# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jul 9 2019 16:03:52 # Log Creation Date: 12.07.2019 15:03:57.030 Process: id = "1" image_name = "1.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe" page_root = "0x4ebbd000" os_pid = "0x8d4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x8d8 [0028.690] GetVersion () returned 0x1db10106 [0028.690] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x3f0000 [0028.699] GetVersionExA (in: lpVersionInformation=0x18fe6c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x100000, dwPlatformId=0x2000, szCSDVersion="") | out: lpVersionInformation=0x18fe6c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0028.699] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x3f07d0 [0028.699] GetCurrentThreadId () returned 0x8d8 [0028.699] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x480) returned 0x3f0858 [0028.699] GetStartupInfoA (in: lpStartupInfo=0x18fec4 | out: lpStartupInfo=0x18fec4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0028.699] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0028.699] GetFileType (hFile=0x0) returned 0x0 [0028.699] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.699] GetFileType (hFile=0x0) returned 0x0 [0028.699] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0028.699] GetFileType (hFile=0x0) returned 0x0 [0028.699] SetHandleCount (uNumber=0x20) returned 0x20 [0028.699] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe\" " [0028.699] GetEnvironmentStringsW () returned 0x255158* [0028.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0028.699] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x570) returned 0x3f0ce0 [0028.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x3f0ce0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0028.699] FreeEnvironmentStringsW (penv=0x255158) returned 1 [0028.699] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f1258 [0028.700] GetACP () returned 0x4e4 [0028.700] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fed0 | out: lpCPInfo=0x18fed0) returned 1 [0028.700] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fea8 | out: lpCPInfo=0x18fea8) returned 1 [0028.700] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0028.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f74c, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ떜BĀ") returned 256 [0028.700] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ떜BĀ", cchSrc=256, lpCharType=0x18f9a8 | out: lpCharType=0x18f9a8) returned 1 [0028.700] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0028.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f728, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ떜BĀ") returned 256 [0028.700] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ떜BĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0028.700] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ떜BĀ", cchSrc=256, lpDestStr=0x18f528, cchDest=256 | out: lpDestStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x161\x2039\x153\x8d\x17e\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb59c\x42\x100") returned 256 [0028.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x220, lpWideCharStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x161\x2039\x153\x8d\x17e\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb59c\x42\x100", cchWideChar=256, lpMultiByteStr=0x18fca8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x01", lpUsedDefaultChar=0x0) returned 256 [0028.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0028.700] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda8, cbMultiByte=256, lpWideCharStr=0x18f708, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ떜BĀ") returned 256 [0028.700] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ떜BĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0028.700] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ떜BĀ", cchSrc=256, lpDestStr=0x18f508, cchDest=256 | out: lpDestStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x191\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x160\x203a\x152\x9d\x17d\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x178\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb59c\x42\x100") returned 256 [0028.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x220, lpWideCharStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x191\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x160\x203a\x152\x9d\x17d\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x178\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x20ac\x81\x201a\x192\x201e\x2026\x2020\x2021\x2c6\x2030\x160\x2039\x152\x8d\x17d\x8f\x90\x2018\x2019\x201c\x201d\x2022\x2013\x2014\x2dc\x2122\x161\x203a\x153\x9d\x17e\x178\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb59c\x42\x100", cchWideChar=256, lpMultiByteStr=0x18fba8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x01", lpUsedDefaultChar=0x0) returned 256 [0028.700] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x42a10c, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe")) returned 0x2b [0028.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x40) returned 0x3f1280 [0028.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0xa0) returned 0x3f12c8 [0028.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f1370 [0028.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x40) returned 0x3f1398 [0028.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x40) returned 0x3f13e0 [0028.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x40) returned 0x3f1428 [0028.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x40) returned 0x3f1470 [0028.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f14b8 [0028.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x30) returned 0x3f14e0 [0028.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f1518 [0028.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x10) returned 0x3f1540 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x30) returned 0x3f1558 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x40) returned 0x3f1590 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f15d8 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f1600 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x10) returned 0x3f1628 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x70) returned 0x3f1640 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x40) returned 0x3f16b8 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f1700 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f1728 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x50) returned 0x3f1750 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f17a8 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f17d0 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f17f8 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x30) returned 0x3f1820 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x30) returned 0x3f1858 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f1890 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x50) returned 0x3f18b8 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f1910 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x10) returned 0x3f1938 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f1950 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x30) returned 0x3f1978 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x30) returned 0x3f19b0 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f19e8 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f1a10 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x30) returned 0x3f1a38 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3f1a70 [0028.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x20) returned 0x3fc300 [0028.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x50) returned 0x3fc328 [0028.702] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x3f0ce0 | out: hHeap=0x3f0000) returned 1 [0028.702] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76c20000 [0028.702] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0028.702] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0028.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x80) returned 0x3f0ce0 [0028.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x800) returned 0x3fc380 [0028.702] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40d220) returned 0x0 [0028.702] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.702] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.703] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.703] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.703] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.703] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.703] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.703] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.703] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.703] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.703] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.703] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.703] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.704] GlobalLock (hMem=0x1c10004) returned 0x255da0 [0028.704] LocalAlloc (uFlags=0x40, uBytes=0x118) returned 0x255eb0 [0028.704] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x255fe8 [0028.704] LocalAlloc (uFlags=0x0, uBytes=0x8) returned 0x2563d0 [0028.704] GetVersion () returned 0x1db10106 [0028.704] LocalAlloc (uFlags=0x40, uBytes=0x1074) returned 0x2563e0 [0028.704] GetACP () returned 0x4e4 [0028.704] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.704] GetCursorPos (in: lpPoint=0x421abc | out: lpPoint=0x421abc*(x=820, y=457)) returned 1 [0028.705] LocalAlloc (uFlags=0x40, uBytes=0x3c) returned 0x257460 [0028.705] LocalReAlloc (hMem=0x2563d0, uBytes=0xc, uFlags=0x2) returned 0x2574a8 [0028.705] GetCurrentThread () returned 0xfffffffe [0028.705] GetCurrentThreadId () returned 0x8d8 [0028.705] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.705] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.705] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.705] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.705] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.705] RegisterClipboardFormatA (lpszFormat="commctrl_DragListMsg") returned 0xc0fd [0028.705] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.705] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.705] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.705] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.705] GetVersion () returned 0x1db10106 [0028.705] GetProcessVersion (ProcessId=0x0) returned 0x40000 [0028.705] GetSystemMetrics (nIndex=11) returned 32 [0028.967] GetSystemMetrics (nIndex=12) returned 32 [0028.967] GetSystemMetrics (nIndex=2) returned 17 [0028.967] GetSystemMetrics (nIndex=3) returned 17 [0028.967] GetDC (hWnd=0x0) returned 0x160107c7 [0028.967] GetDeviceCaps (hdc=0x160107c7, index=88) returned 96 [0028.967] GetDeviceCaps (hdc=0x160107c7, index=90) returned 96 [0028.967] ReleaseDC (hWnd=0x0, hDC=0x160107c7) returned 1 [0028.967] GetSysColor (nIndex=15) returned 0xf0f0f0 [0028.967] GetSysColor (nIndex=16) returned 0xa0a0a0 [0028.967] GetSysColor (nIndex=20) returned 0xffffff [0028.967] GetSysColor (nIndex=18) returned 0x0 [0028.967] GetSysColor (nIndex=6) returned 0x646464 [0028.967] GetSysColorBrush (nIndex=15) returned 0x1100059 [0028.967] GetSysColorBrush (nIndex=6) returned 0x1100061 [0028.967] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0028.967] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0028.967] RtlSizeHeap (HeapHandle=0x3f0000, Flags=0x0, MemoryPointer=0x3f0ce0) returned 0x80 [0028.967] GetOEMCP () returned 0x1b5 [0028.967] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x18fed8 | out: lpCPInfo=0x18fed8) returned 1 [0028.967] GetStartupInfoA (in: lpStartupInfo=0x18ff2c | out: lpStartupInfo=0x18ff2c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0028.968] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0028.968] SetErrorMode (uMode=0x0) returned 0x0 [0028.968] SetErrorMode (uMode=0x8001) returned 0x0 [0028.968] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18fcb4, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe")) returned 0x2b [0028.968] lstrcpynA (in: lpString1=0x18fdb8, lpString2="1", iMaxLength=260 | out: lpString1="1") returned="1" [0028.968] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x10) returned 0x3fcb88 [0028.968] LoadStringA (in: hInstance=0x400000, uID=0xe000, lpBuffer=0x18fbb4, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0028.968] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x10) returned 0x3fcba0 [0028.968] lstrcpyA (in: lpString1=0x18fcdb, lpString2=".HLP" | out: lpString1=".HLP") returned=".HLP" [0028.968] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x30) returned 0x3fcbb8 [0028.968] lstrcatA (in: lpString1="1", lpString2=".INI" | out: lpString1="1.INI") returned="1.INI" [0028.968] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x10) returned 0x3fcbf0 [0028.968] GetCurrentThreadId () returned 0x8d8 [0028.968] SetWindowsHookExA (idHook=-1, lpfn=0x410a4b, hmod=0x0, dwThreadId=0x8d8) returned 0x301c3 [0028.968] LocalAlloc (uFlags=0x40, uBytes=0x30) returned 0x257518 [0028.969] LocalAlloc (uFlags=0x40, uBytes=0x4) returned 0x257840 [0028.969] LocalReAlloc (hMem=0x2574a8, uBytes=0x10, uFlags=0x2) returned 0x2574a8 [0028.969] GetProcessHeap () returned 0x240000 [0028.973] SHGetSpecialFolderPathA (in: hwnd=0x0, pszPath=0x18fd80, csidl=5, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0029.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x29) returned 0x259050 [0029.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2d) returned 0x259248 [0029.650] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\*.*", lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa0fc710, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fc710, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x18fb3c, cFileName=".", cAlternateFileName="")) returned 0x2592e8 [0029.650] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa0fc710, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fc710, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x18fb3c, cFileName="..", cAlternateFileName="")) returned 1 [0029.651] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x346331d0, ftCreationTime.dwHighDateTime=0x1d4cfc5, ftLastAccessTime.dwLowDateTime=0xad672080, ftLastAccessTime.dwHighDateTime=0x1d4d594, ftLastWriteTime.dwLowDateTime=0xad672080, ftLastWriteTime.dwHighDateTime=0x1d4d594, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x1c, dwReserved1=0x18fb3c, cFileName="-MKqyxYjc5JRno0_.xlsx", cAlternateFileName="-MKQYX~1.XLS")) returned 1 [0029.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x259280 [0029.651] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0029.651] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3f) returned 0x257980 [0029.651] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\-MKqyxYjc5JRno0_.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-mkqyxyjc5jrno0_.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.651] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x142a6 [0029.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x142ae) returned 0x25a330 [0029.651] ReadFile (in: hFile=0xc4, lpBuffer=0x25a338, nNumberOfBytesToRead=0x142a6, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a338*, lpNumberOfBytesRead=0x18fe70*=0x142a6, lpOverlapped=0x0) returned 1 [0029.653] CloseHandle (hObject=0xc4) returned 1 [0029.653] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\-MKqyxYjc5JRno0_.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-mkqyxyjc5jrno0_.xlsx")) returned 1 [0029.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0029.655] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259248 [0029.655] GetTickCount () returned 0x18229 [0029.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256168 [0029.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2592a0 [0029.655] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.655] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.655] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098857" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098857"), lpSecurityAttributes=0x256150) returned 1 [0029.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x26e5e8 [0029.663] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098857\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098857\\...."), lpSecurityAttributes=0x256150) returned 1 [0029.663] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x26e5e8 | out: hHeap=0x240000) returned 1 [0029.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x26e5e8 [0029.663] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\-MKqyxYjc5JRno0_.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-mkqyxyjc5jrno0_.xlsx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098857\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098857\\....\\temporaryfile")) returned 0 [0029.664] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x26e5e8 | out: hHeap=0x240000) returned 1 [0029.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x26e5e8 [0029.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x2579c8 [0029.664] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098857\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098857\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098857\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098857\\temporaryfile")) returned 1 [0029.666] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x26e5e8 | out: hHeap=0x240000) returned 1 [0029.667] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2579c8 | out: hHeap=0x240000) returned 1 [0029.667] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098857\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16bd69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16bfcb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16bfcb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x259320, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x26e650 [0029.667] FindNextFileA (in: hFindFile=0x26e650, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16bd69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16bfcb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16bfcb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x259320, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0029.667] FindNextFileA (in: hFindFile=0x26e650, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16bfcb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16bfcb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16bfcb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x259320, dwReserved1=0x240000, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.667] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098857\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16bfcb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16bfcb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16bfcb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26e66c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x26e5e8 [0029.667] FindNextFileA (in: hFindFile=0x26e5e8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16bfcb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16bfcb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16bfcb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26e66c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.667] FindNextFileA (in: hFindFile=0x26e5e8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16bfcb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16bfcb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16bfcb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26e66c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.667] FindClose (in: hFindFile=0x26e5e8 | out: hFindFile=0x26e5e8) returned 1 [0029.667] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098857\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098857\\temporaryfile")) returned 1 [0029.667] FindNextFileA (in: hFindFile=0x26e650, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16bfcb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16bfcb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16bfcb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x259320, dwReserved1=0x240000, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.667] FindClose (in: hFindFile=0x26e650 | out: hFindFile=0x26e650) returned 1 [0029.668] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098857" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098857")) returned 1 [0029.668] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\-MKqyxYjc5JRno0_.xlsx") returned 0 [0029.668] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2592a0 | out: hHeap=0x240000) returned 1 [0029.668] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x48) returned 0x26e5e8 [0029.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x257618 [0029.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.668] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257618 | out: hHeap=0x240000) returned 1 [0029.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x142b0) returned 0x2150048 [0029.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x142b8) returned 0x26e638 [0029.671] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.671] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\-MKqyxYjc5JRno0_.xlsx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-mkqyxyjc5jrno0_.xlsx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.685] WriteFile (in: hFile=0xc4, lpBuffer=0x26e640*, nNumberOfBytesToWrite=0x142b0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26e640*, lpNumberOfBytesWritten=0x18fe58*=0x142b0, lpOverlapped=0x0) returned 1 [0029.689] CloseHandle (hObject=0xc4) returned 1 [0029.692] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x26e5e8 | out: hHeap=0x240000) returned 1 [0029.692] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x26e638 | out: hHeap=0x240000) returned 1 [0029.692] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.692] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.692] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f7754e0, ftCreationTime.dwHighDateTime=0x1d4c9d2, ftLastAccessTime.dwLowDateTime=0x1390e510, ftLastAccessTime.dwHighDateTime=0x1d4c660, ftLastWriteTime.dwLowDateTime=0x1390e510, ftLastWriteTime.dwHighDateTime=0x1d4c660, nFileSizeHigh=0x0, nFileSizeLow=0x7cd9, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="4su2oko3I.odp", cAlternateFileName="4SU2OK~1.ODP")) returned 1 [0029.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x256150 [0029.692] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259280 | out: hHeap=0x240000) returned 1 [0029.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x37) returned 0x259248 [0029.692] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\4su2oko3I.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4su2oko3i.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.692] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x7cd9 [0029.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce1) returned 0x25a330 [0029.692] ReadFile (in: hFile=0xc4, lpBuffer=0x25a338, nNumberOfBytesToRead=0x7cd9, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a338*, lpNumberOfBytesRead=0x18fe70*=0x7cd9, lpOverlapped=0x0) returned 1 [0029.693] CloseHandle (hObject=0xc4) returned 1 [0029.694] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\4su2oko3I.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4su2oko3i.odp")) returned 1 [0029.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.696] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.696] GetTickCount () returned 0x18258 [0029.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256180 [0029.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262020 [0029.696] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.696] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256180 | out: hHeap=0x240000) returned 1 [0029.696] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098904" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098904"), lpSecurityAttributes=0x256168) returned 1 [0029.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.697] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098904\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.699] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.699] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259288 [0029.699] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\4su2oko3I.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4su2oko3i.odp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098904\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098904\\....\\temporaryfile")) returned 0 [0029.700] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x257980 [0029.700] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098904\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098904\\temporaryfile")) returned 1 [0029.701] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.701] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.701] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098904\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c48e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c48e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c48e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.702] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c48e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c48e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c48e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.702] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c48e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c48e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c48e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.702] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098904\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c48e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c48e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c48e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2630e8 [0029.702] FindNextFileA (in: hFindFile=0x2630e8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c48e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c48e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c48e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.702] FindNextFileA (in: hFindFile=0x2630e8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c48e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c48e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c48e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.702] FindClose (in: hFindFile=0x2630e8 | out: hFindFile=0x2630e8) returned 1 [0029.702] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098904\\temporaryfile")) returned 1 [0029.702] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c48e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c48e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c48e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.702] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.702] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098904" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098904")) returned 1 [0029.702] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\4su2oko3I.odp") returned 0 [0029.703] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x262020 | out: hHeap=0x240000) returned 1 [0029.703] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x257980 [0029.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x257618 [0029.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.703] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257618 | out: hHeap=0x240000) returned 1 [0029.703] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x7ce0) returned 0x2150048 [0029.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x7ce8) returned 0x262020 [0029.704] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.704] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.704] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\4su2oko3I.odp.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4su2oko3i.odp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.704] WriteFile (in: hFile=0xc4, lpBuffer=0x262028*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x262028*, lpNumberOfBytesWritten=0x18fe58*=0x7ce0, lpOverlapped=0x0) returned 1 [0029.706] CloseHandle (hObject=0xc4) returned 1 [0029.707] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.707] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x262020 | out: hHeap=0x240000) returned 1 [0029.707] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.707] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.707] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5378a40, ftCreationTime.dwHighDateTime=0x1d4d8c9, ftLastAccessTime.dwLowDateTime=0x4488c210, ftLastAccessTime.dwHighDateTime=0x1d4f5c6, ftLastWriteTime.dwLowDateTime=0x4488c210, ftLastWriteTime.dwHighDateTime=0x1d4f5c6, nFileSizeHigh=0x0, nFileSizeLow=0x3d04, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="5uCl6.pptx", cAlternateFileName="5UCL6~1.PPT")) returned 1 [0029.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256168 [0029.707] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259248 [0029.707] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\5uCl6.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5ucl6.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.707] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x3d04 [0029.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d0c) returned 0x25a330 [0029.708] ReadFile (in: hFile=0xc4, lpBuffer=0x25a338, nNumberOfBytesToRead=0x3d04, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a338*, lpNumberOfBytesRead=0x18fe70*=0x3d04, lpOverlapped=0x0) returned 1 [0029.708] CloseHandle (hObject=0xc4) returned 1 [0029.708] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\5uCl6.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5ucl6.pptx")) returned 1 [0029.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0029.710] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.710] GetTickCount () returned 0x18268 [0029.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256180 [0029.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25e048 [0029.710] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.710] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256180 | out: hHeap=0x240000) returned 1 [0029.710] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920"), lpSecurityAttributes=0x256150) returned 1 [0029.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.711] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920\\...."), lpSecurityAttributes=0x256150) returned 1 [0029.711] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259288 [0029.711] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\5uCl6.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5ucl6.pptx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920\\....\\temporaryfile")) returned 0 [0029.711] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x257980 [0029.711] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920\\temporaryfile")) returned 1 [0029.712] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.712] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.712] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.712] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.713] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.713] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25f110 [0029.713] FindNextFileA (in: hFindFile=0x25f110, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.713] FindNextFileA (in: hFindFile=0x25f110, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.713] FindClose (in: hFindFile=0x25f110 | out: hFindFile=0x25f110) returned 1 [0029.713] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920\\temporaryfile")) returned 1 [0029.713] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.713] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.713] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920")) returned 1 [0029.713] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\5uCl6.pptx") returned 0 [0029.713] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e048 | out: hHeap=0x240000) returned 1 [0029.713] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3d) returned 0x257980 [0029.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x257618 [0029.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.714] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257618 | out: hHeap=0x240000) returned 1 [0029.714] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x3d10) returned 0x2150048 [0029.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3d10) returned 0x25e048 [0029.714] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.714] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\5uCl6.pptx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5ucl6.pptx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.714] WriteFile (in: hFile=0xc4, lpBuffer=0x25e050*, nNumberOfBytesToWrite=0x3d08, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25e050*, lpNumberOfBytesWritten=0x18fe58*=0x3d08, lpOverlapped=0x0) returned 1 [0029.715] CloseHandle (hObject=0xc4) returned 1 [0029.716] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.716] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e048 | out: hHeap=0x240000) returned 1 [0029.716] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.716] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.716] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa63e7a80, ftCreationTime.dwHighDateTime=0x1d4c75f, ftLastAccessTime.dwLowDateTime=0xbbee7540, ftLastAccessTime.dwHighDateTime=0x1d4d431, ftLastWriteTime.dwLowDateTime=0xbbee7540, ftLastWriteTime.dwHighDateTime=0x1d4d431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="6b 5xTdqcrCQ2", cAlternateFileName="6B5XTD~1")) returned 1 [0029.716] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf413fc90, ftCreationTime.dwHighDateTime=0x1d4ca97, ftLastAccessTime.dwLowDateTime=0x2ba58090, ftLastAccessTime.dwHighDateTime=0x1d4d0bd, ftLastWriteTime.dwLowDateTime=0x2ba58090, ftLastWriteTime.dwHighDateTime=0x1d4d0bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="6CaRSI1gd4xA", cAlternateFileName="6CARSI~1")) returned 1 [0029.716] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69694a90, ftCreationTime.dwHighDateTime=0x1d51133, ftLastAccessTime.dwLowDateTime=0xa8d4e390, ftLastAccessTime.dwHighDateTime=0x1d4f3a3, ftLastWriteTime.dwLowDateTime=0xa8d4e390, ftLastWriteTime.dwHighDateTime=0x1d4f3a3, nFileSizeHigh=0x0, nFileSizeLow=0x3849, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="76hRSKD790-L.pptx", cAlternateFileName="76HRSK~1.PPT")) returned 1 [0029.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x259248 [0029.716] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3b) returned 0x257980 [0029.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\76hRSKD790-L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\76hrskd790-l.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.717] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x3849 [0029.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3851) returned 0x25a330 [0029.717] ReadFile (in: hFile=0xc4, lpBuffer=0x25a338, nNumberOfBytesToRead=0x3849, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a338*, lpNumberOfBytesRead=0x18fe70*=0x3849, lpOverlapped=0x0) returned 1 [0029.717] CloseHandle (hObject=0xc4) returned 1 [0029.717] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\76hRSKD790-L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\76hrskd790-l.pptx")) returned 1 [0029.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.719] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259268 [0029.719] GetTickCount () returned 0x18268 [0029.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259298 [0029.719] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.719] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.719] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920"), lpSecurityAttributes=0x256168) returned 1 [0029.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25db90 [0029.720] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.720] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25db90 | out: hHeap=0x240000) returned 1 [0029.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x25db90 [0029.720] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\76hRSKD790-L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\76hrskd790-l.pptx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920\\....\\temporaryfile")) returned 0 [0029.720] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25db90 | out: hHeap=0x240000) returned 1 [0029.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25db90 [0029.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x2579c8 [0029.720] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920\\temporaryfile")) returned 1 [0029.722] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25db90 | out: hHeap=0x240000) returned 1 [0029.722] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2579c8 | out: hHeap=0x240000) returned 1 [0029.722] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25dbf8 [0029.722] FindNextFileA (in: hFindFile=0x25dbf8, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.722] FindNextFileA (in: hFindFile=0x25dbf8, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.722] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25dc14, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25db90 [0029.722] FindNextFileA (in: hFindFile=0x25db90, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25dc14, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.722] FindNextFileA (in: hFindFile=0x25db90, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25dc14, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.722] FindClose (in: hFindFile=0x25db90 | out: hFindFile=0x25db90) returned 1 [0029.722] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920\\temporaryfile")) returned 1 [0029.723] FindNextFileA (in: hFindFile=0x25dbf8, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c6ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c6ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c6ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.723] FindClose (in: hFindFile=0x25dbf8 | out: hFindFile=0x25dbf8) returned 1 [0029.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098920" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098920")) returned 1 [0029.723] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\76hRSKD790-L.pptx") returned 0 [0029.723] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259298 | out: hHeap=0x240000) returned 1 [0029.723] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x259268 [0029.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x257618 [0029.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.723] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257618 | out: hHeap=0x240000) returned 1 [0029.723] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x3850) returned 0x2150048 [0029.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3858) returned 0x25db90 [0029.724] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.724] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\76hRSKD790-L.pptx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\76hrskd790-l.pptx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.724] WriteFile (in: hFile=0xc4, lpBuffer=0x25db98*, nNumberOfBytesToWrite=0x3850, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25db98*, lpNumberOfBytesWritten=0x18fe58*=0x3850, lpOverlapped=0x0) returned 1 [0029.725] CloseHandle (hObject=0xc4) returned 1 [0029.726] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.726] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25db90 | out: hHeap=0x240000) returned 1 [0029.726] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.726] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.726] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e17fc20, ftCreationTime.dwHighDateTime=0x1d4c661, ftLastAccessTime.dwLowDateTime=0xe936c190, ftLastAccessTime.dwHighDateTime=0x1d4cadd, ftLastWriteTime.dwLowDateTime=0xe936c190, ftLastWriteTime.dwHighDateTime=0x1d4cadd, nFileSizeHigh=0x0, nFileSizeLow=0x12ad6, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="9Vfajx59Z9Z5.docx", cAlternateFileName="9VFAJX~1.DOC")) returned 1 [0029.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x259268 [0029.726] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3b) returned 0x257980 [0029.726] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\9Vfajx59Z9Z5.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9vfajx59z9z5.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.726] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x12ad6 [0029.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12ade) returned 0x25a330 [0029.726] ReadFile (in: hFile=0xc4, lpBuffer=0x25a338, nNumberOfBytesToRead=0x12ad6, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a338*, lpNumberOfBytesRead=0x18fe70*=0x12ad6, lpOverlapped=0x0) returned 1 [0029.728] CloseHandle (hObject=0xc4) returned 1 [0029.728] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\9Vfajx59Z9Z5.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9vfajx59z9z5.docx")) returned 1 [0029.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.729] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.730] GetTickCount () returned 0x18277 [0029.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x26ce18 [0029.730] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.730] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.730] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098935" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098935"), lpSecurityAttributes=0x256168) returned 1 [0029.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.730] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098935\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098935\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.731] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259288 [0029.731] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\9Vfajx59Z9Z5.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9vfajx59z9z5.docx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098935\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098935\\....\\temporaryfile")) returned 0 [0029.731] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x2579c8 [0029.731] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098935\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098935\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098935\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098935\\temporaryfile")) returned 1 [0029.732] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.732] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2579c8 | out: hHeap=0x240000) returned 1 [0029.732] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098935\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c950c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c950c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c950c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.732] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c950c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c950c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c950c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.732] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c950c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c950c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c950c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.732] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098935\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c950c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c950c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c950c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x26dee0 [0029.732] FindNextFileA (in: hFindFile=0x26dee0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c950c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c950c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c950c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.732] FindNextFileA (in: hFindFile=0x26dee0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c950c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c950c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c950c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.732] FindClose (in: hFindFile=0x26dee0 | out: hFindFile=0x26dee0) returned 1 [0029.733] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098935\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098935\\temporaryfile")) returned 1 [0029.733] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16c950c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16c950c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16c950c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.733] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.733] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098935" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098935")) returned 1 [0029.733] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\9Vfajx59Z9Z5.docx") returned 0 [0029.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x26ce18 | out: hHeap=0x240000) returned 1 [0029.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x259288 [0029.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x2592d8 [0029.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.733] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2592d8 | out: hHeap=0x240000) returned 1 [0029.733] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x12ae0) returned 0x2150048 [0029.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12ae8) returned 0x26ce18 [0029.734] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.735] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.735] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\9Vfajx59Z9Z5.docx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9vfajx59z9z5.docx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.735] WriteFile (in: hFile=0xc4, lpBuffer=0x26ce20*, nNumberOfBytesToWrite=0x12ae0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26ce20*, lpNumberOfBytesWritten=0x18fe58*=0x12ae0, lpOverlapped=0x0) returned 1 [0029.737] CloseHandle (hObject=0xc4) returned 1 [0029.738] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.738] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x26ce18 | out: hHeap=0x240000) returned 1 [0029.738] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.738] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.738] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa9950e0, ftCreationTime.dwHighDateTime=0x1d4cd4b, ftLastAccessTime.dwLowDateTime=0xfc930f0, ftLastAccessTime.dwHighDateTime=0x1d4d451, ftLastWriteTime.dwLowDateTime=0xfc930f0, ftLastWriteTime.dwHighDateTime=0x1d4d451, nFileSizeHigh=0x0, nFileSizeLow=0x4431, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="aajrkz KC.doc", cAlternateFileName="AAJRKZ~1.DOC")) returned 1 [0029.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x256168 [0029.739] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x37) returned 0x259248 [0029.739] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\aajrkz KC.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aajrkz kc.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.739] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x4431 [0029.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4439) returned 0x25a330 [0029.739] ReadFile (in: hFile=0xc4, lpBuffer=0x25a338, nNumberOfBytesToRead=0x4431, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a338*, lpNumberOfBytesRead=0x18fe70*=0x4431, lpOverlapped=0x0) returned 1 [0029.740] CloseHandle (hObject=0xc4) returned 1 [0029.740] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\aajrkz KC.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aajrkz kc.doc")) returned 1 [0029.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0029.743] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.743] GetTickCount () returned 0x18287 [0029.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256180 [0029.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25e778 [0029.743] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.743] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256180 | out: hHeap=0x240000) returned 1 [0029.743] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098951" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098951"), lpSecurityAttributes=0x256150) returned 1 [0029.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.744] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098951\\...."), lpSecurityAttributes=0x256150) returned 1 [0029.744] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259288 [0029.744] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\aajrkz KC.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aajrkz kc.doc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098951\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098951\\....\\temporaryfile")) returned 0 [0029.744] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x257980 [0029.744] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098951\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098951\\temporaryfile")) returned 1 [0029.745] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.745] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.746] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098951\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16cbb220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16cbb220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16cbb220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.746] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16cbb220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16cbb220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16cbb220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.746] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16cbb220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16cbb220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16cbb220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.746] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098951\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16cbb220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16cbb220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16cbb220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25f840 [0029.746] FindNextFileA (in: hFindFile=0x25f840, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16cbb220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16cbb220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16cbb220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.746] FindNextFileA (in: hFindFile=0x25f840, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16cbb220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16cbb220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16cbb220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.746] FindClose (in: hFindFile=0x25f840 | out: hFindFile=0x25f840) returned 1 [0029.746] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098951\\temporaryfile")) returned 1 [0029.746] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16cbb220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16cbb220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16cbb220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.746] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.746] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098951" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098951")) returned 1 [0029.746] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\aajrkz KC.doc") returned 0 [0029.747] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e778 | out: hHeap=0x240000) returned 1 [0029.747] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x257980 [0029.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x257618 [0029.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.747] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257618 | out: hHeap=0x240000) returned 1 [0029.747] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x4440) returned 0x2150048 [0029.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4440) returned 0x25e778 [0029.747] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.747] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\aajrkz KC.doc.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aajrkz kc.doc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.748] WriteFile (in: hFile=0xc4, lpBuffer=0x25e780*, nNumberOfBytesToWrite=0x4438, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25e780*, lpNumberOfBytesWritten=0x18fe58*=0x4438, lpOverlapped=0x0) returned 1 [0029.749] CloseHandle (hObject=0xc4) returned 1 [0029.749] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.749] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25e778 | out: hHeap=0x240000) returned 1 [0029.749] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.749] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.749] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724facf0, ftCreationTime.dwHighDateTime=0x1d4f304, ftLastAccessTime.dwLowDateTime=0xdf994710, ftLastAccessTime.dwHighDateTime=0x1d4b99f, ftLastWriteTime.dwLowDateTime=0xdf994710, ftLastWriteTime.dwHighDateTime=0x1d4b99f, nFileSizeHigh=0x0, nFileSizeLow=0x62ee, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="akWullZV3EwuyRnw.pptx", cAlternateFileName="AKWULL~1.PPT")) returned 1 [0029.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x259248 [0029.749] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3f) returned 0x257980 [0029.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\akWullZV3EwuyRnw.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\akwullzv3ewuyrnw.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.750] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x62ee [0029.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x62f6) returned 0x25a330 [0029.750] ReadFile (in: hFile=0xc4, lpBuffer=0x25a338, nNumberOfBytesToRead=0x62ee, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a338*, lpNumberOfBytesRead=0x18fe70*=0x62ee, lpOverlapped=0x0) returned 1 [0029.751] CloseHandle (hObject=0xc4) returned 1 [0029.751] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\akWullZV3EwuyRnw.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\akwullzv3ewuyrnw.pptx")) returned 1 [0029.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.752] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259268 [0029.752] GetTickCount () returned 0x18297 [0029.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259298 [0029.752] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.753] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.753] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967"), lpSecurityAttributes=0x256168) returned 1 [0029.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x260630 [0029.753] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.753] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x260630 | out: hHeap=0x240000) returned 1 [0029.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x260630 [0029.753] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\akWullZV3EwuyRnw.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\akwullzv3ewuyrnw.pptx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967\\....\\temporaryfile")) returned 0 [0029.754] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x260630 | out: hHeap=0x240000) returned 1 [0029.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x260630 [0029.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x2579c8 [0029.754] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967\\temporaryfile")) returned 1 [0029.755] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x260630 | out: hHeap=0x240000) returned 1 [0029.755] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2579c8 | out: hHeap=0x240000) returned 1 [0029.755] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x260698 [0029.755] FindNextFileA (in: hFindFile=0x260698, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.755] FindNextFileA (in: hFindFile=0x260698, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.755] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2606b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x260630 [0029.755] FindNextFileA (in: hFindFile=0x260630, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2606b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.755] FindNextFileA (in: hFindFile=0x260630, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2606b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.755] FindClose (in: hFindFile=0x260630 | out: hFindFile=0x260630) returned 1 [0029.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967\\temporaryfile")) returned 1 [0029.755] FindNextFileA (in: hFindFile=0x260698, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.755] FindClose (in: hFindFile=0x260698 | out: hFindFile=0x260698) returned 1 [0029.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967")) returned 1 [0029.756] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\akWullZV3EwuyRnw.pptx") returned 0 [0029.756] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259298 | out: hHeap=0x240000) returned 1 [0029.756] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x48) returned 0x259268 [0029.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x257618 [0029.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.756] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257618 | out: hHeap=0x240000) returned 1 [0029.756] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x6300) returned 0x2150048 [0029.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x6300) returned 0x260630 [0029.756] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.756] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\akWullZV3EwuyRnw.pptx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\akwullzv3ewuyrnw.pptx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.757] WriteFile (in: hFile=0xc4, lpBuffer=0x260638*, nNumberOfBytesToWrite=0x62f8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x260638*, lpNumberOfBytesWritten=0x18fe58*=0x62f8, lpOverlapped=0x0) returned 1 [0029.758] CloseHandle (hObject=0xc4) returned 1 [0029.759] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.759] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x260630 | out: hHeap=0x240000) returned 1 [0029.759] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.759] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.759] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c7f7190, ftCreationTime.dwHighDateTime=0x1d50a10, ftLastAccessTime.dwLowDateTime=0x2ca20b80, ftLastAccessTime.dwHighDateTime=0x1d4f197, ftLastWriteTime.dwLowDateTime=0x2ca20b80, ftLastWriteTime.dwHighDateTime=0x1d4f197, nFileSizeHigh=0x0, nFileSizeLow=0x1486c, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="axiblyMnDJq6wybsV.docx", cAlternateFileName="AXIBLY~1.DOC")) returned 1 [0029.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17) returned 0x259268 [0029.759] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x257980 [0029.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\axiblyMnDJq6wybsV.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\axiblymndjq6wybsv.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.759] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x1486c [0029.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14874) returned 0x25a330 [0029.759] ReadFile (in: hFile=0xc4, lpBuffer=0x25a338, nNumberOfBytesToRead=0x1486c, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a338*, lpNumberOfBytesRead=0x18fe70*=0x1486c, lpOverlapped=0x0) returned 1 [0029.760] CloseHandle (hObject=0xc4) returned 1 [0029.760] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\axiblyMnDJq6wybsV.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\axiblymndjq6wybsv.docx")) returned 1 [0029.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.763] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.763] GetTickCount () returned 0x18297 [0029.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x26ebb0 [0029.763] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.763] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.763] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967"), lpSecurityAttributes=0x256168) returned 1 [0029.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.763] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.764] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259288 [0029.764] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\axiblyMnDJq6wybsV.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\axiblymndjq6wybsv.docx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967\\....\\temporaryfile")) returned 0 [0029.764] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x2579c8 [0029.764] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967\\temporaryfile")) returned 1 [0029.765] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.765] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2579c8 | out: hHeap=0x240000) returned 1 [0029.765] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.765] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.765] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.765] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x26fc78 [0029.766] FindNextFileA (in: hFindFile=0x26fc78, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.766] FindNextFileA (in: hFindFile=0x26fc78, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.766] FindClose (in: hFindFile=0x26fc78 | out: hFindFile=0x26fc78) returned 1 [0029.766] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967\\temporaryfile")) returned 1 [0029.766] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ce1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ce1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ce1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.766] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.766] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098967" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098967")) returned 1 [0029.766] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\axiblyMnDJq6wybsV.docx") returned 0 [0029.766] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x26ebb0 | out: hHeap=0x240000) returned 1 [0029.766] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x49) returned 0x259288 [0029.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x257618 [0029.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.766] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257618 | out: hHeap=0x240000) returned 1 [0029.766] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x14870) returned 0x2150048 [0029.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x14878) returned 0x26ebb0 [0029.768] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.768] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.769] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\axiblyMnDJq6wybsV.docx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\axiblymndjq6wybsv.docx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.769] WriteFile (in: hFile=0xc4, lpBuffer=0x26ebb8*, nNumberOfBytesToWrite=0x14870, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26ebb8*, lpNumberOfBytesWritten=0x18fe58*=0x14870, lpOverlapped=0x0) returned 1 [0029.771] CloseHandle (hObject=0xc4) returned 1 [0029.772] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.772] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x26ebb0 | out: hHeap=0x240000) returned 1 [0029.772] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.772] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.772] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37cf4c0, ftCreationTime.dwHighDateTime=0x1d4c472, ftLastAccessTime.dwLowDateTime=0xdd5af40, ftLastAccessTime.dwHighDateTime=0x1d518b6, ftLastWriteTime.dwLowDateTime=0xdd5af40, ftLastWriteTime.dwHighDateTime=0x1d518b6, nFileSizeHigh=0x0, nFileSizeLow=0x2631, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="BEthdv.xlsx", cAlternateFileName="BETHDV~1.XLS")) returned 1 [0029.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256168 [0029.772] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x35) returned 0x259248 [0029.772] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\BEthdv.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\bethdv.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.772] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x2631 [0029.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2639) returned 0x25a330 [0029.772] ReadFile (in: hFile=0xc4, lpBuffer=0x25a338, nNumberOfBytesToRead=0x2631, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a338*, lpNumberOfBytesRead=0x18fe70*=0x2631, lpOverlapped=0x0) returned 1 [0029.773] CloseHandle (hObject=0xc4) returned 1 [0029.773] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\BEthdv.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\bethdv.xlsx")) returned 1 [0029.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0029.775] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.775] GetTickCount () returned 0x182a6 [0029.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256180 [0029.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c978 [0029.775] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.775] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256180 | out: hHeap=0x240000) returned 1 [0029.775] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098982" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098982"), lpSecurityAttributes=0x256150) returned 1 [0029.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.775] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098982\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098982\\...."), lpSecurityAttributes=0x256150) returned 1 [0029.776] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259288 [0029.776] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\BEthdv.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\bethdv.xlsx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098982\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098982\\....\\temporaryfile")) returned 0 [0029.776] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x257980 [0029.776] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098982\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098982\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098982\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098982\\temporaryfile")) returned 1 [0029.777] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.777] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098982\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d074e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d074e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d074e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.777] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d074e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d074e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d074e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.777] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d074e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d074e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d074e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098982\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d074e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d074e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d074e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25da40 [0029.777] FindNextFileA (in: hFindFile=0x25da40, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d074e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d074e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d074e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.777] FindNextFileA (in: hFindFile=0x25da40, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d074e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d074e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d074e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.777] FindClose (in: hFindFile=0x25da40 | out: hFindFile=0x25da40) returned 1 [0029.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098982\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098982\\temporaryfile")) returned 1 [0029.778] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d074e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d074e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d074e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.778] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.778] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098982" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098982")) returned 1 [0029.778] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\BEthdv.xlsx") returned 0 [0029.778] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c978 | out: hHeap=0x240000) returned 1 [0029.778] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x257980 [0029.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x25c990 [0029.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.778] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c990 | out: hHeap=0x240000) returned 1 [0029.778] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x2640) returned 0x2150048 [0029.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2640) returned 0x25cd78 [0029.778] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.778] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.778] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\BEthdv.xlsx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\bethdv.xlsx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.779] WriteFile (in: hFile=0xc4, lpBuffer=0x25cd80*, nNumberOfBytesToWrite=0x2638, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesWritten=0x18fe58*=0x2638, lpOverlapped=0x0) returned 1 [0029.780] CloseHandle (hObject=0xc4) returned 1 [0029.780] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.780] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd78 | out: hHeap=0x240000) returned 1 [0029.780] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.781] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.781] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8614bb90, ftCreationTime.dwHighDateTime=0x1d4f75a, ftLastAccessTime.dwLowDateTime=0x5b93fc00, ftLastAccessTime.dwHighDateTime=0x1d4b0d3, ftLastWriteTime.dwLowDateTime=0x5b93fc00, ftLastWriteTime.dwHighDateTime=0x1d4b0d3, nFileSizeHigh=0x0, nFileSizeLow=0x57f9, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="CPySWMll AnWU6bLZ9.docx", cAlternateFileName="CPYSWM~1.DOC")) returned 1 [0029.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x259248 [0029.781] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259268 [0029.781] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\CPySWMll AnWU6bLZ9.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cpyswmll anwu6blz9.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.781] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x57f9 [0029.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5801) returned 0x25cd78 [0029.781] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x57f9, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x57f9, lpOverlapped=0x0) returned 1 [0029.782] CloseHandle (hObject=0xc4) returned 1 [0029.782] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\CPySWMll AnWU6bLZ9.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cpyswmll anwu6blz9.docx")) returned 1 [0029.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.783] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2592b8 [0029.783] GetTickCount () returned 0x182b6 [0029.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a330 [0029.784] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2592b8 | out: hHeap=0x240000) returned 1 [0029.784] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.784] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998"), lpSecurityAttributes=0x256168) returned 1 [0029.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a368 [0029.787] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.787] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a368 | out: hHeap=0x240000) returned 1 [0029.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x25a368 [0029.787] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\CPySWMll AnWU6bLZ9.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cpyswmll anwu6blz9.docx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998\\....\\temporaryfile")) returned 0 [0029.787] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a368 | out: hHeap=0x240000) returned 1 [0029.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a368 [0029.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x257980 [0029.787] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998\\temporaryfile")) returned 1 [0029.788] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a368 | out: hHeap=0x240000) returned 1 [0029.788] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a3d0 [0029.789] FindNextFileA (in: hFindFile=0x25a3d0, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.789] FindNextFileA (in: hFindFile=0x25a3d0, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.789] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a368 [0029.789] FindNextFileA (in: hFindFile=0x25a368, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.789] FindNextFileA (in: hFindFile=0x25a368, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.789] FindClose (in: hFindFile=0x25a368 | out: hFindFile=0x25a368) returned 1 [0029.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998\\temporaryfile")) returned 1 [0029.789] FindNextFileA (in: hFindFile=0x25a3d0, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.789] FindClose (in: hFindFile=0x25a3d0 | out: hFindFile=0x25a3d0) returned 1 [0029.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998")) returned 1 [0029.789] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\CPySWMll AnWU6bLZ9.docx") returned 0 [0029.790] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.790] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4a) returned 0x25a330 [0029.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x25c990 [0029.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.790] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c990 | out: hHeap=0x240000) returned 1 [0029.790] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x5800) returned 0x2150048 [0029.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5808) returned 0x262588 [0029.790] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.790] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.790] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\CPySWMll AnWU6bLZ9.docx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cpyswmll anwu6blz9.docx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.790] WriteFile (in: hFile=0xc4, lpBuffer=0x262590*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x262590*, lpNumberOfBytesWritten=0x18fe58*=0x5800, lpOverlapped=0x0) returned 1 [0029.792] CloseHandle (hObject=0xc4) returned 1 [0029.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x262588 | out: hHeap=0x240000) returned 1 [0029.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd78 | out: hHeap=0x240000) returned 1 [0029.792] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.792] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0029.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256168 [0029.793] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x35) returned 0x259248 [0029.793] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.793] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x192 [0029.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19a) returned 0x25a330 [0029.793] ReadFile (in: hFile=0xc4, lpBuffer=0x25a338, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a338*, lpNumberOfBytesRead=0x18fe70*=0x192, lpOverlapped=0x0) returned 1 [0029.794] CloseHandle (hObject=0xc4) returned 1 [0029.794] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini")) returned 1 [0029.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0029.794] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.795] GetTickCount () returned 0x182b6 [0029.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256180 [0029.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a4d8 [0029.795] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.795] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256180 | out: hHeap=0x240000) returned 1 [0029.795] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998"), lpSecurityAttributes=0x256150) returned 1 [0029.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.795] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998\\...."), lpSecurityAttributes=0x256150) returned 1 [0029.796] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259288 [0029.796] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998\\....\\temporaryfile")) returned 0 [0029.796] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x257980 [0029.796] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998\\temporaryfile")) returned 1 [0029.797] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.797] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.797] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.797] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.797] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.797] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b5a0 [0029.797] FindNextFileA (in: hFindFile=0x25b5a0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.797] FindNextFileA (in: hFindFile=0x25b5a0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.797] FindClose (in: hFindFile=0x25b5a0 | out: hFindFile=0x25b5a0) returned 1 [0029.797] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998\\temporaryfile")) returned 1 [0029.798] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d2d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d2d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d2d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.798] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18098998" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18098998")) returned 1 [0029.798] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\desktop.ini") returned 0 [0029.798] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a4d8 | out: hHeap=0x240000) returned 1 [0029.798] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x257980 [0029.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x25c990 [0029.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.798] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c990 | out: hHeap=0x240000) returned 1 [0029.798] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x1a0) returned 0x3fcc08 [0029.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1a0) returned 0x25a4d8 [0029.798] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x3fcc08 | out: hHeap=0x3f0000) returned 1 [0029.798] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.798] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.799] WriteFile (in: hFile=0xc4, lpBuffer=0x25a4e0*, nNumberOfBytesToWrite=0x198, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25a4e0*, lpNumberOfBytesWritten=0x18fe58*=0x198, lpOverlapped=0x0) returned 1 [0029.834] CloseHandle (hObject=0xc4) returned 1 [0029.835] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.835] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a4d8 | out: hHeap=0x240000) returned 1 [0029.835] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.835] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.835] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cb5f80, ftCreationTime.dwHighDateTime=0x1d4b28f, ftLastAccessTime.dwLowDateTime=0x70a9b480, ftLastAccessTime.dwHighDateTime=0x1d50520, ftLastWriteTime.dwLowDateTime=0x70a9b480, ftLastWriteTime.dwHighDateTime=0x1d50520, nFileSizeHigh=0x0, nFileSizeLow=0xd125, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="E5dSTIR0F62ceIRi.xlsx", cAlternateFileName="E5DSTI~1.XLS")) returned 1 [0029.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x259248 [0029.836] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3f) returned 0x257980 [0029.836] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\E5dSTIR0F62ceIRi.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e5dstir0f62ceiri.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.836] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xd125 [0029.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd12d) returned 0x25cd78 [0029.836] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xd125, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xd125, lpOverlapped=0x0) returned 1 [0029.837] CloseHandle (hObject=0xc4) returned 1 [0029.837] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\E5dSTIR0F62ceIRi.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e5dstir0f62ceiri.xlsx")) returned 1 [0029.838] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.838] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.838] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259268 [0029.839] GetTickCount () returned 0x182e5 [0029.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259298 [0029.839] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.839] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.839] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099045" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099045"), lpSecurityAttributes=0x256168) returned 1 [0029.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a330 [0029.839] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099045\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099045\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.839] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x25a330 [0029.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\E5dSTIR0F62ceIRi.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e5dstir0f62ceiri.xlsx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099045\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099045\\....\\temporaryfile")) returned 0 [0029.840] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a330 [0029.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x2579c8 [0029.840] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099045\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099045\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099045\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099045\\temporaryfile")) returned 1 [0029.841] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.841] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2579c8 | out: hHeap=0x240000) returned 1 [0029.841] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099045\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d9fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d9fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d9fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a398 [0029.841] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d9fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d9fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d9fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.841] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d9fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d9fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d9fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.841] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099045\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d9fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d9fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d9fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a330 [0029.841] FindNextFileA (in: hFindFile=0x25a330, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d9fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d9fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d9fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.841] FindNextFileA (in: hFindFile=0x25a330, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d9fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d9fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d9fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.841] FindClose (in: hFindFile=0x25a330 | out: hFindFile=0x25a330) returned 1 [0029.841] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099045\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099045\\temporaryfile")) returned 1 [0029.842] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16d9fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16d9fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16d9fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.842] FindClose (in: hFindFile=0x25a398 | out: hFindFile=0x25a398) returned 1 [0029.842] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099045" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099045")) returned 1 [0029.842] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\E5dSTIR0F62ceIRi.xlsx") returned 0 [0029.842] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259298 | out: hHeap=0x240000) returned 1 [0029.842] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x48) returned 0x259268 [0029.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x25c990 [0029.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.842] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c990 | out: hHeap=0x240000) returned 1 [0029.842] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0xd130) returned 0x2150048 [0029.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xd138) returned 0x269eb0 [0029.843] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.843] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\E5dSTIR0F62ceIRi.xlsx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\e5dstir0f62ceiri.xlsx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.843] WriteFile (in: hFile=0xc4, lpBuffer=0x269eb8*, nNumberOfBytesToWrite=0xd130, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x269eb8*, lpNumberOfBytesWritten=0x18fe58*=0xd130, lpOverlapped=0x0) returned 1 [0029.845] CloseHandle (hObject=0xc4) returned 1 [0029.846] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.846] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x269eb0 | out: hHeap=0x240000) returned 1 [0029.846] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd78 | out: hHeap=0x240000) returned 1 [0029.846] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.846] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc098aa30, ftCreationTime.dwHighDateTime=0x1d4d372, ftLastAccessTime.dwLowDateTime=0x68081a20, ftLastAccessTime.dwHighDateTime=0x1d4d08b, ftLastWriteTime.dwLowDateTime=0x68081a20, ftLastWriteTime.dwHighDateTime=0x1d4d08b, nFileSizeHigh=0x0, nFileSizeLow=0x6c1b, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="eDeJvIUF8LXYojXe.xls", cAlternateFileName="EDEJVI~1.XLS")) returned 1 [0029.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15) returned 0x259268 [0029.847] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x257980 [0029.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\eDeJvIUF8LXYojXe.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\edejviuf8lxyojxe.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.847] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x6c1b [0029.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6c23) returned 0x25cd78 [0029.847] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x6c1b, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x6c1b, lpOverlapped=0x0) returned 1 [0029.848] CloseHandle (hObject=0xc4) returned 1 [0029.848] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\eDeJvIUF8LXYojXe.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\edejviuf8lxyojxe.xls")) returned 1 [0029.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.849] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.849] GetTickCount () returned 0x182f4 [0029.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a330 [0029.849] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.849] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.849] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060"), lpSecurityAttributes=0x256168) returned 1 [0029.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.850] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.850] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259288 [0029.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\eDeJvIUF8LXYojXe.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\edejviuf8lxyojxe.xls"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060\\....\\temporaryfile")) returned 0 [0029.850] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x2579c8 [0029.850] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060\\temporaryfile")) returned 1 [0029.851] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.851] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2579c8 | out: hHeap=0x240000) returned 1 [0029.851] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.852] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.852] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.852] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0029.852] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.852] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.852] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0029.852] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060\\temporaryfile")) returned 1 [0029.852] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.852] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.852] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060")) returned 1 [0029.852] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\eDeJvIUF8LXYojXe.xls") returned 0 [0029.852] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.853] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x47) returned 0x259288 [0029.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x25c990 [0029.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.853] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c990 | out: hHeap=0x240000) returned 1 [0029.853] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0x6c20) returned 0x2150048 [0029.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x6c28) returned 0x2639a8 [0029.853] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.853] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\eDeJvIUF8LXYojXe.xls.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\edejviuf8lxyojxe.xls.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.853] WriteFile (in: hFile=0xc4, lpBuffer=0x2639b0*, nNumberOfBytesToWrite=0x6c20, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x2639b0*, lpNumberOfBytesWritten=0x18fe58*=0x6c20, lpOverlapped=0x0) returned 1 [0029.855] CloseHandle (hObject=0xc4) returned 1 [0029.855] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.855] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2639a8 | out: hHeap=0x240000) returned 1 [0029.856] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd78 | out: hHeap=0x240000) returned 1 [0029.856] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.856] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ecc00, ftCreationTime.dwHighDateTime=0x1d4edef, ftLastAccessTime.dwLowDateTime=0x13c9f4b0, ftLastAccessTime.dwHighDateTime=0x1d5229d, ftLastWriteTime.dwLowDateTime=0x13c9f4b0, ftLastWriteTime.dwHighDateTime=0x1d5229d, nFileSizeHigh=0x0, nFileSizeLow=0xabc0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="iJAd4NLQA5m2_U7sFDwi.docx", cAlternateFileName="IJAD4N~1.DOC")) returned 1 [0029.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x255b30 [0029.856] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x43) returned 0x259248 [0029.856] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\iJAd4NLQA5m2_U7sFDwi.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ijad4nlqa5m2_u7sfdwi.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.856] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xabc0 [0029.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xabc8) returned 0x25cd78 [0029.856] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xabc0, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xabc0, lpOverlapped=0x0) returned 1 [0029.857] CloseHandle (hObject=0xc4) returned 1 [0029.857] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\iJAd4NLQA5m2_U7sFDwi.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ijad4nlqa5m2_u7sfdwi.docx")) returned 1 [0029.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.859] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259298 [0029.859] GetTickCount () returned 0x182f4 [0029.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a330 [0029.859] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259298 | out: hHeap=0x240000) returned 1 [0029.859] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.859] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060"), lpSecurityAttributes=0x256168) returned 1 [0029.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259298 [0029.859] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.860] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259298 | out: hHeap=0x240000) returned 1 [0029.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259298 [0029.860] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\iJAd4NLQA5m2_U7sFDwi.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ijad4nlqa5m2_u7sfdwi.docx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060\\....\\temporaryfile")) returned 0 [0029.860] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259298 | out: hHeap=0x240000) returned 1 [0029.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259298 [0029.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x257980 [0029.860] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060\\temporaryfile")) returned 1 [0029.861] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259298 | out: hHeap=0x240000) returned 1 [0029.861] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259298 [0029.861] FindNextFileA (in: hFindFile=0x259298, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.861] FindNextFileA (in: hFindFile=0x259298, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0029.862] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.862] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.862] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0029.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060\\temporaryfile")) returned 1 [0029.862] FindNextFileA (in: hFindFile=0x259298, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16dc5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16dc5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16dc5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.862] FindClose (in: hFindFile=0x259298 | out: hFindFile=0x259298) returned 1 [0029.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099060" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099060")) returned 1 [0029.862] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\iJAd4NLQA5m2_U7sFDwi.docx") returned 0 [0029.862] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.862] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4c) returned 0x25a330 [0029.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x25c990 [0029.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b58 [0029.862] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c990 | out: hHeap=0x240000) returned 1 [0029.863] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0xabd0) returned 0x2150048 [0029.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xabd0) returned 0x267948 [0029.863] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.863] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b58 | out: hHeap=0x240000) returned 1 [0029.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\iJAd4NLQA5m2_U7sFDwi.docx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ijad4nlqa5m2_u7sfdwi.docx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.864] WriteFile (in: hFile=0xc4, lpBuffer=0x267950*, nNumberOfBytesToWrite=0xabc8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x267950*, lpNumberOfBytesWritten=0x18fe58*=0xabc8, lpOverlapped=0x0) returned 1 [0029.865] CloseHandle (hObject=0xc4) returned 1 [0029.866] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.866] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x267948 | out: hHeap=0x240000) returned 1 [0029.866] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd78 | out: hHeap=0x240000) returned 1 [0029.866] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.866] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c02700, ftCreationTime.dwHighDateTime=0x1d4c95b, ftLastAccessTime.dwLowDateTime=0xc6292660, ftLastAccessTime.dwHighDateTime=0x1d4c700, ftLastWriteTime.dwLowDateTime=0xc6292660, ftLastWriteTime.dwHighDateTime=0x1d4c700, nFileSizeHigh=0x0, nFileSizeLow=0xecc6, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="k8AKeCkuzc4HIIi.xlsx", cAlternateFileName="K8AKEC~1.XLS")) returned 1 [0029.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15) returned 0x259248 [0029.866] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3e) returned 0x257980 [0029.866] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\k8AKeCkuzc4HIIi.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\k8akeckuzc4hiii.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.866] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xecc6 [0029.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xecce) returned 0x25cd78 [0029.866] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xecc6, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xecc6, lpOverlapped=0x0) returned 1 [0029.867] CloseHandle (hObject=0xc4) returned 1 [0029.867] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\k8AKeCkuzc4HIIi.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\k8akeckuzc4hiii.xlsx")) returned 1 [0029.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.874] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259268 [0029.874] GetTickCount () returned 0x18304 [0029.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259298 [0029.874] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.874] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.875] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099076" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099076"), lpSecurityAttributes=0x256168) returned 1 [0029.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a330 [0029.875] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099076\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099076\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.875] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x25a330 [0029.875] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\k8AKeCkuzc4HIIi.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\k8akeckuzc4hiii.xlsx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099076\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099076\\....\\temporaryfile")) returned 0 [0029.875] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a330 [0029.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x2579c8 [0029.876] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099076\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099076\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099076\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099076\\temporaryfile")) returned 1 [0029.877] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.877] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2579c8 | out: hHeap=0x240000) returned 1 [0029.877] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099076\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16debd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16debd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16debd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a398 [0029.877] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16debd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16debd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16debd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.877] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16debd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16debd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16debd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.877] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099076\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16debd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16debd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16debd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a330 [0029.877] FindNextFileA (in: hFindFile=0x25a330, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16debd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16debd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16debd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.877] FindNextFileA (in: hFindFile=0x25a330, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16debd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16debd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16debd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.877] FindClose (in: hFindFile=0x25a330 | out: hFindFile=0x25a330) returned 1 [0029.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099076\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099076\\temporaryfile")) returned 1 [0029.878] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16debd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16debd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16debd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.878] FindClose (in: hFindFile=0x25a398 | out: hFindFile=0x25a398) returned 1 [0029.878] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099076" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099076")) returned 1 [0029.878] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\k8AKeCkuzc4HIIi.xlsx") returned 0 [0029.878] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259298 | out: hHeap=0x240000) returned 1 [0029.878] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x47) returned 0x259268 [0029.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x25c990 [0029.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.878] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c990 | out: hHeap=0x240000) returned 1 [0029.878] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0xecd0) returned 0x2150048 [0029.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xecd8) returned 0x26ba50 [0029.879] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.879] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\k8AKeCkuzc4HIIi.xlsx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\k8akeckuzc4hiii.xlsx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.880] WriteFile (in: hFile=0xc4, lpBuffer=0x26ba58*, nNumberOfBytesToWrite=0xecd0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26ba58*, lpNumberOfBytesWritten=0x18fe58*=0xecd0, lpOverlapped=0x0) returned 1 [0029.881] CloseHandle (hObject=0xc4) returned 1 [0029.882] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.882] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x26ba50 | out: hHeap=0x240000) returned 1 [0029.882] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd78 | out: hHeap=0x240000) returned 1 [0029.882] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.882] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x243e5910, ftCreationTime.dwHighDateTime=0x1d4ddb2, ftLastAccessTime.dwLowDateTime=0x4884fe40, ftLastAccessTime.dwHighDateTime=0x1d4f67c, ftLastWriteTime.dwLowDateTime=0x4884fe40, ftLastWriteTime.dwHighDateTime=0x1d4f67c, nFileSizeHigh=0x0, nFileSizeLow=0xbde2, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="KczBX1JhveWm.xlsx", cAlternateFileName="KCZBX1~1.XLS")) returned 1 [0029.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x259268 [0029.882] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259248 | out: hHeap=0x240000) returned 1 [0029.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3b) returned 0x257980 [0029.882] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\KczBX1JhveWm.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kczbx1jhvewm.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.883] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xbde2 [0029.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbdea) returned 0x25cd78 [0029.883] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xbde2, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xbde2, lpOverlapped=0x0) returned 1 [0029.884] CloseHandle (hObject=0xc4) returned 1 [0029.884] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\KczBX1JhveWm.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kczbx1jhvewm.xlsx")) returned 1 [0029.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.885] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.885] GetTickCount () returned 0x18313 [0029.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a330 [0029.885] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.885] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.886] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099091" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099091"), lpSecurityAttributes=0x256168) returned 1 [0029.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.886] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099091\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099091\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.886] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259288 [0029.886] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\KczBX1JhveWm.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kczbx1jhvewm.xlsx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099091\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099091\\....\\temporaryfile")) returned 0 [0029.886] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x2579c8 [0029.886] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099091\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099091\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099091\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099091\\temporaryfile")) returned 1 [0029.888] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.888] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2579c8 | out: hHeap=0x240000) returned 1 [0029.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099091\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e11e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e11e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e11e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.888] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e11e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e11e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e11e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.888] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e11e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e11e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e11e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099091\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e11e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e11e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e11e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0029.888] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e11e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e11e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e11e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.888] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e11e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e11e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e11e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.888] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0029.888] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099091\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099091\\temporaryfile")) returned 1 [0029.888] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e11e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e11e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e11e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.888] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.888] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099091" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099091")) returned 1 [0029.888] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\KczBX1JhveWm.xlsx") returned 0 [0029.889] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.889] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256168 | out: hHeap=0x240000) returned 1 [0029.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x44) returned 0x259288 [0029.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x25c990 [0029.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.889] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c990 | out: hHeap=0x240000) returned 1 [0029.889] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0xbdf0) returned 0x2150048 [0029.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xbdf0) returned 0x268b70 [0029.890] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.890] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b30 | out: hHeap=0x240000) returned 1 [0029.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\KczBX1JhveWm.xlsx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kczbx1jhvewm.xlsx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.890] WriteFile (in: hFile=0xc4, lpBuffer=0x268b78*, nNumberOfBytesToWrite=0xbde8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x268b78*, lpNumberOfBytesWritten=0x18fe58*=0xbde8, lpOverlapped=0x0) returned 1 [0029.891] CloseHandle (hObject=0xc4) returned 1 [0029.892] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.892] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x268b70 | out: hHeap=0x240000) returned 1 [0029.892] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd78 | out: hHeap=0x240000) returned 1 [0029.893] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.893] FindNextFileA (in: hFindFile=0x2592e8, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4fc0, ftCreationTime.dwHighDateTime=0x1d4e92d, ftLastAccessTime.dwLowDateTime=0x3de769d0, ftLastAccessTime.dwHighDateTime=0x1d52b03, ftLastWriteTime.dwLowDateTime=0x3de769d0, ftLastWriteTime.dwHighDateTime=0x1d52b03, nFileSizeHigh=0x0, nFileSizeLow=0xa747, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName="LdyKq sH.pptx", cAlternateFileName="LDYKQS~1.PPT")) returned 1 [0029.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x256168 [0029.893] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259268 | out: hHeap=0x240000) returned 1 [0029.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x37) returned 0x259248 [0029.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\LdyKq sH.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ldykq sh.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.893] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xa747 [0029.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa74f) returned 0x25cd78 [0029.893] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xa747, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xa747, lpOverlapped=0x0) returned 1 [0029.894] CloseHandle (hObject=0xc4) returned 1 [0029.894] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\LdyKq sH.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ldykq sh.pptx")) returned 1 [0029.895] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0029.895] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.896] GetTickCount () returned 0x18323 [0029.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256180 [0029.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a330 [0029.896] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.896] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256180 | out: hHeap=0x240000) returned 1 [0029.896] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107"), lpSecurityAttributes=0x256150) returned 1 [0029.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.896] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107\\...."), lpSecurityAttributes=0x256150) returned 1 [0029.896] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x41) returned 0x259288 [0029.896] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\LdyKq sH.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ldykq sh.pptx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107\\....\\temporaryfile")) returned 0 [0029.897] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x3c) returned 0x257980 [0029.897] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107\\temporaryfile")) returned 1 [0029.898] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259288 | out: hHeap=0x240000) returned 1 [0029.898] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x257980 | out: hHeap=0x240000) returned 1 [0029.898] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e37fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e37fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e37fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.898] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e37fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e37fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e37fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.898] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e37fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e37fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e37fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.898] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e37fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e37fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e37fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0029.898] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e37fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e37fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e37fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.898] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e37fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e37fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e37fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.898] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0029.898] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107\\temporaryfile")) returned 1 [0029.898] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e37fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e37fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e37fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.898] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.898] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107")) returned 1 [0029.899] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\LdyKq sH.pptx") returned 0 [0029.899] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25a330 | out: hHeap=0x240000) returned 1 [0029.899] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256150 | out: hHeap=0x240000) returned 1 [0029.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x40) returned 0x257980 [0029.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5) returned 0x25c990 [0029.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1f) returned 0x255b30 [0029.899] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c990 | out: hHeap=0x240000) returned 1 [0029.899] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x0, Size=0xa750) returned 0x2150048 [0029.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa758) returned 0x2674d0 [0029.900] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0029.900] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\LdyKq sH.pptx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ldykq sh.pptx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.900] WriteFile (in: hFile=0xc4, lpBuffer=0x2674d8*, nNumberOfBytesToWrite=0xa750, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x2674d8*, lpNumberOfBytesWritten=0x18fe58*=0xa750, lpOverlapped=0x0) returned 1 [0029.901] CloseHandle (hObject=0xc4) returned 1 [0029.902] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\OXwvMzo7VU4DQ.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oxwvmzo7vu4dq.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.903] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x476 [0029.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x47e) returned 0x25a330 [0029.903] ReadFile (in: hFile=0xc4, lpBuffer=0x25a338, nNumberOfBytesToRead=0x476, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a338*, lpNumberOfBytesRead=0x18fe70*=0x476, lpOverlapped=0x0) returned 1 [0029.903] CloseHandle (hObject=0xc4) returned 1 [0029.903] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\OXwvMzo7VU4DQ.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oxwvmzo7vu4dq.ods")) returned 1 [0029.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.905] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259268 [0029.905] GetTickCount () returned 0x18323 [0029.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259298 [0029.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a7b8 [0029.909] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.910] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\OXwvMzo7VU4DQ.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oxwvmzo7vu4dq.ods"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107\\....\\temporaryfile")) returned 0 [0029.910] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107\\temporaryfile")) returned 1 [0029.911] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e37fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a820 [0029.911] FindNextFileA (in: hFindFile=0x25a820, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e37fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.911] FindNextFileA (in: hFindFile=0x25a820, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.911] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a83c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a7b8 [0029.911] FindNextFileA (in: hFindFile=0x25a7b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a83c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.911] FindNextFileA (in: hFindFile=0x25a7b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a83c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.911] FindClose (in: hFindFile=0x25a7b8 | out: hFindFile=0x25a7b8) returned 1 [0029.911] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107\\temporaryfile")) returned 1 [0029.912] FindNextFileA (in: hFindFile=0x25a820, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.912] FindClose (in: hFindFile=0x25a820 | out: hFindFile=0x25a820) returned 1 [0029.912] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099107" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099107")) returned 1 [0029.912] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\OXwvMzo7VU4DQ.ods") returned 0 [0029.912] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\OXwvMzo7VU4DQ.ods.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oxwvmzo7vu4dq.ods.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.912] WriteFile (in: hFile=0xc4, lpBuffer=0x25a7c0*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25a7c0*, lpNumberOfBytesWritten=0x18fe58*=0x480, lpOverlapped=0x0) returned 1 [0029.913] CloseHandle (hObject=0xc4) returned 1 [0029.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\PyIsTigOF966Nu_K.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pyistigof966nu_k.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.914] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x293e [0029.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2946) returned 0x25cd78 [0029.914] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x293e, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x293e, lpOverlapped=0x0) returned 1 [0029.915] CloseHandle (hObject=0xc4) returned 1 [0029.915] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\PyIsTigOF966Nu_K.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pyistigof966nu_k.csv")) returned 1 [0029.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.916] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.916] GetTickCount () returned 0x18333 [0029.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a330 [0029.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.917] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099123\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099123\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.918] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\PyIsTigOF966Nu_K.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pyistigof966nu_k.csv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099123\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099123\\....\\temporaryfile")) returned 0 [0029.918] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099123\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099123\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099123\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099123\\temporaryfile")) returned 1 [0029.919] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099123\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.919] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.919] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.919] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099123\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0029.919] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.919] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.919] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0029.919] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099123\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099123\\temporaryfile")) returned 1 [0029.919] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e5e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e5e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e5e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.919] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.919] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099123" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099123")) returned 1 [0029.920] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\PyIsTigOF966Nu_K.csv") returned 0 [0029.920] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\PyIsTigOF966Nu_K.csv.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pyistigof966nu_k.csv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.920] WriteFile (in: hFile=0xc4, lpBuffer=0x25f6d0*, nNumberOfBytesToWrite=0x2948, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25f6d0*, lpNumberOfBytesWritten=0x18fe58*=0x2948, lpOverlapped=0x0) returned 1 [0029.921] CloseHandle (hObject=0xc4) returned 1 [0029.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\rF_ok6UvUojb.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rf_ok6uvuojb.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.922] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x12342 [0029.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1234a) returned 0x25cd78 [0029.922] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x12342, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x12342, lpOverlapped=0x0) returned 1 [0029.923] CloseHandle (hObject=0xc4) returned 1 [0029.923] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\rF_ok6UvUojb.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rf_ok6uvuojb.xlsx")) returned 1 [0029.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.925] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259268 [0029.925] GetTickCount () returned 0x18342 [0029.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259298 [0029.926] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a330 [0029.926] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.926] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\rF_ok6UvUojb.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rf_ok6uvuojb.xlsx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138\\....\\temporaryfile")) returned 0 [0029.926] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138\\temporaryfile")) returned 1 [0029.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e842a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e842a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e842a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a398 [0029.927] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e842a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e842a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e842a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.927] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e842a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e842a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e842a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e842a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e842a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e842a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a330 [0029.927] FindNextFileA (in: hFindFile=0x25a330, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e842a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e842a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e842a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.928] FindNextFileA (in: hFindFile=0x25a330, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e842a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e842a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e842a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.928] FindClose (in: hFindFile=0x25a330 | out: hFindFile=0x25a330) returned 1 [0029.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138\\temporaryfile")) returned 1 [0029.928] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e842a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16e842a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16e842a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.928] FindClose (in: hFindFile=0x25a398 | out: hFindFile=0x25a398) returned 1 [0029.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138")) returned 1 [0029.928] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\rF_ok6UvUojb.xlsx") returned 0 [0029.929] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\rF_ok6UvUojb.xlsx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rf_ok6uvuojb.xlsx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.930] WriteFile (in: hFile=0xc4, lpBuffer=0x26f0d8*, nNumberOfBytesToWrite=0x12348, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26f0d8*, lpNumberOfBytesWritten=0x18fe58*=0x12348, lpOverlapped=0x0) returned 1 [0029.932] CloseHandle (hObject=0xc4) returned 1 [0029.933] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\RIHbvM5AACGsvn9b3.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rihbvm5aacgsvn9b3.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.933] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x1280f [0029.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12817) returned 0x25cd78 [0029.933] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x1280f, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x1280f, lpOverlapped=0x0) returned 1 [0029.934] CloseHandle (hObject=0xc4) returned 1 [0029.934] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\RIHbvM5AACGsvn9b3.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rihbvm5aacgsvn9b3.docx")) returned 1 [0029.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.939] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.939] GetTickCount () returned 0x18342 [0029.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a330 [0029.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.940] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.940] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\RIHbvM5AACGsvn9b3.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rihbvm5aacgsvn9b3.docx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138\\....\\temporaryfile")) returned 0 [0029.940] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138\\temporaryfile")) returned 1 [0029.941] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e842a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.942] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16e842a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.942] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.942] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0029.942] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.942] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.942] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0029.942] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138\\temporaryfile")) returned 1 [0029.942] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.942] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.942] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099138" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099138")) returned 1 [0029.942] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\RIHbvM5AACGsvn9b3.docx") returned 0 [0029.944] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\RIHbvM5AACGsvn9b3.docx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rihbvm5aacgsvn9b3.docx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.944] WriteFile (in: hFile=0xc4, lpBuffer=0x26f5a0*, nNumberOfBytesToWrite=0x12818, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26f5a0*, lpNumberOfBytesWritten=0x18fe58*=0x12818, lpOverlapped=0x0) returned 1 [0029.946] CloseHandle (hObject=0xc4) returned 1 [0029.947] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\ThsCTAWGPdf6ip5.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\thsctawgpdf6ip5.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.947] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x2acc [0029.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ad4) returned 0x25cd78 [0029.947] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x2acc, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x2acc, lpOverlapped=0x0) returned 1 [0029.948] CloseHandle (hObject=0xc4) returned 1 [0029.948] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\ThsCTAWGPdf6ip5.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\thsctawgpdf6ip5.pptx")) returned 1 [0029.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.949] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259268 [0029.950] GetTickCount () returned 0x18352 [0029.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259298 [0029.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a330 [0029.950] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099154\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099154\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.951] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\ThsCTAWGPdf6ip5.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\thsctawgpdf6ip5.pptx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099154\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099154\\....\\temporaryfile")) returned 0 [0029.951] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099154\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099154\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099154\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099154\\temporaryfile")) returned 1 [0029.952] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099154\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a398 [0029.952] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.952] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.952] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099154\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a330 [0029.952] FindNextFileA (in: hFindFile=0x25a330, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.952] FindNextFileA (in: hFindFile=0x25a330, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a3b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.952] FindClose (in: hFindFile=0x25a330 | out: hFindFile=0x25a330) returned 1 [0029.952] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099154\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099154\\temporaryfile")) returned 1 [0029.952] FindNextFileA (in: hFindFile=0x25a398, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16eaa400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16eaa400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16eaa400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.952] FindClose (in: hFindFile=0x25a398 | out: hFindFile=0x25a398) returned 1 [0029.953] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099154" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099154")) returned 1 [0029.953] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\ThsCTAWGPdf6ip5.pptx") returned 0 [0029.953] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\ThsCTAWGPdf6ip5.pptx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\thsctawgpdf6ip5.pptx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.953] WriteFile (in: hFile=0xc4, lpBuffer=0x25f860*, nNumberOfBytesToWrite=0x2ad0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25f860*, lpNumberOfBytesWritten=0x18fe58*=0x2ad0, lpOverlapped=0x0) returned 1 [0029.954] CloseHandle (hObject=0xc4) returned 1 [0029.955] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\wt3HXsmzIUggPP_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wt3hxsmziuggpp_.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.955] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x3353 [0029.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x335b) returned 0x25cd78 [0029.955] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x3353, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x3353, lpOverlapped=0x0) returned 1 [0029.956] CloseHandle (hObject=0xc4) returned 1 [0029.956] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\wt3HXsmzIUggPP_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wt3hxsmziuggpp_.docx")) returned 1 [0029.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0029.958] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0029.958] GetTickCount () returned 0x18361 [0029.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0029.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a330 [0029.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259288 [0029.958] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169\\...."), lpSecurityAttributes=0x256168) returned 1 [0029.959] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\wt3HXsmzIUggPP_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wt3hxsmziuggpp_.docx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169\\....\\temporaryfile")) returned 0 [0029.959] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169\\temporaryfile")) returned 1 [0029.960] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.960] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.960] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.960] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0029.960] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.960] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2592a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.960] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0029.960] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169\\temporaryfile")) returned 1 [0029.960] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.961] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0029.961] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169")) returned 1 [0029.961] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\wt3HXsmzIUggPP_.docx") returned 0 [0029.961] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\wt3HXsmzIUggPP_.docx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wt3hxsmziuggpp_.docx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0029.961] WriteFile (in: hFile=0xc4, lpBuffer=0x2600e8*, nNumberOfBytesToWrite=0x3358, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x2600e8*, lpNumberOfBytesWritten=0x18fe58*=0x3358, lpOverlapped=0x0) returned 1 [0029.962] CloseHandle (hObject=0xc4) returned 1 [0029.966] FindClose (in: hFindFile=0x2592e8 | out: hFindFile=0x2592e8) returned 1 [0029.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\*.*", lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x2592e8 [0029.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0029.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa63e7a80, ftCreationTime.dwHighDateTime=0x1d4c75f, ftLastAccessTime.dwLowDateTime=0xbbee7540, ftLastAccessTime.dwHighDateTime=0x1d4d431, ftLastWriteTime.dwLowDateTime=0xbbee7540, ftLastWriteTime.dwHighDateTime=0x1d4d431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa63e7a80, dwReserved1=0x1d4c75f, cFileName=".", cAlternateFileName="")) returned 0x259288 [0029.966] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa63e7a80, ftCreationTime.dwHighDateTime=0x1d4c75f, ftLastAccessTime.dwLowDateTime=0xbbee7540, ftLastAccessTime.dwHighDateTime=0x1d4d431, ftLastWriteTime.dwLowDateTime=0xbbee7540, ftLastWriteTime.dwHighDateTime=0x1d4d431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa63e7a80, dwReserved1=0x1d4c75f, cFileName="..", cAlternateFileName="")) returned 1 [0029.966] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d68c630, ftCreationTime.dwHighDateTime=0x1d4cdaf, ftLastAccessTime.dwLowDateTime=0x618070f0, ftLastAccessTime.dwHighDateTime=0x1d4c639, ftLastWriteTime.dwLowDateTime=0x618070f0, ftLastWriteTime.dwHighDateTime=0x1d4c639, nFileSizeHigh=0x0, nFileSizeLow=0xc56d, dwReserved0=0xa63e7a80, dwReserved1=0x1d4c75f, cFileName="1SVv3QXnp1AD4QB.doc", cAlternateFileName="1SVV3Q~1.DOC")) returned 1 [0029.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x2592c8 [0029.966] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\1SVv3QXnp1AD4QB.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\1svv3qxnp1ad4qb.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0029.966] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0xc56d [0029.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc575) returned 0x25cd78 [0029.966] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xc56d, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0xc56d, lpOverlapped=0x0) returned 1 [0029.967] CloseHandle (hObject=0xcc) returned 1 [0029.967] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\1SVv3QXnp1AD4QB.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\1svv3qxnp1ad4qb.doc")) returned 1 [0029.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0029.969] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b390 [0029.969] GetTickCount () returned 0x18361 [0029.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256180 [0029.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3c0 [0029.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f8 [0029.970] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169\\...."), lpSecurityAttributes=0x256150) returned 1 [0029.970] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\1SVv3QXnp1AD4QB.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\1svv3qxnp1ad4qb.doc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169\\....\\temporaryfile")) returned 0 [0029.970] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169\\temporaryfile")) returned 1 [0029.971] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b460 [0029.972] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.972] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.972] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0029.972] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.972] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.972] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0029.972] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169\\temporaryfile")) returned 1 [0029.972] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ed0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ed0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ed0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.972] FindClose (in: hFindFile=0x25b460 | out: hFindFile=0x25b460) returned 1 [0029.972] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099169" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099169")) returned 1 [0029.972] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\1SVv3QXnp1AD4QB.doc") returned 0 [0029.973] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\1SVv3QXnp1AD4QB.doc.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\1svv3qxnp1ad4qb.doc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0029.974] WriteFile (in: hFile=0xcc, lpBuffer=0x269300*, nNumberOfBytesToWrite=0xc578, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x269300*, lpNumberOfBytesWritten=0x18fe38*=0xc578, lpOverlapped=0x0) returned 1 [0029.975] CloseHandle (hObject=0xcc) returned 1 [0029.976] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\7GRcqO09RMPUte99-j.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\7grcqo09rmpute99-j.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0029.976] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x842b [0029.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8433) returned 0x25cd78 [0029.976] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x842b, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x842b, lpOverlapped=0x0) returned 1 [0029.977] CloseHandle (hObject=0xcc) returned 1 [0029.977] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\7GRcqO09RMPUte99-j.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\7grcqo09rmpute99-j.docx")) returned 1 [0029.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0029.978] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b3b0 [0029.978] GetTickCount () returned 0x18371 [0029.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256180 [0029.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3e0 [0029.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b418 [0029.979] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099185\\...."), lpSecurityAttributes=0x256150) returned 1 [0029.980] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\7GRcqO09RMPUte99-j.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\7grcqo09rmpute99-j.docx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099185\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099185\\....\\temporaryfile")) returned 0 [0029.980] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099185\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099185\\temporaryfile")) returned 1 [0029.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099185\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ef66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ef66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ef66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b480 [0029.981] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ef66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ef66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ef66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.981] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ef66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ef66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ef66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099185\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ef66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ef66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ef66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b418 [0029.981] FindNextFileA (in: hFindFile=0x25b418, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ef66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ef66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ef66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.981] FindNextFileA (in: hFindFile=0x25b418, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ef66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ef66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ef66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.981] FindClose (in: hFindFile=0x25b418 | out: hFindFile=0x25b418) returned 1 [0029.981] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099185\\temporaryfile")) returned 1 [0029.981] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16ef66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16ef66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16ef66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.981] FindClose (in: hFindFile=0x25b480 | out: hFindFile=0x25b480) returned 1 [0029.981] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099185" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099185")) returned 1 [0029.982] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\7GRcqO09RMPUte99-j.docx") returned 0 [0029.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\7GRcqO09RMPUte99-j.docx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\7grcqo09rmpute99-j.docx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0029.983] WriteFile (in: hFile=0xcc, lpBuffer=0x2651c0*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x2651c0*, lpNumberOfBytesWritten=0x18fe38*=0x8430, lpOverlapped=0x0) returned 1 [0029.984] CloseHandle (hObject=0xcc) returned 1 [0029.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\8qE80HJgAQ4T-05.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\8qe80hjgaq4t-05.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0029.985] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x55ef [0029.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x55f7) returned 0x25cd78 [0029.985] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x55ef, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x55ef, lpOverlapped=0x0) returned 1 [0029.986] CloseHandle (hObject=0xcc) returned 1 [0029.986] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\8qE80HJgAQ4T-05.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\8qe80hjgaq4t-05.ots")) returned 1 [0029.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0029.990] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b390 [0029.990] GetTickCount () returned 0x18381 [0029.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256180 [0029.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3c0 [0029.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f8 [0029.990] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201\\...."), lpSecurityAttributes=0x256150) returned 1 [0029.991] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\8qE80HJgAQ4T-05.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\8qe80hjgaq4t-05.ots"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201\\....\\temporaryfile")) returned 0 [0029.991] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201\\temporaryfile")) returned 1 [0029.992] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b460 [0029.992] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.992] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0029.992] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0029.992] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.992] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.992] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0029.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201\\temporaryfile")) returned 1 [0029.992] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0029.992] FindClose (in: hFindFile=0x25b460 | out: hFindFile=0x25b460) returned 1 [0029.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201")) returned 1 [0029.993] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\8qE80HJgAQ4T-05.ots") returned 0 [0029.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\8qE80HJgAQ4T-05.ots.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\8qe80hjgaq4t-05.ots.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0029.993] WriteFile (in: hFile=0xcc, lpBuffer=0x262380*, nNumberOfBytesToWrite=0x55f8, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x262380*, lpNumberOfBytesWritten=0x18fe38*=0x55f8, lpOverlapped=0x0) returned 1 [0029.994] CloseHandle (hObject=0xcc) returned 1 [0029.995] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\hap-mdvd.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\hap-mdvd.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0029.995] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x1118c [0029.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11194) returned 0x25cd78 [0029.995] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x1118c, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x1118c, lpOverlapped=0x0) returned 1 [0029.996] CloseHandle (hObject=0xcc) returned 1 [0029.996] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\hap-mdvd.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\hap-mdvd.xls")) returned 1 [0029.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0029.998] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0029.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b388 [0029.998] GetTickCount () returned 0x18381 [0029.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0029.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3b8 [0029.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f0 [0029.999] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201\\...."), lpSecurityAttributes=0x256180) returned 1 [0029.999] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\hap-mdvd.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\hap-mdvd.xls"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201\\....\\temporaryfile")) returned 0 [0029.999] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201\\temporaryfile")) returned 1 [0030.000] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b458 [0030.000] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.001] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.001] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f0 [0030.001] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.001] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.001] FindClose (in: hFindFile=0x25b3f0 | out: hFindFile=0x25b3f0) returned 1 [0030.001] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201\\temporaryfile")) returned 1 [0030.001] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f1c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f1c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f1c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.001] FindClose (in: hFindFile=0x25b458 | out: hFindFile=0x25b458) returned 1 [0030.001] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099201" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099201")) returned 1 [0030.001] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\hap-mdvd.xls") returned 0 [0030.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\hap-mdvd.xls.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\hap-mdvd.xls.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.004] WriteFile (in: hFile=0xcc, lpBuffer=0x26df20*, nNumberOfBytesToWrite=0x11190, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x26df20*, lpNumberOfBytesWritten=0x18fe38*=0x11190, lpOverlapped=0x0) returned 1 [0030.006] CloseHandle (hObject=0xcc) returned 1 [0030.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\p2v55AVj.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\p2v55avj.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.007] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x30f4 [0030.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30fc) returned 0x25cd78 [0030.007] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x30f4, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x30f4, lpOverlapped=0x0) returned 1 [0030.008] CloseHandle (hObject=0xcc) returned 1 [0030.008] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\p2v55AVj.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\p2v55avj.ppt")) returned 1 [0030.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.009] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b388 [0030.009] GetTickCount () returned 0x18390 [0030.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3b8 [0030.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f0 [0030.010] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.010] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\p2v55AVj.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\p2v55avj.ppt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216\\....\\temporaryfile")) returned 0 [0030.010] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216\\temporaryfile")) returned 1 [0030.011] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f42980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f42980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f42980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b458 [0030.011] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f42980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f42980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f42980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.011] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f42980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f42980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f42980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.011] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f42980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f42980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f42980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f0 [0030.011] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f42980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f42980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f42980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.011] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f42980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f42980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f42980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.011] FindClose (in: hFindFile=0x25b3f0 | out: hFindFile=0x25b3f0) returned 1 [0030.011] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216\\temporaryfile")) returned 1 [0030.012] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f42980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f42980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f42980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.012] FindClose (in: hFindFile=0x25b458 | out: hFindFile=0x25b458) returned 1 [0030.012] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216")) returned 1 [0030.012] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\p2v55AVj.ppt") returned 0 [0030.012] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\p2v55AVj.ppt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\p2v55avj.ppt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.013] WriteFile (in: hFile=0xcc, lpBuffer=0x25fe88*, nNumberOfBytesToWrite=0x30f8, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x25fe88*, lpNumberOfBytesWritten=0x18fe38*=0x30f8, lpOverlapped=0x0) returned 1 [0030.014] CloseHandle (hObject=0xcc) returned 1 [0030.014] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\Rj1_r3.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\rj1_r3.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.014] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x7c94 [0030.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c9c) returned 0x25cd78 [0030.014] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x7c94, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x7c94, lpOverlapped=0x0) returned 1 [0030.015] CloseHandle (hObject=0xcc) returned 1 [0030.015] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\Rj1_r3.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\rj1_r3.docx")) returned 1 [0030.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.017] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b388 [0030.017] GetTickCount () returned 0x18390 [0030.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3b8 [0030.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f0 [0030.019] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.020] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\Rj1_r3.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\rj1_r3.docx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216\\....\\temporaryfile")) returned 0 [0030.020] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216\\temporaryfile")) returned 1 [0030.021] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f42980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b458 [0030.021] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f42980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.021] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.021] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f0 [0030.021] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.021] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.021] FindClose (in: hFindFile=0x25b3f0 | out: hFindFile=0x25b3f0) returned 1 [0030.021] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216\\temporaryfile")) returned 1 [0030.021] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.021] FindClose (in: hFindFile=0x25b458 | out: hFindFile=0x25b458) returned 1 [0030.022] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099216" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099216")) returned 1 [0030.022] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\Rj1_r3.docx") returned 0 [0030.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\Rj1_r3.docx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\rj1_r3.docx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.023] WriteFile (in: hFile=0xcc, lpBuffer=0x264a28*, nNumberOfBytesToWrite=0x7c98, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x264a28*, lpNumberOfBytesWritten=0x18fe38*=0x7c98, lpOverlapped=0x0) returned 1 [0030.024] CloseHandle (hObject=0xcc) returned 1 [0030.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\sLz-Qn.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\slz-qn.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.025] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0xca1c [0030.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xca24) returned 0x25cd78 [0030.025] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xca1c, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0xca1c, lpOverlapped=0x0) returned 1 [0030.026] CloseHandle (hObject=0xcc) returned 1 [0030.026] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\sLz-Qn.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\slz-qn.pps")) returned 1 [0030.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.028] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b388 [0030.028] GetTickCount () returned 0x183a0 [0030.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3b8 [0030.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f0 [0030.028] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099232\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.029] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\sLz-Qn.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\slz-qn.pps"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099232\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099232\\....\\temporaryfile")) returned 0 [0030.029] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099232\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099232\\temporaryfile")) returned 1 [0030.030] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099232\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b458 [0030.030] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.030] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.030] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099232\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f0 [0030.030] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.030] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.030] FindClose (in: hFindFile=0x25b3f0 | out: hFindFile=0x25b3f0) returned 1 [0030.031] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099232\\temporaryfile")) returned 1 [0030.031] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f68ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f68ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f68ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.031] FindClose (in: hFindFile=0x25b458 | out: hFindFile=0x25b458) returned 1 [0030.031] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099232" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099232")) returned 1 [0030.031] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\sLz-Qn.pps") returned 0 [0030.032] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\sLz-Qn.pps.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\slz-qn.pps.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.032] WriteFile (in: hFile=0xcc, lpBuffer=0x2697b0*, nNumberOfBytesToWrite=0xca20, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x2697b0*, lpNumberOfBytesWritten=0x18fe38*=0xca20, lpOverlapped=0x0) returned 1 [0030.034] CloseHandle (hObject=0xcc) returned 1 [0030.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\ZwQr6.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\zwqr6.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.035] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x15784 [0030.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1578c) returned 0x25cd78 [0030.035] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x15784, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x15784, lpOverlapped=0x0) returned 1 [0030.037] CloseHandle (hObject=0xcc) returned 1 [0030.037] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\ZwQr6.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\zwqr6.pdf")) returned 1 [0030.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.038] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b388 [0030.038] GetTickCount () returned 0x183af [0030.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3b8 [0030.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f0 [0030.039] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099247\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099247\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.039] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\ZwQr6.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\zwqr6.pdf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099247\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099247\\....\\temporaryfile")) returned 0 [0030.039] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099247\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099247\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099247\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099247\\temporaryfile")) returned 1 [0030.040] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099247\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f8ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f8ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f8ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b458 [0030.041] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f8ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f8ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f8ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.041] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f8ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f8ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f8ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.041] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099247\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f8ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f8ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f8ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f0 [0030.041] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f8ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f8ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f8ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.041] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f8ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f8ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f8ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.041] FindClose (in: hFindFile=0x25b3f0 | out: hFindFile=0x25b3f0) returned 1 [0030.041] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099247\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099247\\temporaryfile")) returned 1 [0030.041] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16f8ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16f8ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f8ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.041] FindClose (in: hFindFile=0x25b458 | out: hFindFile=0x25b458) returned 1 [0030.041] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099247" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099247")) returned 1 [0030.041] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\ZwQr6.pdf") returned 0 [0030.043] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\ZwQr6.pdf.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6b 5xtdqcrcq2\\zwqr6.pdf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.043] WriteFile (in: hFile=0xcc, lpBuffer=0x272518*, nNumberOfBytesToWrite=0x15788, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x272518*, lpNumberOfBytesWritten=0x18fe38*=0x15788, lpOverlapped=0x0) returned 1 [0030.046] CloseHandle (hObject=0xcc) returned 1 [0030.047] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0030.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6b 5xTdqcrCQ2\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa63e7a80, ftCreationTime.dwHighDateTime=0x1d4c75f, ftLastAccessTime.dwLowDateTime=0x16f8ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16f8ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x259288 [0030.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0030.047] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0030.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf413fc90, ftCreationTime.dwHighDateTime=0x1d4ca97, ftLastAccessTime.dwLowDateTime=0x2ba58090, ftLastAccessTime.dwHighDateTime=0x1d4d0bd, ftLastWriteTime.dwLowDateTime=0x2ba58090, ftLastWriteTime.dwHighDateTime=0x1d4d0bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf413fc90, dwReserved1=0x1d4ca97, cFileName=".", cAlternateFileName="")) returned 0x259288 [0030.047] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf413fc90, ftCreationTime.dwHighDateTime=0x1d4ca97, ftLastAccessTime.dwLowDateTime=0x2ba58090, ftLastAccessTime.dwHighDateTime=0x1d4d0bd, ftLastWriteTime.dwLowDateTime=0x2ba58090, ftLastWriteTime.dwHighDateTime=0x1d4d0bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf413fc90, dwReserved1=0x1d4ca97, cFileName="..", cAlternateFileName="")) returned 1 [0030.047] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd336a010, ftCreationTime.dwHighDateTime=0x1d4cc66, ftLastAccessTime.dwLowDateTime=0x904ff500, ftLastAccessTime.dwHighDateTime=0x1d4d1d7, ftLastWriteTime.dwLowDateTime=0x904ff500, ftLastWriteTime.dwHighDateTime=0x1d4d1d7, nFileSizeHigh=0x0, nFileSizeLow=0x12bc0, dwReserved0=0xf413fc90, dwReserved1=0x1d4ca97, cFileName="6fah5Apwpl8.odp", cAlternateFileName="6FAH5A~1.ODP")) returned 1 [0030.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x256168 [0030.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\6fah5Apwpl8.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\6fah5apwpl8.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.047] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x12bc0 [0030.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12bc8) returned 0x25cd78 [0030.048] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x12bc0, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x12bc0, lpOverlapped=0x0) returned 1 [0030.049] CloseHandle (hObject=0xcc) returned 1 [0030.049] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\6fah5Apwpl8.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\6fah5apwpl8.odp")) returned 1 [0030.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.051] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b388 [0030.051] GetTickCount () returned 0x183bf [0030.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3b8 [0030.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f0 [0030.051] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.051] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\6fah5Apwpl8.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\6fah5apwpl8.odp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263\\....\\temporaryfile")) returned 0 [0030.051] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263\\temporaryfile")) returned 1 [0030.052] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b458 [0030.053] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.053] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.053] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f0 [0030.053] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.053] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.053] FindClose (in: hFindFile=0x25b3f0 | out: hFindFile=0x25b3f0) returned 1 [0030.053] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263\\temporaryfile")) returned 1 [0030.053] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.053] FindClose (in: hFindFile=0x25b458 | out: hFindFile=0x25b458) returned 1 [0030.053] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263")) returned 1 [0030.053] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\6fah5Apwpl8.odp") returned 0 [0030.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\6fah5Apwpl8.odp.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\6fah5apwpl8.odp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.055] WriteFile (in: hFile=0xcc, lpBuffer=0x26f950*, nNumberOfBytesToWrite=0x12bc8, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x26f950*, lpNumberOfBytesWritten=0x18fe38*=0x12bc8, lpOverlapped=0x0) returned 1 [0030.057] CloseHandle (hObject=0xcc) returned 1 [0030.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\ah1cMF2z.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ah1cmf2z.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.058] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x1347d [0030.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13485) returned 0x25cd78 [0030.058] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x1347d, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x1347d, lpOverlapped=0x0) returned 1 [0030.059] CloseHandle (hObject=0xcc) returned 1 [0030.059] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\ah1cMF2z.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ah1cmf2z.rtf")) returned 1 [0030.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0030.061] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b388 [0030.061] GetTickCount () returned 0x183bf [0030.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3b8 [0030.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f0 [0030.062] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263\\...."), lpSecurityAttributes=0x256168) returned 1 [0030.062] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\ah1cMF2z.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ah1cmf2z.rtf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263\\....\\temporaryfile")) returned 0 [0030.062] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263\\temporaryfile")) returned 1 [0030.063] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b458 [0030.063] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.063] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f0 [0030.064] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.064] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.064] FindClose (in: hFindFile=0x25b3f0 | out: hFindFile=0x25b3f0) returned 1 [0030.064] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263\\temporaryfile")) returned 1 [0030.064] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fb4da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fb4da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fb4da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.064] FindClose (in: hFindFile=0x25b458 | out: hFindFile=0x25b458) returned 1 [0030.064] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099263" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099263")) returned 1 [0030.064] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\ah1cMF2z.rtf") returned 0 [0030.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\ah1cMF2z.rtf.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ah1cmf2z.rtf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.066] WriteFile (in: hFile=0xcc, lpBuffer=0x270210*, nNumberOfBytesToWrite=0x13488, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x270210*, lpNumberOfBytesWritten=0x18fe38*=0x13488, lpOverlapped=0x0) returned 1 [0030.068] CloseHandle (hObject=0xcc) returned 1 [0030.069] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\Ck73aG03huDrzd07UJ.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ck73ag03hudrzd07uj.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.069] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x14612 [0030.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1461a) returned 0x25cd78 [0030.069] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x14612, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x14612, lpOverlapped=0x0) returned 1 [0030.070] CloseHandle (hObject=0xcc) returned 1 [0030.071] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\Ck73aG03huDrzd07UJ.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ck73ag03hudrzd07uj.pps")) returned 1 [0030.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.072] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b390 [0030.072] GetTickCount () returned 0x183cf [0030.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256168 [0030.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3c0 [0030.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f8 [0030.073] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099279\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\Ck73aG03huDrzd07UJ.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ck73ag03hudrzd07uj.pps"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099279\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099279\\....\\temporaryfile")) returned 0 [0030.073] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099279\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099279\\temporaryfile")) returned 1 [0030.074] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099279\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fdaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fdaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fdaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b460 [0030.074] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fdaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fdaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fdaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.074] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fdaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fdaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fdaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.074] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099279\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fdaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fdaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fdaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0030.074] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fdaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fdaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fdaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.075] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fdaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fdaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fdaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.075] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0030.075] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099279\\temporaryfile")) returned 1 [0030.075] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x16fdaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x16fdaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x16fdaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.075] FindClose (in: hFindFile=0x25b460 | out: hFindFile=0x25b460) returned 1 [0030.075] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099279" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099279")) returned 1 [0030.075] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\Ck73aG03huDrzd07UJ.pps") returned 0 [0030.076] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\Ck73aG03huDrzd07UJ.pps.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ck73ag03hudrzd07uj.pps.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.077] WriteFile (in: hFile=0xcc, lpBuffer=0x2713a8*, nNumberOfBytesToWrite=0x14618, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x2713a8*, lpNumberOfBytesWritten=0x18fe38*=0x14618, lpOverlapped=0x0) returned 1 [0030.079] CloseHandle (hObject=0xcc) returned 1 [0030.080] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\sHSDSkZ0g_NoboxW.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\shsdskz0g_noboxw.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.080] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x11fc8 [0030.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11fd0) returned 0x25cd78 [0030.080] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x11fc8, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x11fc8, lpOverlapped=0x0) returned 1 [0030.081] CloseHandle (hObject=0xcc) returned 1 [0030.081] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\sHSDSkZ0g_NoboxW.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\shsdskz0g_noboxw.odp")) returned 1 [0030.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.083] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b3b0 [0030.083] GetTickCount () returned 0x183de [0030.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256168 [0030.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3e0 [0030.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b418 [0030.084] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.084] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\sHSDSkZ0g_NoboxW.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\shsdskz0g_noboxw.odp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294\\....\\temporaryfile")) returned 0 [0030.084] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294\\temporaryfile")) returned 1 [0030.085] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b480 [0030.085] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.085] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b418 [0030.085] FindNextFileA (in: hFindFile=0x25b418, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x25b418, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.085] FindClose (in: hFindFile=0x25b418 | out: hFindFile=0x25b418) returned 1 [0030.085] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294\\temporaryfile")) returned 1 [0030.086] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.086] FindClose (in: hFindFile=0x25b480 | out: hFindFile=0x25b480) returned 1 [0030.086] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294")) returned 1 [0030.086] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\sHSDSkZ0g_NoboxW.odp") returned 0 [0030.087] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\sHSDSkZ0g_NoboxW.odp.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\shsdskz0g_noboxw.odp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.088] WriteFile (in: hFile=0xcc, lpBuffer=0x26ed58*, nNumberOfBytesToWrite=0x11fd0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x26ed58*, lpNumberOfBytesWritten=0x18fe38*=0x11fd0, lpOverlapped=0x0) returned 1 [0030.089] CloseHandle (hObject=0xcc) returned 1 [0030.090] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\T_P_-SNfCBkG8Aq2jj.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\t_p_-snfcbkg8aq2jj.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.090] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x11cad [0030.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11cb5) returned 0x25cd78 [0030.091] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x11cad, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x11cad, lpOverlapped=0x0) returned 1 [0030.092] CloseHandle (hObject=0xcc) returned 1 [0030.092] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\T_P_-SNfCBkG8Aq2jj.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\t_p_-snfcbkg8aq2jj.xls")) returned 1 [0030.093] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.093] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.093] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b390 [0030.093] GetTickCount () returned 0x183de [0030.093] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256168 [0030.093] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3c0 [0030.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f8 [0030.094] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.094] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\T_P_-SNfCBkG8Aq2jj.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\t_p_-snfcbkg8aq2jj.xls"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294\\....\\temporaryfile")) returned 0 [0030.095] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294\\temporaryfile")) returned 1 [0030.097] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b460 [0030.097] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.097] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.097] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0030.097] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.097] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.097] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0030.097] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294\\temporaryfile")) returned 1 [0030.097] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17001060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17001060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17001060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.097] FindClose (in: hFindFile=0x25b460 | out: hFindFile=0x25b460) returned 1 [0030.097] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099294" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099294")) returned 1 [0030.098] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\T_P_-SNfCBkG8Aq2jj.xls") returned 0 [0030.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\T_P_-SNfCBkG8Aq2jj.xls.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\t_p_-snfcbkg8aq2jj.xls.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.099] WriteFile (in: hFile=0xcc, lpBuffer=0x26ea40*, nNumberOfBytesToWrite=0x11cb8, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x26ea40*, lpNumberOfBytesWritten=0x18fe38*=0x11cb8, lpOverlapped=0x0) returned 1 [0030.101] CloseHandle (hObject=0xcc) returned 1 [0030.102] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\YBis7kkv5pT8UqO.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ybis7kkv5pt8uqo.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.102] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x11eb0 [0030.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11eb8) returned 0x25cd78 [0030.102] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x11eb0, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x11eb0, lpOverlapped=0x0) returned 1 [0030.103] CloseHandle (hObject=0xcc) returned 1 [0030.103] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\YBis7kkv5pT8UqO.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ybis7kkv5pt8uqo.odt")) returned 1 [0030.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.105] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b3b0 [0030.105] GetTickCount () returned 0x183ee [0030.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256168 [0030.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3e0 [0030.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b418 [0030.105] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099310\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099310\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.106] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\YBis7kkv5pT8UqO.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ybis7kkv5pt8uqo.odt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099310\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099310\\....\\temporaryfile")) returned 0 [0030.106] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099310\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099310\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099310\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099310\\temporaryfile")) returned 1 [0030.107] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099310\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170271c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170271c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170271c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b480 [0030.107] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170271c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170271c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170271c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.107] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170271c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170271c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170271c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.107] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099310\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170271c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170271c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170271c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b418 [0030.107] FindNextFileA (in: hFindFile=0x25b418, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170271c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170271c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170271c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.107] FindNextFileA (in: hFindFile=0x25b418, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170271c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170271c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170271c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.107] FindClose (in: hFindFile=0x25b418 | out: hFindFile=0x25b418) returned 1 [0030.107] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099310\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099310\\temporaryfile")) returned 1 [0030.108] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170271c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170271c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170271c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.108] FindClose (in: hFindFile=0x25b480 | out: hFindFile=0x25b480) returned 1 [0030.108] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099310" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099310")) returned 1 [0030.108] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\YBis7kkv5pT8UqO.odt") returned 0 [0030.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\YBis7kkv5pT8UqO.odt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\ybis7kkv5pt8uqo.odt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.109] WriteFile (in: hFile=0xcc, lpBuffer=0x26ec40*, nNumberOfBytesToWrite=0x11eb8, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x26ec40*, lpNumberOfBytesWritten=0x18fe38*=0x11eb8, lpOverlapped=0x0) returned 1 [0030.112] CloseHandle (hObject=0xcc) returned 1 [0030.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\YitNJanVQcH2FO.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\yitnjanvqch2fo.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.114] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x121f4 [0030.114] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x121fc) returned 0x25cd78 [0030.114] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x121f4, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x121f4, lpOverlapped=0x0) returned 1 [0030.115] CloseHandle (hObject=0xcc) returned 1 [0030.115] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\YitNJanVQcH2FO.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\yitnjanvqch2fo.odt")) returned 1 [0030.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.119] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b390 [0030.119] GetTickCount () returned 0x183fd [0030.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256168 [0030.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3c0 [0030.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f8 [0030.119] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099325\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099325\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.120] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\YitNJanVQcH2FO.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\yitnjanvqch2fo.odt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099325\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099325\\....\\temporaryfile")) returned 0 [0030.120] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099325\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099325\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099325\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099325\\temporaryfile")) returned 1 [0030.121] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099325\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1704d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1704d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1704d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b460 [0030.121] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1704d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1704d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1704d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.121] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1704d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1704d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1704d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.121] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099325\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1704d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1704d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1704d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0030.121] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1704d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1704d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1704d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.121] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1704d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1704d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1704d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.121] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0030.121] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099325\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099325\\temporaryfile")) returned 1 [0030.121] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1704d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1704d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1704d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.121] FindClose (in: hFindFile=0x25b460 | out: hFindFile=0x25b460) returned 1 [0030.121] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099325" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099325")) returned 1 [0030.122] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\YitNJanVQcH2FO.odt") returned 0 [0030.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\YitNJanVQcH2FO.odt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6carsi1gd4xa\\yitnjanvqch2fo.odt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.123] WriteFile (in: hFile=0xcc, lpBuffer=0x26ef88*, nNumberOfBytesToWrite=0x121f8, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x26ef88*, lpNumberOfBytesWritten=0x18fe38*=0x121f8, lpOverlapped=0x0) returned 1 [0030.125] CloseHandle (hObject=0xcc) returned 1 [0030.126] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0030.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\6CaRSI1gd4xA\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf413fc90, ftCreationTime.dwHighDateTime=0x1d4ca97, ftLastAccessTime.dwLowDateTime=0x1704d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1704d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x259288 [0030.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0030.126] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0030.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Music\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2592e8, ftCreationTime.dwLowDateTime=0xc, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x25cd78, ftLastWriteTime.dwHighDateTime=0x18feb0, nFileSizeHigh=0x14, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x257618, cFileName="\xc9\x04", cAlternateFileName="6")) returned 0xffffffff [0030.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Music\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc, ftCreationTime.dwHighDateTime=0x1000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x18fe28, ftLastWriteTime.dwLowDateTime=0x7716389e, ftLastWriteTime.dwHighDateTime=0x240138, nFileSizeHigh=0x7716387a, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x257618, cFileName="\xc9\x04", cAlternateFileName="6")) returned 0xffffffff [0030.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Pictures\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2592e8, ftCreationTime.dwLowDateTime=0xc, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x240150, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x25cd78, ftLastWriteTime.dwHighDateTime=0x7715e36c, nFileSizeHigh=0x773a5c3e, nFileSizeLow=0x18fe68, dwReserved0=0x2401cc, dwReserved1=0x240000, cFileName="", cAlternateFileName="9")) returned 0xffffffff [0030.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Pictures\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2592e8, ftCreationTime.dwLowDateTime=0xc, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x240150, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x25cd78, ftLastWriteTime.dwHighDateTime=0x7715e36c, nFileSizeHigh=0x773a5c3e, nFileSizeLow=0x18fe68, dwReserved0=0x2401cc, dwReserved1=0x240000, cFileName="", cAlternateFileName="9")) returned 0xffffffff [0030.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e9e4460, dwReserved1=0x1d305ee, cFileName=".", cAlternateFileName="")) returned 0x25a3a8 [0030.128] FindNextFileA (in: hFindFile=0x25a3a8, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e9e4460, dwReserved1=0x1d305ee, cFileName="..", cAlternateFileName="")) returned 1 [0030.128] FindNextFileA (in: hFindFile=0x25a3a8, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x9e9e4460, dwReserved1=0x1d305ee, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256150 [0030.129] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.129] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0xd8 [0030.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe0) returned 0x25b3f0 [0030.129] ReadFile (in: hFile=0xcc, lpBuffer=0x25b3f8, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25b3f8*, lpNumberOfBytesRead=0x18fe50*=0xd8, lpOverlapped=0x0) returned 1 [0030.130] CloseHandle (hObject=0xcc) returned 1 [0030.130] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini")) returned 1 [0030.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0030.131] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259288 [0030.131] GetTickCount () returned 0x1840d [0030.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a330 [0030.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a368 [0030.134] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341\\...."), lpSecurityAttributes=0x256168) returned 1 [0030.134] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341\\....\\temporaryfile")) returned 0 [0030.134] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341\\temporaryfile")) returned 1 [0030.135] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName=".", cAlternateFileName="")) returned 0x25a368 [0030.135] FindNextFileA (in: hFindFile=0x25a368, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName="..", cAlternateFileName="")) returned 1 [0030.135] FindNextFileA (in: hFindFile=0x25a368, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.135] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a384, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259288 [0030.135] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a384, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.136] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a384, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.136] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0030.136] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341\\temporaryfile")) returned 1 [0030.136] FindNextFileA (in: hFindFile=0x25a368, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.136] FindClose (in: hFindFile=0x25a368 | out: hFindFile=0x25a368) returned 1 [0030.136] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341")) returned 1 [0030.136] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\desktop.ini") returned 0 [0030.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.138] WriteFile (in: hFile=0xcc, lpBuffer=0x25b4e0*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x25b4e0*, lpNumberOfBytesWritten=0x18fe38*=0xe0, lpOverlapped=0x0) returned 1 [0030.139] CloseHandle (hObject=0xcc) returned 1 [0030.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.140] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x0 [0030.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9a0 [0030.140] ReadFile (in: hFile=0xcc, lpBuffer=0x25c9a8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25c9a8*, lpNumberOfBytesRead=0x18fe50*=0x0, lpOverlapped=0x0) returned 1 [0030.141] CloseHandle (hObject=0xcc) returned 1 [0030.141] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss")) returned 1 [0030.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.141] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25a330 [0030.141] GetTickCount () returned 0x1840d [0030.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a360 [0030.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f0 [0030.141] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.142] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341\\....\\temporaryfile")) returned 0 [0030.142] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341\\temporaryfile")) returned 1 [0030.143] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170995e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170995e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b458 [0030.144] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170995e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170995e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.144] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.144] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f0 [0030.144] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.144] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.144] FindClose (in: hFindFile=0x25b3f0 | out: hFindFile=0x25b3f0) returned 1 [0030.144] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341\\temporaryfile")) returned 1 [0030.144] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17073480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17073480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17073480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.144] FindClose (in: hFindFile=0x25b458 | out: hFindFile=0x25b458) returned 1 [0030.144] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099341" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099341")) returned 1 [0030.144] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\Favorites.vss") returned 0 [0030.144] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\Favorites.vss.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.145] WriteFile (in: hFile=0xcc, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fe38*=0x0, lpOverlapped=0x0) returned 1 [0030.145] CloseHandle (hObject=0xcc) returned 1 [0030.145] FindClose (in: hFindFile=0x25a3a8 | out: hFindFile=0x25a3a8) returned 1 [0030.145] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x170995e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170995e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25a3a8 [0030.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0030.145] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\_private\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9ebad4e0, dwReserved1=0x1d305ee, cFileName=".", cAlternateFileName="")) returned 0x259288 [0030.146] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9ebad4e0, dwReserved1=0x1d305ee, cFileName="..", cAlternateFileName="")) returned 1 [0030.146] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x9ebad4e0, dwReserved1=0x1d305ee, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0030.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256150 [0030.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.147] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x74e6 [0030.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x74ee) returned 0x25cd78 [0030.147] ReadFile (in: hFile=0xd0, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe30*=0x74e6, lpOverlapped=0x0) returned 1 [0030.149] CloseHandle (hObject=0xd0) returned 1 [0030.149] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico")) returned 1 [0030.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.150] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25c3f8 [0030.150] GetTickCount () returned 0x1841d [0030.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c428 [0030.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c460 [0030.151] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099357\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099357\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.151] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099357\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099357\\....\\temporaryfile")) returned 0 [0030.151] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099357\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099357\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099357\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099357\\temporaryfile")) returned 1 [0030.152] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099357\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170995e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170995e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170995e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x25c4c8 [0030.152] FindNextFileA (in: hFindFile=0x25c4c8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170995e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170995e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170995e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0030.152] FindNextFileA (in: hFindFile=0x25c4c8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170995e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170995e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170995e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.152] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099357\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170995e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170995e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170995e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c4e4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c460 [0030.152] FindNextFileA (in: hFindFile=0x25c460, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170995e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170995e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170995e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c4e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.153] FindNextFileA (in: hFindFile=0x25c460, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170995e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170995e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170995e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c4e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.153] FindClose (in: hFindFile=0x25c460 | out: hFindFile=0x25c460) returned 1 [0030.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099357\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099357\\temporaryfile")) returned 1 [0030.153] FindNextFileA (in: hFindFile=0x25c4c8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170995e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170995e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170995e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.153] FindClose (in: hFindFile=0x25c4c8 | out: hFindFile=0x25c4c8) returned 1 [0030.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099357" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099357")) returned 1 [0030.153] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\_private\\folder.ico") returned 0 [0030.154] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\_private\\folder.ico.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.154] WriteFile (in: hFile=0xd0, lpBuffer=0x264278*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x264278*, lpNumberOfBytesWritten=0x18fe18*=0x74f0, lpOverlapped=0x0) returned 1 [0030.155] CloseHandle (hObject=0xd0) returned 1 [0030.156] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0030.156] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Shapes\\_private\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x170995e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170995e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x259288 [0030.156] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0030.156] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0030.156] FindClose (in: hFindFile=0x25a3a8 | out: hFindFile=0x25a3a8) returned 1 [0030.156] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Videos\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2592e8, ftCreationTime.dwLowDateTime=0xc, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x14, ftLastWriteTime.dwLowDateTime=0x25cd78, ftLastWriteTime.dwHighDateTime=0x18feb0, nFileSizeHigh=0x14, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x257618, cFileName="\xc9\x04", cAlternateFileName="7")) returned 0xffffffff [0030.156] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\My Videos\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc, ftCreationTime.dwHighDateTime=0x1000, ftLastAccessTime.dwLowDateTime=0x8, ftLastAccessTime.dwHighDateTime=0x18fe28, ftLastWriteTime.dwLowDateTime=0x7716389e, ftLastWriteTime.dwHighDateTime=0x240138, nFileSizeHigh=0x7716387a, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x257618, cFileName="\xc9\x04", cAlternateFileName="7")) returned 0xffffffff [0030.157] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\Outlook Files\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a7a9f80, dwReserved1=0x1d2fad7, cFileName=".", cAlternateFileName="")) returned 0x259288 [0030.157] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a7a9f80, dwReserved1=0x1d2fad7, cFileName="..", cAlternateFileName="")) returned 1 [0030.157] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x5a7a9f80, dwReserved1=0x1d2fad7, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0030.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17) returned 0x2592c8 [0030.157] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.157] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x42400 [0030.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x42408) returned 0x25cd78 [0030.158] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x42400, lpOverlapped=0x0) returned 1 [0030.164] CloseHandle (hObject=0xcc) returned 1 [0030.164] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst")) returned 1 [0030.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256168 [0030.167] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b390 [0030.167] GetTickCount () returned 0x1842c [0030.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3c0 [0030.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f8 [0030.167] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099372\\...."), lpSecurityAttributes=0x256168) returned 1 [0030.167] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099372\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099372\\....\\temporaryfile")) returned 0 [0030.168] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099372\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099372\\temporaryfile")) returned 1 [0030.168] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099372\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170bf740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170bf740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170bf740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName=".", cAlternateFileName="")) returned 0x25b460 [0030.169] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170bf740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170bf740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170bf740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName="..", cAlternateFileName="")) returned 1 [0030.169] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170bf740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170bf740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170bf740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.169] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099372\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170bf740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170bf740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170bf740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0030.169] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170bf740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170bf740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170bf740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.169] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170bf740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170bf740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170bf740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.169] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0030.169] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099372\\temporaryfile")) returned 1 [0030.169] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x170bf740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x170bf740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170bf740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.169] FindClose (in: hFindFile=0x25b460 | out: hFindFile=0x25b460) returned 1 [0030.169] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099372" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099372")) returned 1 [0030.169] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned 0 [0030.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x42410) returned 0x29f188 [0030.178] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0030.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\Outlook Files\\voeimd@djhreuu.uhd.pst.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.178] WriteFile (in: hFile=0xcc, lpBuffer=0x29f190*, nNumberOfBytesToWrite=0x42408, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x29f190*, lpNumberOfBytesWritten=0x18fe38*=0x42408, lpOverlapped=0x0) returned 1 [0030.183] CloseHandle (hObject=0xcc) returned 1 [0030.187] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0030.188] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\Outlook Files\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x170e58a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x170e58a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x259288 [0030.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0030.188] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0030.188] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd1944a0, ftCreationTime.dwHighDateTime=0x1d4cefd, ftLastAccessTime.dwLowDateTime=0x93039030, ftLastAccessTime.dwHighDateTime=0x1d4c58a, ftLastWriteTime.dwLowDateTime=0x93039030, ftLastWriteTime.dwHighDateTime=0x1d4c58a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd1944a0, dwReserved1=0x1d4cefd, cFileName=".", cAlternateFileName="")) returned 0x259288 [0030.188] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd1944a0, ftCreationTime.dwHighDateTime=0x1d4cefd, ftLastAccessTime.dwLowDateTime=0x93039030, ftLastAccessTime.dwHighDateTime=0x1d4c58a, ftLastWriteTime.dwLowDateTime=0x93039030, ftLastWriteTime.dwHighDateTime=0x1d4c58a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd1944a0, dwReserved1=0x1d4cefd, cFileName="..", cAlternateFileName="")) returned 1 [0030.188] FindNextFileA (in: hFindFile=0x259288, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90b3900, ftCreationTime.dwHighDateTime=0x1d4cd33, ftLastAccessTime.dwLowDateTime=0xaa385f20, ftLastAccessTime.dwHighDateTime=0x1d4c8f9, ftLastWriteTime.dwLowDateTime=0xaa385f20, ftLastWriteTime.dwHighDateTime=0x1d4c8f9, nFileSizeHigh=0x0, nFileSizeLow=0x15e45, dwReserved0=0xcd1944a0, dwReserved1=0x1d4cefd, cFileName="4S7aUwFCgm0F2.docx", cAlternateFileName="4S7AUW~1.DOC")) returned 1 [0030.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13) returned 0x2592c8 [0030.188] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\4S7aUwFCgm0F2.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\4s7auwfcgm0f2.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.188] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x15e45 [0030.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15e4d) returned 0x25cd78 [0030.188] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x15e45, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x15e45, lpOverlapped=0x0) returned 1 [0030.189] CloseHandle (hObject=0xcc) returned 1 [0030.189] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\4S7aUwFCgm0F2.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\4s7auwfcgm0f2.docx")) returned 1 [0030.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.191] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b390 [0030.191] GetTickCount () returned 0x1844b [0030.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3c0 [0030.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f8 [0030.192] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.192] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\4S7aUwFCgm0F2.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\4s7auwfcgm0f2.docx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403\\....\\temporaryfile")) returned 0 [0030.192] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403\\temporaryfile")) returned 1 [0030.193] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b460 [0030.193] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.193] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.194] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0030.194] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.194] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.194] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0030.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403\\temporaryfile")) returned 1 [0030.194] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.194] FindClose (in: hFindFile=0x25b460 | out: hFindFile=0x25b460) returned 1 [0030.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403")) returned 1 [0030.194] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\4S7aUwFCgm0F2.docx") returned 0 [0030.196] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\4S7aUwFCgm0F2.docx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\4s7auwfcgm0f2.docx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.196] WriteFile (in: hFile=0xcc, lpBuffer=0x272bd8*, nNumberOfBytesToWrite=0x15e50, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x272bd8*, lpNumberOfBytesWritten=0x18fe38*=0x15e50, lpOverlapped=0x0) returned 1 [0030.198] CloseHandle (hObject=0xcc) returned 1 [0030.199] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\jCl699k6cnu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\jcl699k6cnu.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.199] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x2d6a [0030.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d72) returned 0x25cd78 [0030.200] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x2d6a, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x2d6a, lpOverlapped=0x0) returned 1 [0030.200] CloseHandle (hObject=0xcc) returned 1 [0030.200] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\jCl699k6cnu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\jcl699k6cnu.doc")) returned 1 [0030.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.202] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b388 [0030.202] GetTickCount () returned 0x1844b [0030.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3b8 [0030.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f0 [0030.202] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.203] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\jCl699k6cnu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\jcl699k6cnu.doc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403\\....\\temporaryfile")) returned 0 [0030.203] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403\\temporaryfile")) returned 1 [0030.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b458 [0030.204] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.204] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f0 [0030.204] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.204] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.204] FindClose (in: hFindFile=0x25b3f0 | out: hFindFile=0x25b3f0) returned 1 [0030.204] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403\\temporaryfile")) returned 1 [0030.204] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1710ba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1710ba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1710ba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.205] FindClose (in: hFindFile=0x25b458 | out: hFindFile=0x25b458) returned 1 [0030.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099403" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099403")) returned 1 [0030.205] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\jCl699k6cnu.doc") returned 0 [0030.205] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\jCl699k6cnu.doc.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\jcl699k6cnu.doc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.206] WriteFile (in: hFile=0xcc, lpBuffer=0x25fb00*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x25fb00*, lpNumberOfBytesWritten=0x18fe38*=0x2d70, lpOverlapped=0x0) returned 1 [0030.207] CloseHandle (hObject=0xcc) returned 1 [0030.207] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\ky0CNsBAgguhn.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\ky0cnsbagguhn.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.207] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x9bde [0030.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9be6) returned 0x25cd78 [0030.207] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x9bde, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x9bde, lpOverlapped=0x0) returned 1 [0030.208] CloseHandle (hObject=0xcc) returned 1 [0030.208] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\ky0CNsBAgguhn.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\ky0cnsbagguhn.pptx")) returned 1 [0030.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.210] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b390 [0030.210] GetTickCount () returned 0x1845b [0030.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3c0 [0030.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f8 [0030.210] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\ky0CNsBAgguhn.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\ky0cnsbagguhn.pptx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419\\....\\temporaryfile")) returned 0 [0030.211] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419\\temporaryfile")) returned 1 [0030.212] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b460 [0030.212] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.212] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.212] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0030.212] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.212] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.212] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0030.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419\\temporaryfile")) returned 1 [0030.212] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.212] FindClose (in: hFindFile=0x25b460 | out: hFindFile=0x25b460) returned 1 [0030.213] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419")) returned 1 [0030.213] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\ky0CNsBAgguhn.pptx") returned 0 [0030.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\ky0CNsBAgguhn.pptx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\ky0cnsbagguhn.pptx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.214] WriteFile (in: hFile=0xcc, lpBuffer=0x266970*, nNumberOfBytesToWrite=0x9be8, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x266970*, lpNumberOfBytesWritten=0x18fe38*=0x9be8, lpOverlapped=0x0) returned 1 [0030.215] CloseHandle (hObject=0xcc) returned 1 [0030.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\ojzwNs9.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\ojzwns9.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.216] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x57c6 [0030.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x57ce) returned 0x25cd78 [0030.216] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x57c6, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x57c6, lpOverlapped=0x0) returned 1 [0030.217] CloseHandle (hObject=0xcc) returned 1 [0030.217] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\ojzwNs9.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\ojzwns9.pps")) returned 1 [0030.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.218] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b388 [0030.218] GetTickCount () returned 0x1845b [0030.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3b8 [0030.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f0 [0030.219] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\ojzwNs9.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\ojzwns9.pps"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419\\....\\temporaryfile")) returned 0 [0030.219] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419\\temporaryfile")) returned 1 [0030.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b458 [0030.220] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.220] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f0 [0030.220] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.221] FindNextFileA (in: hFindFile=0x25b3f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b474, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.221] FindClose (in: hFindFile=0x25b3f0 | out: hFindFile=0x25b3f0) returned 1 [0030.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419\\temporaryfile")) returned 1 [0030.221] FindNextFileA (in: hFindFile=0x25b458, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17131b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17131b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17131b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.221] FindClose (in: hFindFile=0x25b458 | out: hFindFile=0x25b458) returned 1 [0030.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099419" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099419")) returned 1 [0030.221] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\ojzwNs9.pps") returned 0 [0030.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\ojzwNs9.pps.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\ojzwns9.pps.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.222] WriteFile (in: hFile=0xcc, lpBuffer=0x262558*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x262558*, lpNumberOfBytesWritten=0x18fe38*=0x57d0, lpOverlapped=0x0) returned 1 [0030.223] CloseHandle (hObject=0xcc) returned 1 [0030.224] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\p1IDCpnxsoIZs5eLNz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\p1idcpnxsoizs5elnz.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.224] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x10a76 [0030.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10a7e) returned 0x25cd78 [0030.224] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x10a76, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x10a76, lpOverlapped=0x0) returned 1 [0030.225] CloseHandle (hObject=0xcc) returned 1 [0030.225] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\p1IDCpnxsoIZs5eLNz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\p1idcpnxsoizs5elnz.doc")) returned 1 [0030.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.226] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b390 [0030.227] GetTickCount () returned 0x1846b [0030.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3c0 [0030.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b3f8 [0030.227] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099435\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099435\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.227] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\p1IDCpnxsoIZs5eLNz.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\p1idcpnxsoizs5elnz.doc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099435\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099435\\....\\temporaryfile")) returned 0 [0030.227] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099435\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099435\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099435\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099435\\temporaryfile")) returned 1 [0030.228] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099435\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17157cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17157cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17157cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b460 [0030.228] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17157cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17157cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17157cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.229] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17157cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17157cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17157cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099435\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17157cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17157cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17157cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b3f8 [0030.229] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17157cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17157cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17157cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.229] FindNextFileA (in: hFindFile=0x25b3f8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17157cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17157cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17157cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b47c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.229] FindClose (in: hFindFile=0x25b3f8 | out: hFindFile=0x25b3f8) returned 1 [0030.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099435\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099435\\temporaryfile")) returned 1 [0030.229] FindNextFileA (in: hFindFile=0x25b460, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17157cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17157cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17157cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.229] FindClose (in: hFindFile=0x25b460 | out: hFindFile=0x25b460) returned 1 [0030.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099435" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099435")) returned 1 [0030.229] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\p1IDCpnxsoIZs5eLNz.doc") returned 0 [0030.230] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\p1IDCpnxsoIZs5eLNz.doc.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\p1idcpnxsoizs5elnz.doc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.231] WriteFile (in: hFile=0xcc, lpBuffer=0x26d808*, nNumberOfBytesToWrite=0x10a80, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x26d808*, lpNumberOfBytesWritten=0x18fe38*=0x10a80, lpOverlapped=0x0) returned 1 [0030.232] CloseHandle (hObject=0xcc) returned 1 [0030.233] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\w7j NA8Fc2Fqu.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\w7j na8fc2fqu.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.233] GetFileSize (in: hFile=0xcc, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x15cfb [0030.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15d03) returned 0x25cd78 [0030.234] ReadFile (in: hFile=0xcc, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x15cfb, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x15cfb, lpOverlapped=0x0) returned 1 [0030.235] CloseHandle (hObject=0xcc) returned 1 [0030.235] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\w7j NA8Fc2Fqu.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\w7j na8fc2fqu.odt")) returned 1 [0030.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256180 [0030.237] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b3b0 [0030.237] GetTickCount () returned 0x1847a [0030.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b3e0 [0030.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b418 [0030.237] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450\\...."), lpSecurityAttributes=0x256180) returned 1 [0030.238] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\w7j NA8Fc2Fqu.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\w7j na8fc2fqu.odt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450\\....\\temporaryfile")) returned 0 [0030.238] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450\\temporaryfile")) returned 1 [0030.239] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b480 [0030.239] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.239] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.239] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b418 [0030.239] FindNextFileA (in: hFindFile=0x25b418, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.239] FindNextFileA (in: hFindFile=0x25b418, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b49c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.239] FindClose (in: hFindFile=0x25b418 | out: hFindFile=0x25b418) returned 1 [0030.239] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450\\temporaryfile")) returned 1 [0030.239] FindNextFileA (in: hFindFile=0x25b480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.239] FindClose (in: hFindFile=0x25b480 | out: hFindFile=0x25b480) returned 1 [0030.239] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450")) returned 1 [0030.239] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\w7j NA8Fc2Fqu.odt") returned 0 [0030.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\w7j NA8Fc2Fqu.odt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbgvmc8i55cdkr\\w7j na8fc2fqu.odt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0030.241] WriteFile (in: hFile=0xcc, lpBuffer=0x272a90*, nNumberOfBytesToWrite=0x15d00, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x272a90*, lpNumberOfBytesWritten=0x18fe38*=0x15d00, lpOverlapped=0x0) returned 1 [0030.243] CloseHandle (hObject=0xcc) returned 1 [0030.244] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0030.244] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\\\VBGVmC8I55cDkr\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd1944a0, ftCreationTime.dwHighDateTime=0x1d4cefd, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x259288 [0030.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0030.244] FindClose (in: hFindFile=0x259288 | out: hFindFile=0x259288) returned 1 [0030.244] FindClose (in: hFindFile=0x2592e8 | out: hFindFile=0x2592e8) returned 1 [0030.244] SHGetSpecialFolderPathA (in: hwnd=0x0, pszPath=0x18fd80, csidl=16, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0030.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x27) returned 0x259418 [0030.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2b) returned 0x259448 [0030.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\*.*", lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x114e1630, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x114e1630, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x18fb3c, cFileName=".", cAlternateFileName="")) returned 0x2594e0 [0030.246] FindNextFileA (in: hFindFile=0x2594e0, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x114e1630, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x114e1630, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x18fb3c, cFileName="..", cAlternateFileName="")) returned 1 [0030.247] FindNextFileA (in: hFindFile=0x2594e0, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325df410, ftCreationTime.dwHighDateTime=0x1d4cde5, ftLastAccessTime.dwLowDateTime=0xba9c3a10, ftLastAccessTime.dwHighDateTime=0x1d4ca1d, ftLastWriteTime.dwLowDateTime=0xba9c3a10, ftLastWriteTime.dwHighDateTime=0x1d4ca1d, nFileSizeHigh=0x0, nFileSizeLow=0x175b4, dwReserved0=0x1c, dwReserved1=0x18fb3c, cFileName="-uMN xl8k6N90pMRQ.mp3", cAlternateFileName="-UMNXL~1.MP3")) returned 1 [0030.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16) returned 0x259070 [0030.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\-uMN xl8k6N90pMRQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-umn xl8k6n90pmrq.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.247] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x175b4 [0030.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x175bc) returned 0x25cd78 [0030.247] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x175b4, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x175b4, lpOverlapped=0x0) returned 1 [0030.247] CloseHandle (hObject=0xc4) returned 1 [0030.247] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\-uMN xl8k6N90pMRQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-umn xl8k6n90pmrq.mp3")) returned 1 [0030.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.250] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.250] GetTickCount () returned 0x1847a [0030.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a528 [0030.251] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\-uMN xl8k6N90pMRQ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-umn xl8k6n90pmrq.mp3"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450\\....\\temporaryfile")) returned 0 [0030.252] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450\\temporaryfile")) returned 1 [0030.253] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171a3f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171a3f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0xc, cFileName=".", cAlternateFileName="")) returned 0x25a590 [0030.253] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171a3f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171a3f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0xc, cFileName="..", cAlternateFileName="")) returned 1 [0030.253] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0xc, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.253] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a528 [0030.253] FindNextFileA (in: hFindFile=0x25a528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.253] FindNextFileA (in: hFindFile=0x25a528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.253] FindClose (in: hFindFile=0x25a528 | out: hFindFile=0x25a528) returned 1 [0030.253] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450\\temporaryfile")) returned 1 [0030.254] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1717de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1717de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1717de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0xc, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.254] FindClose (in: hFindFile=0x25a590 | out: hFindFile=0x25a590) returned 1 [0030.254] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099450" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099450")) returned 1 [0030.254] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\-uMN xl8k6N90pMRQ.mp3") returned 0 [0030.255] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\-uMN xl8k6N90pMRQ.mp3.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-umn xl8k6n90pmrq.mp3.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.256] WriteFile (in: hFile=0xc4, lpBuffer=0x274348*, nNumberOfBytesToWrite=0x175b8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x274348*, lpNumberOfBytesWritten=0x18fe58*=0x175b8, lpOverlapped=0x0) returned 1 [0030.258] CloseHandle (hObject=0xc4) returned 1 [0030.259] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.259] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x2a000 [0030.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a008) returned 0x25cd78 [0030.259] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x2a000, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x2a000, lpOverlapped=0x0) returned 1 [0030.261] CloseHandle (hObject=0xc4) returned 1 [0030.261] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe")) returned 0 [0030.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.261] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259480 [0030.261] GetTickCount () returned 0x1848a [0030.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a528 [0030.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259480 [0030.264] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099466\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099466\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099466\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099466\\....\\temporaryfile")) returned 1 [0030.266] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099466\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099466\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099466\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099466\\temporaryfile")) returned 1 [0030.267] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099466\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171a3f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171a3f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171a3f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259480 [0030.267] FindNextFileA (in: hFindFile=0x259480, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171a3f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171a3f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171a3f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.267] FindNextFileA (in: hFindFile=0x259480, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171a3f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171a3f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171a3f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.267] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099466\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171a3f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171a3f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171a3f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25949c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b5f0 [0030.267] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171a3f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171a3f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171a3f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25949c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.267] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6227f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6227f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x589e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x25949c, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.267] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099466\\TemporaryFile\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099466\\temporaryfile\\temporaryfile")) returned 0 [0030.268] FindClose (in: hFindFile=0x25b5f0 | out: hFindFile=0x25b5f0) returned 1 [0030.268] FindClose (in: hFindFile=0x259480 | out: hFindFile=0x259480) returned 1 [0030.268] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\1.exe") returned 0 [0030.271] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\1.exe.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.272] WriteFile (in: hFile=0xc4, lpBuffer=0x286d90*, nNumberOfBytesToWrite=0x2a008, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x286d90*, lpNumberOfBytesWritten=0x18fe58*=0x2a008, lpOverlapped=0x0) returned 1 [0030.275] CloseHandle (hObject=0xc4) returned 1 [0030.277] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\2LoErBDNL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2loerbdnl.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.277] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x1809 [0030.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1811) returned 0x25a528 [0030.277] ReadFile (in: hFile=0xc4, lpBuffer=0x25a530, nNumberOfBytesToRead=0x1809, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a530*, lpNumberOfBytesRead=0x18fe70*=0x1809, lpOverlapped=0x0) returned 1 [0030.277] CloseHandle (hObject=0xc4) returned 1 [0030.277] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\2LoErBDNL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2loerbdnl.flv")) returned 1 [0030.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.278] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.278] GetTickCount () returned 0x18499 [0030.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25bd48 [0030.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.279] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099481\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099481\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.279] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\2LoErBDNL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2loerbdnl.flv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099481\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099481\\....\\temporaryfile")) returned 0 [0030.279] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099481\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099481\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099481\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099481\\temporaryfile")) returned 1 [0030.280] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099481\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171ca0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171ca0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171ca0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6227f80, dwReserved1=0x1d538c3, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.281] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171ca0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171ca0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171ca0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6227f80, dwReserved1=0x1d538c3, cFileName="..", cAlternateFileName="")) returned 1 [0030.281] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171ca0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171ca0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171ca0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6227f80, dwReserved1=0x1d538c3, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099481\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171ca0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171ca0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171ca0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25be08 [0030.281] FindNextFileA (in: hFindFile=0x25be08, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171ca0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171ca0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171ca0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.281] FindNextFileA (in: hFindFile=0x25be08, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171ca0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171ca0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171ca0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.281] FindClose (in: hFindFile=0x25be08 | out: hFindFile=0x25be08) returned 1 [0030.281] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099481\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099481\\temporaryfile")) returned 1 [0030.281] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171ca0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171ca0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171ca0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6227f80, dwReserved1=0x1d538c3, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.281] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.281] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099481" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099481")) returned 1 [0030.281] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\2LoErBDNL.flv") returned 0 [0030.282] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\2LoErBDNL.flv.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2loerbdnl.flv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.282] WriteFile (in: hFile=0xc4, lpBuffer=0x25cd80*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesWritten=0x18fe58*=0x1810, lpOverlapped=0x0) returned 1 [0030.283] CloseHandle (hObject=0xc4) returned 1 [0030.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\4eaJAvH8dt snU9W.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4eajavh8dt snu9w.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.284] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xfe3b [0030.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfe43) returned 0x25cd78 [0030.284] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xfe3b, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xfe3b, lpOverlapped=0x0) returned 1 [0030.284] CloseHandle (hObject=0xc4) returned 1 [0030.284] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\4eaJAvH8dt snU9W.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4eajavh8dt snu9w.flv")) returned 1 [0030.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.286] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.287] GetTickCount () returned 0x184a9 [0030.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a528 [0030.287] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099497\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099497\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.290] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\4eaJAvH8dt snU9W.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4eajavh8dt snu9w.flv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099497\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099497\\....\\temporaryfile")) returned 0 [0030.290] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099497\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099497\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099497\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099497\\temporaryfile")) returned 1 [0030.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099497\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171f0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171f0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171f0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a590 [0030.291] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171f0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171f0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171f0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.291] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171f0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171f0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171f0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099497\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171f0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171f0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171f0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a528 [0030.291] FindNextFileA (in: hFindFile=0x25a528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171f0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171f0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171f0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.291] FindNextFileA (in: hFindFile=0x25a528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171f0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171f0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171f0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.291] FindClose (in: hFindFile=0x25a528 | out: hFindFile=0x25a528) returned 1 [0030.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099497\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099497\\temporaryfile")) returned 1 [0030.291] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x171f0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x171f0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x171f0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.291] FindClose (in: hFindFile=0x25a590 | out: hFindFile=0x25a590) returned 1 [0030.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099497" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099497")) returned 1 [0030.292] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\4eaJAvH8dt snU9W.flv") returned 0 [0030.293] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\4eaJAvH8dt snU9W.flv.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4eajavh8dt snu9w.flv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.293] WriteFile (in: hFile=0xc4, lpBuffer=0x26cbd0*, nNumberOfBytesToWrite=0xfe40, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26cbd0*, lpNumberOfBytesWritten=0x18fe58*=0xfe40, lpOverlapped=0x0) returned 1 [0030.295] CloseHandle (hObject=0xc4) returned 1 [0030.296] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\6GPQLrb9z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6gpqlrb9z.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.296] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x2794 [0030.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x279c) returned 0x25cd78 [0030.296] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x2794, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x2794, lpOverlapped=0x0) returned 1 [0030.297] CloseHandle (hObject=0xc4) returned 1 [0030.297] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\6GPQLrb9z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6gpqlrb9z.png")) returned 1 [0030.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.299] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.299] GetTickCount () returned 0x184b9 [0030.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a528 [0030.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.299] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.301] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\6GPQLrb9z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6gpqlrb9z.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513\\....\\temporaryfile")) returned 0 [0030.301] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513\\temporaryfile")) returned 1 [0030.302] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.303] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.303] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.303] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b5f0 [0030.303] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.303] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.303] FindClose (in: hFindFile=0x25b5f0 | out: hFindFile=0x25b5f0) returned 1 [0030.303] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513\\temporaryfile")) returned 1 [0030.303] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.303] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.303] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513")) returned 1 [0030.303] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\6GPQLrb9z.png") returned 0 [0030.304] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\6GPQLrb9z.png.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6gpqlrb9z.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.304] WriteFile (in: hFile=0xc4, lpBuffer=0x25f528*, nNumberOfBytesToWrite=0x2798, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25f528*, lpNumberOfBytesWritten=0x18fe58*=0x2798, lpOverlapped=0x0) returned 1 [0030.305] CloseHandle (hObject=0xc4) returned 1 [0030.306] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\7IfjlEOaKqm-B.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7ifjleoakqm-b.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.306] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xe250 [0030.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe258) returned 0x25cd78 [0030.306] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xe250, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xe250, lpOverlapped=0x0) returned 1 [0030.307] CloseHandle (hObject=0xc4) returned 1 [0030.307] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\7IfjlEOaKqm-B.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7ifjleoakqm-b.wav")) returned 1 [0030.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.308] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.308] GetTickCount () returned 0x184b9 [0030.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0030.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a528 [0030.309] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.309] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\7IfjlEOaKqm-B.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7ifjleoakqm-b.wav"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513\\....\\temporaryfile")) returned 0 [0030.309] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513\\temporaryfile")) returned 1 [0030.310] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a590 [0030.310] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.310] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.310] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a528 [0030.310] FindNextFileA (in: hFindFile=0x25a528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.311] FindNextFileA (in: hFindFile=0x25a528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.311] FindClose (in: hFindFile=0x25a528 | out: hFindFile=0x25a528) returned 1 [0030.311] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513\\temporaryfile")) returned 1 [0030.311] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172163a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172163a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172163a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.311] FindClose (in: hFindFile=0x25a590 | out: hFindFile=0x25a590) returned 1 [0030.311] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099513" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099513")) returned 1 [0030.311] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\7IfjlEOaKqm-B.wav") returned 0 [0030.312] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\7IfjlEOaKqm-B.wav.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7ifjleoakqm-b.wav.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.313] WriteFile (in: hFile=0xc4, lpBuffer=0x26afe0*, nNumberOfBytesToWrite=0xe258, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26afe0*, lpNumberOfBytesWritten=0x18fe58*=0xe258, lpOverlapped=0x0) returned 1 [0030.314] CloseHandle (hObject=0xc4) returned 1 [0030.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\9H9uiT4RQS.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9h9uit4rqs.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.316] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xd749 [0030.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd751) returned 0x25cd78 [0030.316] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xd749, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xd749, lpOverlapped=0x0) returned 1 [0030.317] CloseHandle (hObject=0xc4) returned 1 [0030.317] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\9H9uiT4RQS.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9h9uit4rqs.bmp")) returned 1 [0030.318] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.319] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.319] GetTickCount () returned 0x184c8 [0030.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a528 [0030.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.319] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099528\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.319] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\9H9uiT4RQS.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9h9uit4rqs.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099528\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099528\\....\\temporaryfile")) returned 0 [0030.319] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099528\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099528\\temporaryfile")) returned 1 [0030.320] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099528\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1723c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1723c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1723c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.321] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1723c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1723c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1723c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.321] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1723c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1723c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1723c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.321] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099528\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1723c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1723c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1723c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b5f0 [0030.321] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1723c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1723c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1723c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.321] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1723c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1723c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1723c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.321] FindClose (in: hFindFile=0x25b5f0 | out: hFindFile=0x25b5f0) returned 1 [0030.321] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099528\\temporaryfile")) returned 1 [0030.321] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1723c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1723c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1723c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.321] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.321] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099528" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099528")) returned 1 [0030.321] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\9H9uiT4RQS.bmp") returned 0 [0030.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\9H9uiT4RQS.bmp.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9h9uit4rqs.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.324] WriteFile (in: hFile=0xc4, lpBuffer=0x26a4e0*, nNumberOfBytesToWrite=0xd750, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26a4e0*, lpNumberOfBytesWritten=0x18fe58*=0xd750, lpOverlapped=0x0) returned 1 [0030.325] CloseHandle (hObject=0xc4) returned 1 [0030.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\9IYI59Ta.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9iyi59ta.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.329] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xbd2e [0030.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbd36) returned 0x25cd78 [0030.329] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xbd2e, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xbd2e, lpOverlapped=0x0) returned 1 [0030.330] CloseHandle (hObject=0xc4) returned 1 [0030.330] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\9IYI59Ta.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9iyi59ta.jpg")) returned 1 [0030.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.331] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.331] GetTickCount () returned 0x184d8 [0030.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a528 [0030.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.332] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.332] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\9IYI59Ta.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9iyi59ta.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544\\....\\temporaryfile")) returned 0 [0030.332] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544\\temporaryfile")) returned 1 [0030.333] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.333] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.333] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.333] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b5f0 [0030.334] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.334] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.334] FindClose (in: hFindFile=0x25b5f0 | out: hFindFile=0x25b5f0) returned 1 [0030.334] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544\\temporaryfile")) returned 1 [0030.334] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.334] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.334] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544")) returned 1 [0030.334] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\9IYI59Ta.jpg") returned 0 [0030.335] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\9IYI59Ta.jpg.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9iyi59ta.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.336] WriteFile (in: hFile=0xc4, lpBuffer=0x268ac0*, nNumberOfBytesToWrite=0xbd38, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x268ac0*, lpNumberOfBytesWritten=0x18fe58*=0xbd38, lpOverlapped=0x0) returned 1 [0030.337] CloseHandle (hObject=0xc4) returned 1 [0030.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\Auw4sdsTepKYeu356.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\auw4sdstepkyeu356.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.338] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x188df [0030.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x188e7) returned 0x25cd78 [0030.338] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x188df, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x188df, lpOverlapped=0x0) returned 1 [0030.339] CloseHandle (hObject=0xc4) returned 1 [0030.339] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\Auw4sdsTepKYeu356.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\auw4sdstepkyeu356.ppt")) returned 1 [0030.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.341] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.341] GetTickCount () returned 0x184d8 [0030.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a528 [0030.342] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.342] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\Auw4sdsTepKYeu356.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\auw4sdstepkyeu356.ppt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544\\....\\temporaryfile")) returned 0 [0030.342] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544\\temporaryfile")) returned 1 [0030.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a590 [0030.343] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.343] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a528 [0030.344] FindNextFileA (in: hFindFile=0x25a528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.344] FindNextFileA (in: hFindFile=0x25a528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.344] FindClose (in: hFindFile=0x25a528 | out: hFindFile=0x25a528) returned 1 [0030.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544\\temporaryfile")) returned 1 [0030.344] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17262660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17262660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17262660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.344] FindClose (in: hFindFile=0x25a590 | out: hFindFile=0x25a590) returned 1 [0030.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099544" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099544")) returned 1 [0030.344] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\Auw4sdsTepKYeu356.ppt") returned 0 [0030.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x188f0) returned 0x275668 [0030.346] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0030.346] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\Auw4sdsTepKYeu356.ppt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\auw4sdstepkyeu356.ppt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.346] WriteFile (in: hFile=0xc4, lpBuffer=0x275670*, nNumberOfBytesToWrite=0x188e8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x275670*, lpNumberOfBytesWritten=0x18fe58*=0x188e8, lpOverlapped=0x0) returned 1 [0030.349] CloseHandle (hObject=0xc4) returned 1 [0030.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\cV435fL13v.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cv435fl13v.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.350] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x607f [0030.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6087) returned 0x25cd78 [0030.350] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x607f, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x607f, lpOverlapped=0x0) returned 1 [0030.351] CloseHandle (hObject=0xc4) returned 1 [0030.351] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\cV435fL13v.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cv435fl13v.jpg")) returned 1 [0030.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.352] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.352] GetTickCount () returned 0x184e7 [0030.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a528 [0030.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.353] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099559\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099559\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.353] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\cV435fL13v.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cv435fl13v.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099559\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099559\\....\\temporaryfile")) returned 0 [0030.353] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099559\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099559\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099559\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099559\\temporaryfile")) returned 1 [0030.354] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099559\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172887c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172887c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172887c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.354] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172887c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172887c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172887c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.354] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172887c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172887c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172887c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.354] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099559\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172887c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172887c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172887c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b5f0 [0030.354] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172887c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172887c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172887c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.354] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172887c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172887c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172887c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.355] FindClose (in: hFindFile=0x25b5f0 | out: hFindFile=0x25b5f0) returned 1 [0030.355] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099559\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099559\\temporaryfile")) returned 1 [0030.355] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172887c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172887c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172887c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.355] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.355] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099559" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099559")) returned 1 [0030.355] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\cV435fL13v.jpg") returned 0 [0030.356] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\cV435fL13v.jpg.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cv435fl13v.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.356] WriteFile (in: hFile=0xc4, lpBuffer=0x262e10*, nNumberOfBytesToWrite=0x6088, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x262e10*, lpNumberOfBytesWritten=0x18fe58*=0x6088, lpOverlapped=0x0) returned 1 [0030.357] CloseHandle (hObject=0xc4) returned 1 [0030.358] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\cyqPND.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cyqpnd.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.359] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xbe23 [0030.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbe2b) returned 0x25cd78 [0030.359] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xbe23, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xbe23, lpOverlapped=0x0) returned 1 [0030.359] CloseHandle (hObject=0xc4) returned 1 [0030.359] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\cyqPND.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cyqpnd.wav")) returned 1 [0030.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.361] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.361] GetTickCount () returned 0x184f7 [0030.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a528 [0030.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.361] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.362] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\cyqPND.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cyqpnd.wav"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575\\....\\temporaryfile")) returned 0 [0030.362] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575\\temporaryfile")) returned 1 [0030.363] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.363] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.363] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.363] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b5f0 [0030.363] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.363] FindNextFileA (in: hFindFile=0x25b5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.363] FindClose (in: hFindFile=0x25b5f0 | out: hFindFile=0x25b5f0) returned 1 [0030.363] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575\\temporaryfile")) returned 1 [0030.363] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.363] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.363] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575")) returned 1 [0030.364] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\cyqPND.wav") returned 0 [0030.364] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\cyqPND.wav.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cyqpnd.wav.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.365] WriteFile (in: hFile=0xc4, lpBuffer=0x268bb8*, nNumberOfBytesToWrite=0xbe28, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x268bb8*, lpNumberOfBytesWritten=0x18fe58*=0xbe28, lpOverlapped=0x0) returned 1 [0030.367] CloseHandle (hObject=0xc4) returned 1 [0030.368] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.368] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x11a [0030.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x122) returned 0x25a528 [0030.368] ReadFile (in: hFile=0xc4, lpBuffer=0x25a530, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25a530*, lpNumberOfBytesRead=0x18fe70*=0x11a, lpOverlapped=0x0) returned 1 [0030.369] CloseHandle (hObject=0xc4) returned 1 [0030.369] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini")) returned 1 [0030.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.370] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.370] GetTickCount () returned 0x184f7 [0030.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a658 [0030.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.370] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.371] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575\\....\\temporaryfile")) returned 0 [0030.371] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575\\temporaryfile")) returned 1 [0030.372] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.372] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.372] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.372] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b720 [0030.372] FindNextFileA (in: hFindFile=0x25b720, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.372] FindNextFileA (in: hFindFile=0x25b720, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.372] FindClose (in: hFindFile=0x25b720 | out: hFindFile=0x25b720) returned 1 [0030.372] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575\\temporaryfile")) returned 1 [0030.373] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172ae920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172ae920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172ae920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.373] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.373] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099575" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099575")) returned 1 [0030.373] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\desktop.ini") returned 0 [0030.373] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.374] WriteFile (in: hFile=0xc4, lpBuffer=0x25a660*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25a660*, lpNumberOfBytesWritten=0x18fe58*=0x120, lpOverlapped=0x0) returned 1 [0030.374] CloseHandle (hObject=0xc4) returned 1 [0030.375] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\EDxoaq8Iw18ul.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\edxoaq8iw18ul.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.375] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x16f8f [0030.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16f97) returned 0x25cd78 [0030.375] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x16f8f, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x16f8f, lpOverlapped=0x0) returned 1 [0030.376] CloseHandle (hObject=0xc4) returned 1 [0030.376] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\EDxoaq8Iw18ul.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\edxoaq8iw18ul.gif")) returned 1 [0030.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.379] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.379] GetTickCount () returned 0x18507 [0030.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a528 [0030.380] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099591\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099591\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.380] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\EDxoaq8Iw18ul.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\edxoaq8iw18ul.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099591\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099591\\....\\temporaryfile")) returned 0 [0030.380] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099591\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099591\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099591\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099591\\temporaryfile")) returned 1 [0030.381] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099591\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172d4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172d4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172d4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a590 [0030.381] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172d4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172d4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172d4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.381] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172d4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172d4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172d4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.381] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099591\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172d4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172d4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172d4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a528 [0030.382] FindNextFileA (in: hFindFile=0x25a528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172d4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172d4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172d4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.382] FindNextFileA (in: hFindFile=0x25a528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172d4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172d4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172d4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.382] FindClose (in: hFindFile=0x25a528 | out: hFindFile=0x25a528) returned 1 [0030.382] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099591\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099591\\temporaryfile")) returned 1 [0030.382] FindNextFileA (in: hFindFile=0x25a590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x172d4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x172d4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x172d4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.382] FindClose (in: hFindFile=0x25a590 | out: hFindFile=0x25a590) returned 1 [0030.382] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099591" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099591")) returned 1 [0030.382] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\EDxoaq8Iw18ul.gif") returned 0 [0030.384] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\EDxoaq8Iw18ul.gif.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\edxoaq8iw18ul.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.384] WriteFile (in: hFile=0xc4, lpBuffer=0x273d20*, nNumberOfBytesToWrite=0x16f98, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x273d20*, lpNumberOfBytesWritten=0x18fe58*=0x16f98, lpOverlapped=0x0) returned 1 [0030.390] CloseHandle (hObject=0xc4) returned 1 [0030.391] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\GwN9jYVw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gwn9jyvw.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.392] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xe45a [0030.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe462) returned 0x25cd78 [0030.392] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xe45a, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xe45a, lpOverlapped=0x0) returned 1 [0030.392] CloseHandle (hObject=0xc4) returned 1 [0030.392] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\GwN9jYVw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gwn9jyvw.bmp")) returned 1 [0030.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.408] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.408] GetTickCount () returned 0x18526 [0030.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b528 [0030.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.408] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.408] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\GwN9jYVw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gwn9jyvw.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622\\....\\temporaryfile")) returned 0 [0030.409] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622\\temporaryfile")) returned 1 [0030.409] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.410] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.410] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.410] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f0 [0030.410] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.410] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.410] FindClose (in: hFindFile=0x25c5f0 | out: hFindFile=0x25c5f0) returned 1 [0030.410] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622\\temporaryfile")) returned 1 [0030.410] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.410] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.410] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622")) returned 1 [0030.410] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\GwN9jYVw.bmp") returned 0 [0030.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\GwN9jYVw.bmp.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gwn9jyvw.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.413] WriteFile (in: hFile=0xc4, lpBuffer=0x26b1f0*, nNumberOfBytesToWrite=0xe460, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26b1f0*, lpNumberOfBytesWritten=0x18fe58*=0xe460, lpOverlapped=0x0) returned 1 [0030.414] CloseHandle (hObject=0xc4) returned 1 [0030.416] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\IL_OG8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\il_og8.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.416] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x555e [0030.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5566) returned 0x25cd78 [0030.416] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x555e, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x555e, lpOverlapped=0x0) returned 1 [0030.416] CloseHandle (hObject=0xc4) returned 1 [0030.416] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\IL_OG8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\il_og8.avi")) returned 1 [0030.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.417] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.417] GetTickCount () returned 0x18526 [0030.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b528 [0030.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.418] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.418] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\IL_OG8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\il_og8.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622\\....\\temporaryfile")) returned 0 [0030.418] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622\\temporaryfile")) returned 1 [0030.419] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.419] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.419] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.420] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f0 [0030.420] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.420] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.420] FindClose (in: hFindFile=0x25c5f0 | out: hFindFile=0x25c5f0) returned 1 [0030.420] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622\\temporaryfile")) returned 1 [0030.420] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17320d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17320d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17320d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.420] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.420] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099622" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099622")) returned 1 [0030.420] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\IL_OG8.avi") returned 0 [0030.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\IL_OG8.avi.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\il_og8.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.421] WriteFile (in: hFile=0xc4, lpBuffer=0x2622f0*, nNumberOfBytesToWrite=0x5568, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x2622f0*, lpNumberOfBytesWritten=0x18fe58*=0x5568, lpOverlapped=0x0) returned 1 [0030.422] CloseHandle (hObject=0xc4) returned 1 [0030.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\imF1N2GKr.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imf1n2gkr.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.424] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xcba3 [0030.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcbab) returned 0x25cd78 [0030.424] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xcba3, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xcba3, lpOverlapped=0x0) returned 1 [0030.424] CloseHandle (hObject=0xc4) returned 1 [0030.424] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\imF1N2GKr.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imf1n2gkr.bmp")) returned 1 [0030.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.426] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.426] GetTickCount () returned 0x18535 [0030.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b528 [0030.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.426] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.427] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\imF1N2GKr.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imf1n2gkr.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637\\....\\temporaryfile")) returned 0 [0030.427] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637\\temporaryfile")) returned 1 [0030.428] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.428] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.428] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.428] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f0 [0030.428] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.428] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.428] FindClose (in: hFindFile=0x25c5f0 | out: hFindFile=0x25c5f0) returned 1 [0030.428] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637\\temporaryfile")) returned 1 [0030.428] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.428] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.428] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637")) returned 1 [0030.429] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\imF1N2GKr.bmp") returned 0 [0030.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\imF1N2GKr.bmp.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\imf1n2gkr.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.430] WriteFile (in: hFile=0xc4, lpBuffer=0x269938*, nNumberOfBytesToWrite=0xcba8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x269938*, lpNumberOfBytesWritten=0x18fe58*=0xcba8, lpOverlapped=0x0) returned 1 [0030.432] CloseHandle (hObject=0xc4) returned 1 [0030.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\IpQ3E_cZPa8PdDey.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ipq3e_czpa8pddey.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.433] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x2a0b [0030.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a13) returned 0x25cd78 [0030.433] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x2a0b, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x2a0b, lpOverlapped=0x0) returned 1 [0030.433] CloseHandle (hObject=0xc4) returned 1 [0030.433] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\IpQ3E_cZPa8PdDey.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ipq3e_czpa8pddey.ots")) returned 1 [0030.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.435] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.435] GetTickCount () returned 0x18535 [0030.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b528 [0030.435] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.436] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\IpQ3E_cZPa8PdDey.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ipq3e_czpa8pddey.ots"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637\\....\\temporaryfile")) returned 0 [0030.436] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637\\temporaryfile")) returned 1 [0030.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b590 [0030.437] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.437] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b528 [0030.437] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.437] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.437] FindClose (in: hFindFile=0x25b528 | out: hFindFile=0x25b528) returned 1 [0030.437] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637\\temporaryfile")) returned 1 [0030.437] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17346ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17346ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17346ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.437] FindClose (in: hFindFile=0x25b590 | out: hFindFile=0x25b590) returned 1 [0030.437] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099637" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099637")) returned 1 [0030.438] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\IpQ3E_cZPa8PdDey.ots") returned 0 [0030.438] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\IpQ3E_cZPa8PdDey.ots.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ipq3e_czpa8pddey.ots.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.439] WriteFile (in: hFile=0xc4, lpBuffer=0x25f7a0*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25f7a0*, lpNumberOfBytesWritten=0x18fe58*=0x2a10, lpOverlapped=0x0) returned 1 [0030.440] CloseHandle (hObject=0xc4) returned 1 [0030.440] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\L4u6PoFiCYyO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l4u6poficyyo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.441] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x1063b [0030.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10643) returned 0x25cd78 [0030.441] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x1063b, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x1063b, lpOverlapped=0x0) returned 1 [0030.441] CloseHandle (hObject=0xc4) returned 1 [0030.441] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\L4u6PoFiCYyO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l4u6poficyyo.png")) returned 1 [0030.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.443] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.443] GetTickCount () returned 0x18545 [0030.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b528 [0030.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.443] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099653\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099653\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.446] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\L4u6PoFiCYyO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l4u6poficyyo.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099653\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099653\\....\\temporaryfile")) returned 0 [0030.446] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099653\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099653\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099653\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099653\\temporaryfile")) returned 1 [0030.447] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099653\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1736d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1736d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1736d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.447] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1736d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1736d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1736d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.447] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1736d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1736d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1736d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.447] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099653\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1736d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1736d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1736d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f0 [0030.447] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1736d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1736d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1736d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.447] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1736d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1736d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1736d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.447] FindClose (in: hFindFile=0x25c5f0 | out: hFindFile=0x25c5f0) returned 1 [0030.448] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099653\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099653\\temporaryfile")) returned 1 [0030.448] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1736d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1736d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1736d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.448] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.448] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099653" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099653")) returned 1 [0030.448] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\L4u6PoFiCYyO.png") returned 0 [0030.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\L4u6PoFiCYyO.png.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l4u6poficyyo.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.450] WriteFile (in: hFile=0xc4, lpBuffer=0x26d3d0*, nNumberOfBytesToWrite=0x10640, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26d3d0*, lpNumberOfBytesWritten=0x18fe58*=0x10640, lpOverlapped=0x0) returned 1 [0030.451] CloseHandle (hObject=0xc4) returned 1 [0030.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\LbU4hyLoWMMWQlqFMMj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbu4hylowmmwqlqfmmj.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.453] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x17d65 [0030.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17d6d) returned 0x25cd78 [0030.453] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x17d65, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x17d65, lpOverlapped=0x0) returned 1 [0030.453] CloseHandle (hObject=0xc4) returned 1 [0030.453] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\LbU4hyLoWMMWQlqFMMj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbu4hylowmmwqlqfmmj.m4a")) returned 1 [0030.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.455] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.455] GetTickCount () returned 0x18555 [0030.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b528 [0030.456] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.456] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\LbU4hyLoWMMWQlqFMMj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbu4hylowmmwqlqfmmj.m4a"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669\\....\\temporaryfile")) returned 0 [0030.456] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669\\temporaryfile")) returned 1 [0030.459] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b590 [0030.459] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.459] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.459] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b528 [0030.459] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.459] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.459] FindClose (in: hFindFile=0x25b528 | out: hFindFile=0x25b528) returned 1 [0030.459] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669\\temporaryfile")) returned 1 [0030.460] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.460] FindClose (in: hFindFile=0x25b590 | out: hFindFile=0x25b590) returned 1 [0030.460] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669")) returned 1 [0030.460] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\LbU4hyLoWMMWQlqFMMj.m4a") returned 0 [0030.461] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\LbU4hyLoWMMWQlqFMMj.m4a.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbu4hylowmmwqlqfmmj.m4a.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.462] WriteFile (in: hFile=0xc4, lpBuffer=0x274af8*, nNumberOfBytesToWrite=0x17d70, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x274af8*, lpNumberOfBytesWritten=0x18fe58*=0x17d70, lpOverlapped=0x0) returned 1 [0030.464] CloseHandle (hObject=0xc4) returned 1 [0030.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\NJ0nkkjXO-jifKg04a.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nj0nkkjxo-jifkg04a.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.466] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x1083f [0030.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10847) returned 0x25cd78 [0030.466] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x1083f, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x1083f, lpOverlapped=0x0) returned 1 [0030.466] CloseHandle (hObject=0xc4) returned 1 [0030.466] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\NJ0nkkjXO-jifKg04a.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nj0nkkjxo-jifkg04a.wav")) returned 1 [0030.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.468] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.468] GetTickCount () returned 0x18555 [0030.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b528 [0030.469] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.469] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\NJ0nkkjXO-jifKg04a.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nj0nkkjxo-jifkg04a.wav"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669\\....\\temporaryfile")) returned 0 [0030.469] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669\\temporaryfile")) returned 1 [0030.470] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b590 [0030.470] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.470] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.470] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b528 [0030.471] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.471] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.471] FindClose (in: hFindFile=0x25b528 | out: hFindFile=0x25b528) returned 1 [0030.471] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669\\temporaryfile")) returned 1 [0030.471] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17393160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17393160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17393160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.471] FindClose (in: hFindFile=0x25b590 | out: hFindFile=0x25b590) returned 1 [0030.471] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099669" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099669")) returned 1 [0030.471] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\NJ0nkkjXO-jifKg04a.wav") returned 0 [0030.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\NJ0nkkjXO-jifKg04a.wav.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nj0nkkjxo-jifkg04a.wav.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.473] WriteFile (in: hFile=0xc4, lpBuffer=0x26d5d0*, nNumberOfBytesToWrite=0x10848, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26d5d0*, lpNumberOfBytesWritten=0x18fe58*=0x10848, lpOverlapped=0x0) returned 1 [0030.475] CloseHandle (hObject=0xc4) returned 1 [0030.476] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\PQjPiQ-k5UaAunXcyp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pqjpiq-k5uaaunxcyp.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.476] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x184dc [0030.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x184e4) returned 0x25cd78 [0030.476] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x184dc, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x184dc, lpOverlapped=0x0) returned 1 [0030.476] CloseHandle (hObject=0xc4) returned 1 [0030.476] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\PQjPiQ-k5UaAunXcyp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pqjpiq-k5uaaunxcyp.jpg")) returned 1 [0030.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.479] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.479] GetTickCount () returned 0x18564 [0030.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b528 [0030.479] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099684\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099684\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.485] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\PQjPiQ-k5UaAunXcyp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pqjpiq-k5uaaunxcyp.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099684\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099684\\....\\temporaryfile")) returned 0 [0030.485] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099684\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099684\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099684\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099684\\temporaryfile")) returned 1 [0030.486] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099684\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173b92c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173b92c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173b92c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b590 [0030.487] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173b92c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173b92c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173b92c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.487] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173b92c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173b92c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173b92c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.487] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099684\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173b92c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173b92c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173b92c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b528 [0030.487] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173b92c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173b92c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173b92c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.487] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173b92c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173b92c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173b92c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.487] FindClose (in: hFindFile=0x25b528 | out: hFindFile=0x25b528) returned 1 [0030.487] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099684\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099684\\temporaryfile")) returned 1 [0030.487] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173b92c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173b92c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173b92c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.487] FindClose (in: hFindFile=0x25b590 | out: hFindFile=0x25b590) returned 1 [0030.487] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099684" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099684")) returned 1 [0030.487] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\PQjPiQ-k5UaAunXcyp.jpg") returned 0 [0030.489] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\PQjPiQ-k5UaAunXcyp.jpg.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pqjpiq-k5uaaunxcyp.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.490] WriteFile (in: hFile=0xc4, lpBuffer=0x275270*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x275270*, lpNumberOfBytesWritten=0x18fe58*=0x184e0, lpOverlapped=0x0) returned 1 [0030.492] CloseHandle (hObject=0xc4) returned 1 [0030.494] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\QpTBIG9 owV873iL.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qptbig9 owv873il.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.494] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x5b6f [0030.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b77) returned 0x25cd78 [0030.494] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x5b6f, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x5b6f, lpOverlapped=0x0) returned 1 [0030.494] CloseHandle (hObject=0xc4) returned 1 [0030.494] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\QpTBIG9 owV873iL.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qptbig9 owv873il.wav")) returned 1 [0030.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.495] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.496] GetTickCount () returned 0x18574 [0030.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b528 [0030.496] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099700\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099700\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.497] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\QpTBIG9 owV873iL.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qptbig9 owv873il.wav"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099700\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099700\\....\\temporaryfile")) returned 0 [0030.497] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099700\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099700\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099700\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099700\\temporaryfile")) returned 1 [0030.498] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099700\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173df420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173df420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173df420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b590 [0030.498] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173df420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173df420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173df420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.498] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173df420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173df420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173df420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.498] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099700\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173df420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173df420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173df420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b528 [0030.498] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173df420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173df420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173df420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.498] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173df420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173df420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173df420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.498] FindClose (in: hFindFile=0x25b528 | out: hFindFile=0x25b528) returned 1 [0030.498] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099700\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099700\\temporaryfile")) returned 1 [0030.498] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x173df420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x173df420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x173df420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.498] FindClose (in: hFindFile=0x25b590 | out: hFindFile=0x25b590) returned 1 [0030.498] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099700" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099700")) returned 1 [0030.499] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\QpTBIG9 owV873iL.wav") returned 0 [0030.499] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\QpTBIG9 owV873iL.wav.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qptbig9 owv873il.wav.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.500] WriteFile (in: hFile=0xc4, lpBuffer=0x262900*, nNumberOfBytesToWrite=0x5b78, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x262900*, lpNumberOfBytesWritten=0x18fe58*=0x5b78, lpOverlapped=0x0) returned 1 [0030.502] CloseHandle (hObject=0xc4) returned 1 [0030.503] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\umeQAnzpGAKM.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\umeqanzpgakm.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.503] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xc11b [0030.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc123) returned 0x25cd78 [0030.503] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xc11b, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xc11b, lpOverlapped=0x0) returned 1 [0030.504] CloseHandle (hObject=0xc4) returned 1 [0030.504] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\umeQAnzpGAKM.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\umeqanzpgakm.wav")) returned 1 [0030.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.505] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.505] GetTickCount () returned 0x18583 [0030.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b528 [0030.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.506] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.506] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\umeQAnzpGAKM.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\umeqanzpgakm.wav"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715\\....\\temporaryfile")) returned 0 [0030.506] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715\\temporaryfile")) returned 1 [0030.507] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.507] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.507] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.507] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f0 [0030.507] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.507] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.507] FindClose (in: hFindFile=0x25c5f0 | out: hFindFile=0x25c5f0) returned 1 [0030.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715\\temporaryfile")) returned 1 [0030.508] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.508] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.508] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715")) returned 1 [0030.509] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\umeQAnzpGAKM.wav") returned 0 [0030.509] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\umeQAnzpGAKM.wav.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\umeqanzpgakm.wav.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.510] WriteFile (in: hFile=0xc4, lpBuffer=0x268eb0*, nNumberOfBytesToWrite=0xc120, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x268eb0*, lpNumberOfBytesWritten=0x18fe58*=0xc120, lpOverlapped=0x0) returned 1 [0030.512] CloseHandle (hObject=0xc4) returned 1 [0030.513] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\VVWQOJivCiw.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vvwqojivciw.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.513] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x7b8 [0030.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c0) returned 0x25b528 [0030.513] ReadFile (in: hFile=0xc4, lpBuffer=0x25b530, nNumberOfBytesToRead=0x7b8, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fe70*=0x7b8, lpOverlapped=0x0) returned 1 [0030.513] CloseHandle (hObject=0xc4) returned 1 [0030.513] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\VVWQOJivCiw.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vvwqojivciw.ots")) returned 1 [0030.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.515] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.515] GetTickCount () returned 0x18583 [0030.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25bcf0 [0030.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.516] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.516] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\VVWQOJivCiw.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vvwqojivciw.ots"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715\\....\\temporaryfile")) returned 0 [0030.516] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715\\temporaryfile")) returned 1 [0030.518] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1742b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1742b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.518] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1742b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1742b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.518] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.518] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25bdb0 [0030.518] FindNextFileA (in: hFindFile=0x25bdb0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.518] FindNextFileA (in: hFindFile=0x25bdb0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.518] FindClose (in: hFindFile=0x25bdb0 | out: hFindFile=0x25bdb0) returned 1 [0030.518] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715\\temporaryfile")) returned 1 [0030.518] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17405580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17405580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17405580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.518] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.518] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099715" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099715")) returned 1 [0030.518] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\VVWQOJivCiw.ots") returned 0 [0030.519] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\VVWQOJivCiw.ots.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vvwqojivciw.ots.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.520] WriteFile (in: hFile=0xc4, lpBuffer=0x25bcf8*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25bcf8*, lpNumberOfBytesWritten=0x18fe58*=0x7c0, lpOverlapped=0x0) returned 1 [0030.520] CloseHandle (hObject=0xc4) returned 1 [0030.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\w RjCfDLyWOGuuuBV9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w rjcfdlywoguuubv9.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.521] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x18b74 [0030.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18b7c) returned 0x25cd78 [0030.521] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x18b74, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x18b74, lpOverlapped=0x0) returned 1 [0030.522] CloseHandle (hObject=0xc4) returned 1 [0030.522] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\w RjCfDLyWOGuuuBV9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w rjcfdlywoguuubv9.wav")) returned 1 [0030.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.524] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.524] GetTickCount () returned 0x18593 [0030.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b528 [0030.525] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099731\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099731\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.525] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\w RjCfDLyWOGuuuBV9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w rjcfdlywoguuubv9.wav"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099731\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099731\\....\\temporaryfile")) returned 0 [0030.525] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099731\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099731\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099731\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099731\\temporaryfile")) returned 1 [0030.526] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099731\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1742b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1742b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1742b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b590 [0030.526] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1742b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1742b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1742b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.526] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1742b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1742b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1742b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.527] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099731\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1742b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1742b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1742b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b528 [0030.527] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1742b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1742b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1742b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.527] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1742b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1742b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1742b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.527] FindClose (in: hFindFile=0x25b528 | out: hFindFile=0x25b528) returned 1 [0030.527] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099731\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099731\\temporaryfile")) returned 1 [0030.527] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1742b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1742b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1742b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.527] FindClose (in: hFindFile=0x25b590 | out: hFindFile=0x25b590) returned 1 [0030.527] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099731" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099731")) returned 1 [0030.527] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\w RjCfDLyWOGuuuBV9.wav") returned 0 [0030.529] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\w RjCfDLyWOGuuuBV9.wav.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w rjcfdlywoguuubv9.wav.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.529] WriteFile (in: hFile=0xc4, lpBuffer=0x275908*, nNumberOfBytesToWrite=0x18b78, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x275908*, lpNumberOfBytesWritten=0x18fe58*=0x18b78, lpOverlapped=0x0) returned 1 [0030.532] CloseHandle (hObject=0xc4) returned 1 [0030.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\w_MGGU cdFd.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w_mggu cdfd.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.534] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x1465c [0030.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14664) returned 0x25cd78 [0030.534] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x1465c, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0x1465c, lpOverlapped=0x0) returned 1 [0030.534] CloseHandle (hObject=0xc4) returned 1 [0030.534] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\w_MGGU cdFd.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w_mggu cdfd.flv")) returned 1 [0030.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.536] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.536] GetTickCount () returned 0x185a3 [0030.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b528 [0030.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.537] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.537] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\w_MGGU cdFd.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w_mggu cdfd.flv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747\\....\\temporaryfile")) returned 0 [0030.537] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747\\temporaryfile")) returned 1 [0030.538] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.538] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.538] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.538] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f0 [0030.539] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.539] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.539] FindClose (in: hFindFile=0x25c5f0 | out: hFindFile=0x25c5f0) returned 1 [0030.539] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747\\temporaryfile")) returned 1 [0030.539] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.539] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.539] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747")) returned 1 [0030.539] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\w_MGGU cdFd.flv") returned 0 [0030.541] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\w_MGGU cdFd.flv.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w_mggu cdfd.flv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.541] WriteFile (in: hFile=0xc4, lpBuffer=0x2713f0*, nNumberOfBytesToWrite=0x14660, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x2713f0*, lpNumberOfBytesWritten=0x18fe58*=0x14660, lpOverlapped=0x0) returned 1 [0030.543] CloseHandle (hObject=0xc4) returned 1 [0030.544] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\YMN7La I9lBJZO.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ymn7la i9lbjzo.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.544] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xf0f5 [0030.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf0fd) returned 0x25cd78 [0030.545] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xf0f5, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xf0f5, lpOverlapped=0x0) returned 1 [0030.545] CloseHandle (hObject=0xc4) returned 1 [0030.545] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\YMN7La I9lBJZO.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ymn7la i9lbjzo.m4a")) returned 1 [0030.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.547] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259448 [0030.547] GetTickCount () returned 0x185a3 [0030.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259478 [0030.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b528 [0030.547] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.548] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\YMN7La I9lBJZO.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ymn7la i9lbjzo.m4a"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747\\....\\temporaryfile")) returned 0 [0030.548] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747\\temporaryfile")) returned 1 [0030.549] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174779a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174779a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b590 [0030.549] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174779a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174779a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.549] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.549] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b528 [0030.549] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.549] FindNextFileA (in: hFindFile=0x25b528, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b5ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.549] FindClose (in: hFindFile=0x25b528 | out: hFindFile=0x25b528) returned 1 [0030.549] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747\\temporaryfile")) returned 1 [0030.549] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17451840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17451840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17451840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.550] FindClose (in: hFindFile=0x25b590 | out: hFindFile=0x25b590) returned 1 [0030.550] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099747" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099747")) returned 1 [0030.550] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\YMN7La I9lBJZO.m4a") returned 0 [0030.551] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\YMN7La I9lBJZO.m4a.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ymn7la i9lbjzo.m4a.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.553] WriteFile (in: hFile=0xc4, lpBuffer=0x26be88*, nNumberOfBytesToWrite=0xf100, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26be88*, lpNumberOfBytesWritten=0x18fe58*=0xf100, lpOverlapped=0x0) returned 1 [0030.554] CloseHandle (hObject=0xc4) returned 1 [0030.556] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\YqrvAc.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yqrvac.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.556] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xdd76 [0030.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdd7e) returned 0x25cd78 [0030.556] ReadFile (in: hFile=0xc4, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xdd76, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe70*=0xdd76, lpOverlapped=0x0) returned 1 [0030.556] CloseHandle (hObject=0xc4) returned 1 [0030.556] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\YqrvAc.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yqrvac.rtf")) returned 1 [0030.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.558] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.558] GetTickCount () returned 0x185b2 [0030.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b528 [0030.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259488 [0030.559] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099762\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099762\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.559] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\YqrvAc.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yqrvac.rtf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099762\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099762\\....\\temporaryfile")) returned 0 [0030.559] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099762\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099762\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099762\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099762\\temporaryfile")) returned 1 [0030.560] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099762\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174779a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174779a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174779a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.560] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174779a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174779a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174779a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.560] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174779a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174779a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174779a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.560] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099762\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174779a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174779a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174779a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f0 [0030.561] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174779a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174779a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174779a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.561] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174779a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174779a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174779a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2594a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.561] FindClose (in: hFindFile=0x25c5f0 | out: hFindFile=0x25c5f0) returned 1 [0030.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099762\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099762\\temporaryfile")) returned 1 [0030.561] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174779a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174779a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174779a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.561] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099762" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099762")) returned 1 [0030.561] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\YqrvAc.rtf") returned 0 [0030.562] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\YqrvAc.rtf.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yqrvac.rtf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.563] WriteFile (in: hFile=0xc4, lpBuffer=0x26ab08*, nNumberOfBytesToWrite=0xdd80, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26ab08*, lpNumberOfBytesWritten=0x18fe58*=0xdd80, lpOverlapped=0x0) returned 1 [0030.564] CloseHandle (hObject=0xc4) returned 1 [0030.566] FindClose (in: hFindFile=0x2594e0 | out: hFindFile=0x2594e0) returned 1 [0030.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\*.*", lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x174779a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174779a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x2594e0 [0030.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0030.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa25e2180, ftCreationTime.dwHighDateTime=0x1d4d3e0, ftLastAccessTime.dwLowDateTime=0x24446940, ftLastAccessTime.dwHighDateTime=0x1d4d0dd, ftLastWriteTime.dwLowDateTime=0x24446940, ftLastWriteTime.dwHighDateTime=0x1d4d0dd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa25e2180, dwReserved1=0x1d4d3e0, cFileName=".", cAlternateFileName="")) returned 0x25b590 [0030.566] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa25e2180, ftCreationTime.dwHighDateTime=0x1d4d3e0, ftLastAccessTime.dwLowDateTime=0x24446940, ftLastAccessTime.dwHighDateTime=0x1d4d0dd, ftLastWriteTime.dwLowDateTime=0x24446940, ftLastWriteTime.dwHighDateTime=0x1d4d0dd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa25e2180, dwReserved1=0x1d4d3e0, cFileName="..", cAlternateFileName="")) returned 1 [0030.566] FindNextFileA (in: hFindFile=0x25b590, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cbf6140, ftCreationTime.dwHighDateTime=0x1d4cab8, ftLastAccessTime.dwLowDateTime=0x11eb5310, ftLastAccessTime.dwHighDateTime=0x1d4c76b, ftLastWriteTime.dwLowDateTime=0x11eb5310, ftLastWriteTime.dwHighDateTime=0x1d4c76b, nFileSizeHigh=0x0, nFileSizeLow=0x4e78, dwReserved0=0xa25e2180, dwReserved1=0x1d4d3e0, cFileName="DB4Pt MG-kRMN5PaImf6.png", cAlternateFileName="DB4PTM~1.PNG")) returned 1 [0030.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19) returned 0x255b80 [0030.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\DB4Pt MG-kRMN5PaImf6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\db4pt mg-krmn5paimf6.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.566] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x4e78 [0030.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4e80) returned 0x25cd78 [0030.566] ReadFile (in: hFile=0xd0, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x4e78, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x4e78, lpOverlapped=0x0) returned 1 [0030.567] CloseHandle (hObject=0xd0) returned 1 [0030.567] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\DB4Pt MG-kRMN5PaImf6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\db4pt mg-krmn5paimf6.png")) returned 1 [0030.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.569] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259480 [0030.569] GetTickCount () returned 0x185c2 [0030.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256150 [0030.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b528 [0030.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x259480 [0030.569] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.570] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\DB4Pt MG-kRMN5PaImf6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\db4pt mg-krmn5paimf6.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778\\....\\temporaryfile")) returned 0 [0030.570] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778\\temporaryfile")) returned 1 [0030.571] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0xd, cFileName=".", cAlternateFileName="")) returned 0x259480 [0030.571] FindNextFileA (in: hFindFile=0x259480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0xd, cFileName="..", cAlternateFileName="")) returned 1 [0030.571] FindNextFileA (in: hFindFile=0x259480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0xd, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.571] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25949c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c660 [0030.571] FindNextFileA (in: hFindFile=0x25c660, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25949c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.571] FindNextFileA (in: hFindFile=0x25c660, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25949c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.571] FindClose (in: hFindFile=0x25c660 | out: hFindFile=0x25c660) returned 1 [0030.571] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778\\temporaryfile")) returned 1 [0030.571] FindNextFileA (in: hFindFile=0x259480, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0xd, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.571] FindClose (in: hFindFile=0x259480 | out: hFindFile=0x259480) returned 1 [0030.571] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778")) returned 1 [0030.572] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\DB4Pt MG-kRMN5PaImf6.png") returned 0 [0030.572] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\DB4Pt MG-kRMN5PaImf6.png.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\db4pt mg-krmn5paimf6.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.573] WriteFile (in: hFile=0xd0, lpBuffer=0x261c08*, nNumberOfBytesToWrite=0x4e80, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x261c08*, lpNumberOfBytesWritten=0x18fe38*=0x4e80, lpOverlapped=0x0) returned 1 [0030.574] CloseHandle (hObject=0xd0) returned 1 [0030.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\okSd1.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\oksd1.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.575] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x889c [0030.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x88a4) returned 0x25cd78 [0030.575] ReadFile (in: hFile=0xd0, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x889c, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x889c, lpOverlapped=0x0) returned 1 [0030.576] CloseHandle (hObject=0xd0) returned 1 [0030.576] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\okSd1.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\oksd1.pptx")) returned 1 [0030.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.577] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b528 [0030.577] GetTickCount () returned 0x185c2 [0030.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b558 [0030.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5d8 [0030.578] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.578] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\okSd1.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\oksd1.pptx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778\\....\\temporaryfile")) returned 0 [0030.578] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778\\temporaryfile")) returned 1 [0030.580] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c640 [0030.580] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.580] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.580] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5d8 [0030.580] FindNextFileA (in: hFindFile=0x25c5d8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.580] FindNextFileA (in: hFindFile=0x25c5d8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.580] FindClose (in: hFindFile=0x25c5d8 | out: hFindFile=0x25c5d8) returned 1 [0030.580] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778\\temporaryfile")) returned 1 [0030.580] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1749db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1749db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1749db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.580] FindClose (in: hFindFile=0x25c640 | out: hFindFile=0x25c640) returned 1 [0030.580] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099778" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099778")) returned 1 [0030.581] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\okSd1.pptx") returned 0 [0030.581] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\okSd1.pptx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\oksd1.pptx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.582] WriteFile (in: hFile=0xd0, lpBuffer=0x265630*, nNumberOfBytesToWrite=0x88a0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x265630*, lpNumberOfBytesWritten=0x18fe38*=0x88a0, lpOverlapped=0x0) returned 1 [0030.583] CloseHandle (hObject=0xd0) returned 1 [0030.584] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\SS_0.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\ss_0.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.584] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x9f7a [0030.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9f82) returned 0x25cd78 [0030.584] ReadFile (in: hFile=0xd0, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x9f7a, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x9f7a, lpOverlapped=0x0) returned 1 [0030.585] CloseHandle (hObject=0xd0) returned 1 [0030.585] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\SS_0.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\ss_0.doc")) returned 1 [0030.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.586] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b528 [0030.586] GetTickCount () returned 0x185d1 [0030.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b558 [0030.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5d8 [0030.589] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099793\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099793\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.589] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\SS_0.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\ss_0.doc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099793\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099793\\....\\temporaryfile")) returned 0 [0030.589] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099793\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099793\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099793\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099793\\temporaryfile")) returned 1 [0030.590] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099793\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174c3c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174c3c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174c3c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c640 [0030.591] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174c3c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174c3c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174c3c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.591] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174c3c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174c3c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174c3c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.591] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099793\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174c3c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174c3c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174c3c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5d8 [0030.591] FindNextFileA (in: hFindFile=0x25c5d8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174c3c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174c3c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174c3c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.591] FindNextFileA (in: hFindFile=0x25c5d8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174c3c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174c3c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174c3c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.591] FindClose (in: hFindFile=0x25c5d8 | out: hFindFile=0x25c5d8) returned 1 [0030.591] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099793\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099793\\temporaryfile")) returned 1 [0030.591] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174c3c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174c3c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174c3c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.591] FindClose (in: hFindFile=0x25c640 | out: hFindFile=0x25c640) returned 1 [0030.591] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099793" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099793")) returned 1 [0030.591] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\SS_0.doc") returned 0 [0030.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\SS_0.doc.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\ss_0.doc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.593] WriteFile (in: hFile=0xd0, lpBuffer=0x266d10*, nNumberOfBytesToWrite=0x9f80, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x266d10*, lpNumberOfBytesWritten=0x18fe38*=0x9f80, lpOverlapped=0x0) returned 1 [0030.594] CloseHandle (hObject=0xd0) returned 1 [0030.596] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\WKgBkja.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\wkgbkja.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.596] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x15ffb [0030.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16003) returned 0x25cd78 [0030.596] ReadFile (in: hFile=0xd0, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x15ffb, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x15ffb, lpOverlapped=0x0) returned 1 [0030.597] CloseHandle (hObject=0xd0) returned 1 [0030.598] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\WKgBkja.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\wkgbkja.ods")) returned 1 [0030.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.599] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b528 [0030.599] GetTickCount () returned 0x185e1 [0030.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b558 [0030.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5d8 [0030.601] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099809\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099809\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.601] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\WKgBkja.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\wkgbkja.ods"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099809\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099809\\....\\temporaryfile")) returned 0 [0030.602] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099809\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099809\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099809\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099809\\temporaryfile")) returned 1 [0030.605] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099809\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174e9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174e9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174e9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c640 [0030.605] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174e9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174e9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174e9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.605] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174e9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174e9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174e9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.605] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099809\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174e9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174e9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174e9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5d8 [0030.605] FindNextFileA (in: hFindFile=0x25c5d8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174e9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174e9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174e9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.605] FindNextFileA (in: hFindFile=0x25c5d8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174e9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174e9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174e9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.605] FindClose (in: hFindFile=0x25c5d8 | out: hFindFile=0x25c5d8) returned 1 [0030.605] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099809\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099809\\temporaryfile")) returned 1 [0030.605] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x174e9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x174e9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x174e9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.605] FindClose (in: hFindFile=0x25c640 | out: hFindFile=0x25c640) returned 1 [0030.605] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099809" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099809")) returned 1 [0030.606] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\WKgBkja.ods") returned 0 [0030.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\WKgBkja.ods.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\wkgbkja.ods.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.608] WriteFile (in: hFile=0xd0, lpBuffer=0x272d90*, nNumberOfBytesToWrite=0x16000, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x272d90*, lpNumberOfBytesWritten=0x18fe38*=0x16000, lpOverlapped=0x0) returned 1 [0030.609] CloseHandle (hObject=0xd0) returned 1 [0030.611] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\xzSJ7.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\xzsj7.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.611] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x136c3 [0030.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x136cb) returned 0x25cd78 [0030.611] ReadFile (in: hFile=0xd0, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x136c3, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x136c3, lpOverlapped=0x0) returned 1 [0030.612] CloseHandle (hObject=0xd0) returned 1 [0030.612] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\xzSJ7.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\xzsj7.doc")) returned 1 [0030.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.614] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b528 [0030.614] GetTickCount () returned 0x185f1 [0030.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b558 [0030.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5d8 [0030.614] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.615] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\xzSJ7.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\xzsj7.doc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825\\....\\temporaryfile")) returned 0 [0030.615] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825\\temporaryfile")) returned 1 [0030.616] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c640 [0030.616] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.616] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.616] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5d8 [0030.616] FindNextFileA (in: hFindFile=0x25c5d8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.616] FindNextFileA (in: hFindFile=0x25c5d8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.616] FindClose (in: hFindFile=0x25c5d8 | out: hFindFile=0x25c5d8) returned 1 [0030.616] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825\\temporaryfile")) returned 1 [0030.616] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.616] FindClose (in: hFindFile=0x25c640 | out: hFindFile=0x25c640) returned 1 [0030.616] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825")) returned 1 [0030.617] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\xzSJ7.doc") returned 0 [0030.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\xzSJ7.doc.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\xzsj7.doc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.618] WriteFile (in: hFile=0xd0, lpBuffer=0x270458*, nNumberOfBytesToWrite=0x136c8, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x270458*, lpNumberOfBytesWritten=0x18fe38*=0x136c8, lpOverlapped=0x0) returned 1 [0030.620] CloseHandle (hObject=0xd0) returned 1 [0030.621] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\YuGi.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\yugi.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.621] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0xb970 [0030.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb978) returned 0x25cd78 [0030.622] ReadFile (in: hFile=0xd0, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xb970, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0xb970, lpOverlapped=0x0) returned 1 [0030.622] CloseHandle (hObject=0xd0) returned 1 [0030.623] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\YuGi.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\yugi.wav")) returned 1 [0030.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.624] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b528 [0030.624] GetTickCount () returned 0x185f1 [0030.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b558 [0030.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5d8 [0030.624] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.625] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\YuGi.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\yugi.wav"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825\\....\\temporaryfile")) returned 0 [0030.625] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825\\temporaryfile")) returned 1 [0030.626] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c640 [0030.626] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.626] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.626] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5d8 [0030.626] FindNextFileA (in: hFindFile=0x25c5d8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.626] FindNextFileA (in: hFindFile=0x25c5d8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c65c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.626] FindClose (in: hFindFile=0x25c5d8 | out: hFindFile=0x25c5d8) returned 1 [0030.626] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825\\temporaryfile")) returned 1 [0030.627] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1750ff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1750ff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1750ff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.627] FindClose (in: hFindFile=0x25c640 | out: hFindFile=0x25c640) returned 1 [0030.627] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099825" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099825")) returned 1 [0030.627] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\YuGi.wav") returned 0 [0030.628] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\YuGi.wav.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i4dq\\yugi.wav.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.628] WriteFile (in: hFile=0xd0, lpBuffer=0x268700*, nNumberOfBytesToWrite=0xb978, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x268700*, lpNumberOfBytesWritten=0x18fe38*=0xb978, lpOverlapped=0x0) returned 1 [0030.630] CloseHandle (hObject=0xd0) returned 1 [0030.631] FindClose (in: hFindFile=0x25b590 | out: hFindFile=0x25b590) returned 1 [0030.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\i4dQ\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa25e2180, ftCreationTime.dwHighDateTime=0x1d4d3e0, ftLastAccessTime.dwLowDateTime=0x17536080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17536080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25b590 [0030.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0030.631] FindClose (in: hFindFile=0x25b590 | out: hFindFile=0x25b590) returned 1 [0030.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f55b460, ftCreationTime.dwHighDateTime=0x1d4cbad, ftLastAccessTime.dwLowDateTime=0x8bcace40, ftLastAccessTime.dwHighDateTime=0x1d4d2d8, ftLastWriteTime.dwLowDateTime=0x8bcace40, ftLastWriteTime.dwHighDateTime=0x1d4d2d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f55b460, dwReserved1=0x1d4cbad, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.631] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f55b460, ftCreationTime.dwHighDateTime=0x1d4cbad, ftLastAccessTime.dwLowDateTime=0x8bcace40, ftLastAccessTime.dwHighDateTime=0x1d4d2d8, ftLastWriteTime.dwLowDateTime=0x8bcace40, ftLastWriteTime.dwHighDateTime=0x1d4d2d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f55b460, dwReserved1=0x1d4cbad, cFileName="..", cAlternateFileName="")) returned 1 [0030.631] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcb10490, ftCreationTime.dwHighDateTime=0x1d4ca02, ftLastAccessTime.dwLowDateTime=0xe53b6b30, ftLastAccessTime.dwHighDateTime=0x1d4d137, ftLastWriteTime.dwLowDateTime=0xe53b6b30, ftLastWriteTime.dwHighDateTime=0x1d4d137, nFileSizeHigh=0x0, nFileSizeLow=0x5c34, dwReserved0=0x5f55b460, dwReserved1=0x1d4cbad, cFileName="0R8VZmxctZ1GX1QI5rL.jpg", cAlternateFileName="0R8VZM~1.JPG")) returned 1 [0030.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x259070 [0030.631] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\0R8VZmxctZ1GX1QI5rL.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\0r8vzmxctz1gx1qi5rl.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.631] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x5c34 [0030.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5c3c) returned 0x25cd78 [0030.631] ReadFile (in: hFile=0xd0, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x5c34, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x5c34, lpOverlapped=0x0) returned 1 [0030.632] CloseHandle (hObject=0xd0) returned 1 [0030.632] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\0R8VZmxctZ1GX1QI5rL.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\0r8vzmxctz1gx1qi5rl.jpg")) returned 1 [0030.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.634] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25c588 [0030.634] GetTickCount () returned 0x18600 [0030.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5b8 [0030.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5f0 [0030.634] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099840\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099840\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.634] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\0R8VZmxctZ1GX1QI5rL.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\0r8vzmxctz1gx1qi5rl.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099840\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099840\\....\\temporaryfile")) returned 0 [0030.635] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099840\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099840\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099840\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099840\\temporaryfile")) returned 1 [0030.636] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099840\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17536080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17536080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17536080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd, cFileName=".", cAlternateFileName="")) returned 0x25c658 [0030.636] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17536080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17536080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17536080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd, cFileName="..", cAlternateFileName="")) returned 1 [0030.636] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17536080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17536080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17536080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.636] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099840\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17536080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17536080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17536080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f0 [0030.636] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17536080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17536080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17536080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.636] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17536080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17536080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17536080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.636] FindClose (in: hFindFile=0x25c5f0 | out: hFindFile=0x25c5f0) returned 1 [0030.636] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099840\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099840\\temporaryfile")) returned 1 [0030.636] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17536080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17536080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17536080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.636] FindClose (in: hFindFile=0x25c658 | out: hFindFile=0x25c658) returned 1 [0030.636] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099840" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099840")) returned 1 [0030.636] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\0R8VZmxctZ1GX1QI5rL.jpg") returned 0 [0030.637] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\0R8VZmxctZ1GX1QI5rL.jpg.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\0r8vzmxctz1gx1qi5rl.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.638] WriteFile (in: hFile=0xd0, lpBuffer=0x2629c8*, nNumberOfBytesToWrite=0x5c38, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x2629c8*, lpNumberOfBytesWritten=0x18fe38*=0x5c38, lpOverlapped=0x0) returned 1 [0030.639] CloseHandle (hObject=0xd0) returned 1 [0030.639] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\Q1gx-EumCFr8hNVa8.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\q1gx-eumcfr8hnva8.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.639] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x2389 [0030.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2391) returned 0x25cd78 [0030.639] ReadFile (in: hFile=0xd0, lpBuffer=0x25cd80, nNumberOfBytesToRead=0x2389, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0x2389, lpOverlapped=0x0) returned 1 [0030.640] CloseHandle (hObject=0xd0) returned 1 [0030.640] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\Q1gx-EumCFr8hNVa8.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\q1gx-eumcfr8hnva8.mp4")) returned 1 [0030.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.641] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25c588 [0030.641] GetTickCount () returned 0x18610 [0030.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5b8 [0030.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5f0 [0030.642] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.642] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\Q1gx-EumCFr8hNVa8.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\q1gx-eumcfr8hnva8.mp4"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856\\....\\temporaryfile")) returned 0 [0030.642] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856\\temporaryfile")) returned 1 [0030.643] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c658 [0030.643] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.643] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.643] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f0 [0030.644] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.644] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.644] FindClose (in: hFindFile=0x25c5f0 | out: hFindFile=0x25c5f0) returned 1 [0030.644] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856\\temporaryfile")) returned 1 [0030.644] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.644] FindClose (in: hFindFile=0x25c658 | out: hFindFile=0x25c658) returned 1 [0030.644] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856")) returned 1 [0030.644] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\Q1gx-EumCFr8hNVa8.mp4") returned 0 [0030.645] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\Q1gx-EumCFr8hNVa8.mp4.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\q1gx-eumcfr8hnva8.mp4.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.645] WriteFile (in: hFile=0xd0, lpBuffer=0x25f120*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x25f120*, lpNumberOfBytesWritten=0x18fe38*=0x2390, lpOverlapped=0x0) returned 1 [0030.646] CloseHandle (hObject=0xd0) returned 1 [0030.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\SBBTIRRJYRwtk_6hA.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\sbbtirrjyrwtk_6ha.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.647] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0xd9cb [0030.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd9d3) returned 0x25cd78 [0030.647] ReadFile (in: hFile=0xd0, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xd9cb, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0xd9cb, lpOverlapped=0x0) returned 1 [0030.648] CloseHandle (hObject=0xd0) returned 1 [0030.648] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\SBBTIRRJYRwtk_6hA.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\sbbtirrjyrwtk_6ha.swf")) returned 1 [0030.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.649] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25c588 [0030.649] GetTickCount () returned 0x18610 [0030.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5b8 [0030.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5f0 [0030.650] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.650] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\SBBTIRRJYRwtk_6hA.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\sbbtirrjyrwtk_6ha.swf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856\\....\\temporaryfile")) returned 0 [0030.650] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856\\temporaryfile")) returned 1 [0030.651] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c658 [0030.651] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.651] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.651] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f0 [0030.652] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.652] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.652] FindClose (in: hFindFile=0x25c5f0 | out: hFindFile=0x25c5f0) returned 1 [0030.652] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856\\temporaryfile")) returned 1 [0030.652] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1755c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1755c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1755c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.652] FindClose (in: hFindFile=0x25c658 | out: hFindFile=0x25c658) returned 1 [0030.652] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099856" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099856")) returned 1 [0030.652] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\SBBTIRRJYRwtk_6hA.swf") returned 0 [0030.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\SBBTIRRJYRwtk_6hA.swf.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\sbbtirrjyrwtk_6ha.swf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.654] WriteFile (in: hFile=0xd0, lpBuffer=0x26a760*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x26a760*, lpNumberOfBytesWritten=0x18fe38*=0xd9d0, lpOverlapped=0x0) returned 1 [0030.656] CloseHandle (hObject=0xd0) returned 1 [0030.657] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\T4nvE0-PZS_fB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\t4nve0-pzs_fb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.658] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0xfca5 [0030.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfcad) returned 0x25cd78 [0030.658] ReadFile (in: hFile=0xd0, lpBuffer=0x25cd80, nNumberOfBytesToRead=0xfca5, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25cd80*, lpNumberOfBytesRead=0x18fe50*=0xfca5, lpOverlapped=0x0) returned 1 [0030.659] CloseHandle (hObject=0xd0) returned 1 [0030.659] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\T4nvE0-PZS_fB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\t4nve0-pzs_fb.jpg")) returned 1 [0030.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.668] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25c588 [0030.668] GetTickCount () returned 0x1861f [0030.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5b8 [0030.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5f0 [0030.668] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099871\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099871\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.668] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\T4nvE0-PZS_fB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\t4nve0-pzs_fb.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099871\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099871\\....\\temporaryfile")) returned 0 [0030.669] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099871\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099871\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099871\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099871\\temporaryfile")) returned 1 [0030.670] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099871\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17582340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17582340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17582340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c658 [0030.670] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17582340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17582340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17582340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.670] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17582340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17582340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17582340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.670] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099871\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17582340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17582340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17582340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f0 [0030.670] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17582340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17582340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17582340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.670] FindNextFileA (in: hFindFile=0x25c5f0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17582340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17582340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17582340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c674, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.670] FindClose (in: hFindFile=0x25c5f0 | out: hFindFile=0x25c5f0) returned 1 [0030.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099871\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099871\\temporaryfile")) returned 1 [0030.670] FindNextFileA (in: hFindFile=0x25c658, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17582340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17582340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17582340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.670] FindClose (in: hFindFile=0x25c658 | out: hFindFile=0x25c658) returned 1 [0030.671] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099871" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099871")) returned 1 [0030.671] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\T4nvE0-PZS_fB.jpg") returned 0 [0030.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\T4nvE0-PZS_fB.jpg.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\t4nve0-pzs_fb.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.673] WriteFile (in: hFile=0xd0, lpBuffer=0x26ca38*, nNumberOfBytesToWrite=0xfcb0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x26ca38*, lpNumberOfBytesWritten=0x18fe38*=0xfcb0, lpOverlapped=0x0) returned 1 [0030.675] CloseHandle (hObject=0xd0) returned 1 [0030.676] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f55b460, ftCreationTime.dwHighDateTime=0x1d4cbad, ftLastAccessTime.dwLowDateTime=0x17582340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17582340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0030.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f88ba0, ftCreationTime.dwHighDateTime=0x1d4d4fc, ftLastAccessTime.dwLowDateTime=0x71362de0, ftLastAccessTime.dwHighDateTime=0x1d4c897, ftLastWriteTime.dwLowDateTime=0x71362de0, ftLastWriteTime.dwHighDateTime=0x1d4c897, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c530, dwReserved1=0x1d4d4fc, cFileName=".", cAlternateFileName="")) returned 0x25c688 [0030.676] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f88ba0, ftCreationTime.dwHighDateTime=0x1d4d4fc, ftLastAccessTime.dwLowDateTime=0x71362de0, ftLastAccessTime.dwHighDateTime=0x1d4c897, ftLastWriteTime.dwLowDateTime=0x71362de0, ftLastWriteTime.dwHighDateTime=0x1d4c897, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c530, dwReserved1=0x1d4d4fc, cFileName="..", cAlternateFileName="")) returned 1 [0030.676] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc299db20, ftCreationTime.dwHighDateTime=0x1d4d3a3, ftLastAccessTime.dwLowDateTime=0x55b28a0, ftLastAccessTime.dwHighDateTime=0x1d4cc2a, ftLastWriteTime.dwLowDateTime=0x55b28a0, ftLastWriteTime.dwHighDateTime=0x1d4cc2a, nFileSizeHigh=0x0, nFileSizeLow=0x4799, dwReserved0=0x25c530, dwReserved1=0x1d4d4fc, cFileName="siXuQ8hvAO01ox4.csv", cAlternateFileName="SIXUQ8~1.CSV")) returned 1 [0030.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x25cdb0 [0030.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\siXuQ8hvAO01ox4.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\eshhi8tkusth9xs1d\\sixuq8hvao01ox4.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0030.677] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x4799 [0030.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x47a1) returned 0x25e580 [0030.677] ReadFile (in: hFile=0xd4, lpBuffer=0x25e588, nNumberOfBytesToRead=0x4799, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x25e588*, lpNumberOfBytesRead=0x18fe30*=0x4799, lpOverlapped=0x0) returned 1 [0030.677] CloseHandle (hObject=0xd4) returned 1 [0030.677] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\siXuQ8hvAO01ox4.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\eshhi8tkusth9xs1d\\sixuq8hvao01ox4.csv")) returned 1 [0030.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256150 [0030.679] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25c5f0 [0030.679] GetTickCount () returned 0x1862f [0030.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c620 [0030.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6c8 [0030.679] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887\\...."), lpSecurityAttributes=0x256150) returned 1 [0030.680] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\siXuQ8hvAO01ox4.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\eshhi8tkusth9xs1d\\sixuq8hvao01ox4.csv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887\\....\\temporaryfile")) returned 0 [0030.680] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887\\temporaryfile")) returned 1 [0030.681] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x25c730 [0030.681] FindNextFileA (in: hFindFile=0x25c730, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0030.681] FindNextFileA (in: hFindFile=0x25c730, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.681] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c74c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6c8 [0030.681] FindNextFileA (in: hFindFile=0x25c6c8, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c74c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.681] FindNextFileA (in: hFindFile=0x25c6c8, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c74c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.681] FindClose (in: hFindFile=0x25c6c8 | out: hFindFile=0x25c6c8) returned 1 [0030.681] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887\\temporaryfile")) returned 1 [0030.682] FindNextFileA (in: hFindFile=0x25c730, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.682] FindClose (in: hFindFile=0x25c730 | out: hFindFile=0x25c730) returned 1 [0030.682] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887")) returned 1 [0030.682] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\siXuQ8hvAO01ox4.csv") returned 0 [0030.682] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\siXuQ8hvAO01ox4.csv.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\eshhi8tkusth9xs1d\\sixuq8hvao01ox4.csv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0030.683] WriteFile (in: hFile=0xd4, lpBuffer=0x262d38*, nNumberOfBytesToWrite=0x47a0, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x262d38*, lpNumberOfBytesWritten=0x18fe18*=0x47a0, lpOverlapped=0x0) returned 1 [0030.684] CloseHandle (hObject=0xd4) returned 1 [0030.685] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\TDPtbCn5uV9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\eshhi8tkusth9xs1d\\tdptbcn5uv9.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0030.685] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x989 [0030.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x991) returned 0x25e580 [0030.685] ReadFile (in: hFile=0xd4, lpBuffer=0x25e588, nNumberOfBytesToRead=0x989, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x25e588*, lpNumberOfBytesRead=0x18fe30*=0x989, lpOverlapped=0x0) returned 1 [0030.685] CloseHandle (hObject=0xd4) returned 1 [0030.685] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\TDPtbCn5uV9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\eshhi8tkusth9xs1d\\tdptbcn5uv9.png")) returned 1 [0030.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.687] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25c5f0 [0030.687] GetTickCount () returned 0x1862f [0030.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c620 [0030.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6c8 [0030.687] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.688] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\TDPtbCn5uV9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\eshhi8tkusth9xs1d\\tdptbcn5uv9.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887\\....\\temporaryfile")) returned 0 [0030.688] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887\\temporaryfile")) returned 1 [0030.689] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175ce600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175ce600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c730 [0030.689] FindNextFileA (in: hFindFile=0x25c730, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175ce600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175ce600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.689] FindNextFileA (in: hFindFile=0x25c730, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.690] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c74c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6c8 [0030.690] FindNextFileA (in: hFindFile=0x25c6c8, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c74c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.690] FindNextFileA (in: hFindFile=0x25c6c8, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c74c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.690] FindClose (in: hFindFile=0x25c6c8 | out: hFindFile=0x25c6c8) returned 1 [0030.690] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887\\temporaryfile")) returned 1 [0030.690] FindNextFileA (in: hFindFile=0x25c730, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175a84a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175a84a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175a84a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.690] FindClose (in: hFindFile=0x25c730 | out: hFindFile=0x25c730) returned 1 [0030.690] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099887" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099887")) returned 1 [0030.690] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\TDPtbCn5uV9.png") returned 0 [0030.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\TDPtbCn5uV9.png.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\eshhi8tkusth9xs1d\\tdptbcn5uv9.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0030.691] WriteFile (in: hFile=0xd4, lpBuffer=0x25ef28*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x25ef28*, lpNumberOfBytesWritten=0x18fe18*=0x990, lpOverlapped=0x0) returned 1 [0030.692] CloseHandle (hObject=0xd4) returned 1 [0030.692] FindClose (in: hFindFile=0x25c688 | out: hFindFile=0x25c688) returned 1 [0030.692] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\ESHHI8tKuSTh9Xs1d\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f88ba0, ftCreationTime.dwHighDateTime=0x1d4d4fc, ftLastAccessTime.dwLowDateTime=0x175ce600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175ce600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c688 [0030.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0030.693] FindClose (in: hFindFile=0x25c688 | out: hFindFile=0x25c688) returned 1 [0030.693] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd87f0cd0, ftCreationTime.dwHighDateTime=0x1d4d0b5, ftLastAccessTime.dwLowDateTime=0x7fb0eac0, ftLastAccessTime.dwHighDateTime=0x1d4c9ed, ftLastWriteTime.dwLowDateTime=0x7fb0eac0, ftLastWriteTime.dwHighDateTime=0x1d4c9ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd87f0cd0, dwReserved1=0x1d4d0b5, cFileName=".", cAlternateFileName="")) returned 0x25c5c8 [0030.693] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd87f0cd0, ftCreationTime.dwHighDateTime=0x1d4d0b5, ftLastAccessTime.dwLowDateTime=0x7fb0eac0, ftLastAccessTime.dwHighDateTime=0x1d4c9ed, ftLastWriteTime.dwLowDateTime=0x7fb0eac0, ftLastWriteTime.dwHighDateTime=0x1d4c9ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd87f0cd0, dwReserved1=0x1d4d0b5, cFileName="..", cAlternateFileName="")) returned 1 [0030.693] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15bd0a0, ftCreationTime.dwHighDateTime=0x1d4d059, ftLastAccessTime.dwLowDateTime=0x76271240, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x76271240, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0xd465, dwReserved0=0xd87f0cd0, dwReserved1=0x1d4d0b5, cFileName="C 8INbgLqg8.mkv", cAlternateFileName="C8INBG~1.MKV")) returned 1 [0030.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561b0 [0030.693] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\C 8INbgLqg8.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\h938whtrhk\\c 8inbglqg8.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0030.693] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xd465 [0030.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd46d) returned 0x25e580 [0030.693] ReadFile (in: hFile=0xd4, lpBuffer=0x25e588, nNumberOfBytesToRead=0xd465, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x25e588*, lpNumberOfBytesRead=0x18fe30*=0xd465, lpOverlapped=0x0) returned 1 [0030.694] CloseHandle (hObject=0xd4) returned 1 [0030.694] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\C 8INbgLqg8.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\h938whtrhk\\c 8inbglqg8.mkv")) returned 1 [0030.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0030.696] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25c590 [0030.696] GetTickCount () returned 0x1863f [0030.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0030.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c608 [0030.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c640 [0030.696] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099903\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099903\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0030.697] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\C 8INbgLqg8.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\h938whtrhk\\c 8inbglqg8.mkv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099903\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099903\\....\\temporaryfile")) returned 0 [0030.697] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099903\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099903\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099903\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099903\\temporaryfile")) returned 1 [0030.698] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099903\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175ce600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175ce600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175ce600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13, cFileName=".", cAlternateFileName="")) returned 0x25c6a8 [0030.698] FindNextFileA (in: hFindFile=0x25c6a8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175ce600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175ce600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175ce600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13, cFileName="..", cAlternateFileName="")) returned 1 [0030.698] FindNextFileA (in: hFindFile=0x25c6a8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175ce600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175ce600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175ce600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.698] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099903\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175ce600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175ce600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175ce600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6c4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c640 [0030.698] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175ce600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175ce600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175ce600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6c4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.698] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175ce600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175ce600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175ce600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6c4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.698] FindClose (in: hFindFile=0x25c640 | out: hFindFile=0x25c640) returned 1 [0030.698] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099903\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099903\\temporaryfile")) returned 1 [0030.699] FindNextFileA (in: hFindFile=0x25c6a8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175ce600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175ce600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175ce600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x13, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.699] FindClose (in: hFindFile=0x25c6a8 | out: hFindFile=0x25c6a8) returned 1 [0030.699] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099903" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099903")) returned 1 [0030.699] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\C 8INbgLqg8.mkv") returned 0 [0030.700] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\C 8INbgLqg8.mkv.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\h938whtrhk\\c 8inbglqg8.mkv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0030.700] WriteFile (in: hFile=0xd4, lpBuffer=0x26ba00*, nNumberOfBytesToWrite=0xd470, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x26ba00*, lpNumberOfBytesWritten=0x18fe18*=0xd470, lpOverlapped=0x0) returned 1 [0030.702] CloseHandle (hObject=0xd4) returned 1 [0030.703] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\jq8VxXCnWlEayHpw6D.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\h938whtrhk\\jq8vxxcnwleayhpw6d.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0030.703] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x13042 [0030.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1304a) returned 0x25e580 [0030.703] ReadFile (in: hFile=0xd4, lpBuffer=0x25e588, nNumberOfBytesToRead=0x13042, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x25e588*, lpNumberOfBytesRead=0x18fe30*=0x13042, lpOverlapped=0x0) returned 1 [0030.706] CloseHandle (hObject=0xd4) returned 1 [0030.706] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\jq8VxXCnWlEayHpw6D.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\h938whtrhk\\jq8vxxcnwleayhpw6d.avi")) returned 1 [0030.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.707] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25c598 [0030.707] GetTickCount () returned 0x1864e [0030.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c608 [0030.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c640 [0030.708] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.708] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\jq8VxXCnWlEayHpw6D.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\h938whtrhk\\jq8vxxcnwleayhpw6d.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918\\....\\temporaryfile")) returned 0 [0030.708] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918\\temporaryfile")) returned 1 [0030.709] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175f4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175f4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175f4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6a8 [0030.709] FindNextFileA (in: hFindFile=0x25c6a8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175f4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175f4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175f4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.709] FindNextFileA (in: hFindFile=0x25c6a8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175f4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175f4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175f4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.709] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175f4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175f4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175f4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6c4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c640 [0030.709] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175f4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175f4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175f4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6c4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.709] FindNextFileA (in: hFindFile=0x25c640, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175f4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175f4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175f4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6c4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.710] FindClose (in: hFindFile=0x25c640 | out: hFindFile=0x25c640) returned 1 [0030.710] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918\\temporaryfile")) returned 1 [0030.710] FindNextFileA (in: hFindFile=0x25c6a8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175f4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x175f4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175f4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.710] FindClose (in: hFindFile=0x25c6a8 | out: hFindFile=0x25c6a8) returned 1 [0030.710] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918")) returned 1 [0030.710] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\jq8VxXCnWlEayHpw6D.avi") returned 0 [0030.711] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\jq8VxXCnWlEayHpw6D.avi.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\opn7b_ostedzg-z\\h938whtrhk\\jq8vxxcnwleayhpw6d.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0030.712] WriteFile (in: hFile=0xd4, lpBuffer=0x2715e0*, nNumberOfBytesToWrite=0x13048, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2715e0*, lpNumberOfBytesWritten=0x18fe18*=0x13048, lpOverlapped=0x0) returned 1 [0030.714] CloseHandle (hObject=0xd4) returned 1 [0030.715] FindClose (in: hFindFile=0x25c5c8 | out: hFindFile=0x25c5c8) returned 1 [0030.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\OPn7B_oStEDZG-Z\\H938whtrhk\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd87f0cd0, ftCreationTime.dwHighDateTime=0x1d4d0b5, ftLastAccessTime.dwLowDateTime=0x175f4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x175f4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c5c8 [0030.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0030.715] FindClose (in: hFindFile=0x25c5c8 | out: hFindFile=0x25c5c8) returned 1 [0030.715] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6a4eb0, ftCreationTime.dwHighDateTime=0x1d4c9a0, ftLastAccessTime.dwLowDateTime=0xad1ebb50, ftLastAccessTime.dwHighDateTime=0x1d4d0fe, ftLastWriteTime.dwLowDateTime=0xad1ebb50, ftLastWriteTime.dwHighDateTime=0x1d4d0fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c6a4eb0, dwReserved1=0x1d4c9a0, cFileName=".", cAlternateFileName="")) returned 0x25b5a0 [0030.715] FindNextFileA (in: hFindFile=0x25b5a0, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6a4eb0, ftCreationTime.dwHighDateTime=0x1d4c9a0, ftLastAccessTime.dwLowDateTime=0xad1ebb50, ftLastAccessTime.dwHighDateTime=0x1d4d0fe, ftLastWriteTime.dwLowDateTime=0xad1ebb50, ftLastWriteTime.dwHighDateTime=0x1d4d0fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c6a4eb0, dwReserved1=0x1d4c9a0, cFileName="..", cAlternateFileName="")) returned 1 [0030.715] FindNextFileA (in: hFindFile=0x25b5a0, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd16bd0, ftCreationTime.dwHighDateTime=0x1d4ca2e, ftLastAccessTime.dwLowDateTime=0xf7365620, ftLastAccessTime.dwHighDateTime=0x1d4cfc4, ftLastWriteTime.dwLowDateTime=0xf7365620, ftLastWriteTime.dwHighDateTime=0x1d4cfc4, nFileSizeHigh=0x0, nFileSizeLow=0x6df4, dwReserved0=0x9c6a4eb0, dwReserved1=0x1d4c9a0, cFileName="KcjGX0 W5p_j5 Xn.m4a", cAlternateFileName="KCJGX0~1.M4A")) returned 1 [0030.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15) returned 0x25cd90 [0030.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\KcjGX0 W5p_j5 Xn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\kcjgx0 w5p_j5 xn.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.715] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x6df4 [0030.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6dfc) returned 0x25d578 [0030.716] ReadFile (in: hFile=0xd0, lpBuffer=0x25d580, nNumberOfBytesToRead=0x6df4, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe50*=0x6df4, lpOverlapped=0x0) returned 1 [0030.716] CloseHandle (hObject=0xd0) returned 1 [0030.716] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\KcjGX0 W5p_j5 Xn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\kcjgx0 w5p_j5 xn.m4a")) returned 1 [0030.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.718] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.718] GetTickCount () returned 0x1864e [0030.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b528 [0030.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b560 [0030.721] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.721] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\KcjGX0 W5p_j5 Xn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\kcjgx0 w5p_j5 xn.m4a"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918\\....\\temporaryfile")) returned 0 [0030.721] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918\\temporaryfile")) returned 1 [0030.722] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175f4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName=".", cAlternateFileName="")) returned 0x25b560 [0030.723] FindNextFileA (in: hFindFile=0x25b560, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x175f4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName="..", cAlternateFileName="")) returned 1 [0030.723] FindNextFileA (in: hFindFile=0x25b560, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.723] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b57c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.723] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b57c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.723] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b57c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.723] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918\\temporaryfile")) returned 1 [0030.723] FindNextFileA (in: hFindFile=0x25b560, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.723] FindClose (in: hFindFile=0x25b560 | out: hFindFile=0x25b560) returned 1 [0030.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099918" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099918")) returned 1 [0030.723] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\KcjGX0 W5p_j5 Xn.m4a") returned 0 [0030.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\KcjGX0 W5p_j5 Xn.m4a.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\kcjgx0 w5p_j5 xn.m4a.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.725] WriteFile (in: hFile=0xd0, lpBuffer=0x264388*, nNumberOfBytesToWrite=0x6df8, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x264388*, lpNumberOfBytesWritten=0x18fe38*=0x6df8, lpOverlapped=0x0) returned 1 [0030.726] CloseHandle (hObject=0xd0) returned 1 [0030.727] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\kFSjmyF-KmWxxu h.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\kfsjmyf-kmwxxu h.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.727] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x1021b [0030.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10223) returned 0x25d578 [0030.727] ReadFile (in: hFile=0xd0, lpBuffer=0x25d580, nNumberOfBytesToRead=0x1021b, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe50*=0x1021b, lpOverlapped=0x0) returned 1 [0030.728] CloseHandle (hObject=0xd0) returned 1 [0030.728] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\kFSjmyF-KmWxxu h.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\kfsjmyf-kmwxxu h.swf")) returned 1 [0030.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.729] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.729] GetTickCount () returned 0x1865e [0030.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b528 [0030.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b560 [0030.730] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099934\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.730] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\kFSjmyF-KmWxxu h.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\kfsjmyf-kmwxxu h.swf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099934\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099934\\....\\temporaryfile")) returned 0 [0030.730] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099934\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099934\\temporaryfile")) returned 1 [0030.731] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099934\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b560 [0030.731] FindNextFileA (in: hFindFile=0x25b560, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.731] FindNextFileA (in: hFindFile=0x25b560, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.732] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099934\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b57c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.732] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b57c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.732] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b57c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.732] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.732] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099934\\temporaryfile")) returned 1 [0030.732] FindNextFileA (in: hFindFile=0x25b560, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1761a8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1761a8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1761a8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.732] FindClose (in: hFindFile=0x25b560 | out: hFindFile=0x25b560) returned 1 [0030.732] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099934" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099934")) returned 1 [0030.732] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\kFSjmyF-KmWxxu h.swf") returned 0 [0030.733] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\kFSjmyF-KmWxxu h.swf.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\kfsjmyf-kmwxxu h.swf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.734] WriteFile (in: hFile=0xd0, lpBuffer=0x26d7b0*, nNumberOfBytesToWrite=0x10220, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x26d7b0*, lpNumberOfBytesWritten=0x18fe38*=0x10220, lpOverlapped=0x0) returned 1 [0030.736] CloseHandle (hObject=0xd0) returned 1 [0030.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\oP55.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\op55.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.737] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0xcb88 [0030.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcb90) returned 0x25d578 [0030.737] ReadFile (in: hFile=0xd0, lpBuffer=0x25d580, nNumberOfBytesToRead=0xcb88, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe50*=0xcb88, lpOverlapped=0x0) returned 1 [0030.738] CloseHandle (hObject=0xd0) returned 1 [0030.738] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\oP55.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\op55.swf")) returned 1 [0030.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.739] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259488 [0030.739] GetTickCount () returned 0x1866d [0030.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b528 [0030.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25b560 [0030.740] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.740] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\oP55.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\op55.swf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949\\....\\temporaryfile")) returned 0 [0030.740] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949\\temporaryfile")) returned 1 [0030.741] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25b560 [0030.741] FindNextFileA (in: hFindFile=0x25b560, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.741] FindNextFileA (in: hFindFile=0x25b560, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.741] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b57c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x259488 [0030.742] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b57c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.742] FindNextFileA (in: hFindFile=0x259488, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25b57c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.742] FindClose (in: hFindFile=0x259488 | out: hFindFile=0x259488) returned 1 [0030.742] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949\\temporaryfile")) returned 1 [0030.742] FindNextFileA (in: hFindFile=0x25b560, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.742] FindClose (in: hFindFile=0x25b560 | out: hFindFile=0x25b560) returned 1 [0030.742] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949")) returned 1 [0030.742] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\oP55.swf") returned 0 [0030.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\oP55.swf.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\op55.swf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.744] WriteFile (in: hFile=0xd0, lpBuffer=0x26a118*, nNumberOfBytesToWrite=0xcb90, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x26a118*, lpNumberOfBytesWritten=0x18fe38*=0xcb90, lpOverlapped=0x0) returned 1 [0030.745] CloseHandle (hObject=0xd0) returned 1 [0030.746] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\POP8pfc9QmIhWOQhe.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\pop8pfc9qmihwoqhe.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.746] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x143c6 [0030.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x143ce) returned 0x25d578 [0030.746] ReadFile (in: hFile=0xd0, lpBuffer=0x25d580, nNumberOfBytesToRead=0x143c6, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe50*=0x143c6, lpOverlapped=0x0) returned 1 [0030.748] CloseHandle (hObject=0xd0) returned 1 [0030.748] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\POP8pfc9QmIhWOQhe.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\pop8pfc9qmihwoqhe.avi")) returned 1 [0030.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.749] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x25b528 [0030.749] GetTickCount () returned 0x1866d [0030.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25b558 [0030.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5e8 [0030.750] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.750] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\POP8pfc9QmIhWOQhe.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\pop8pfc9qmihwoqhe.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949\\....\\temporaryfile")) returned 0 [0030.750] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949\\temporaryfile")) returned 1 [0030.751] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c650 [0030.751] FindNextFileA (in: hFindFile=0x25c650, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.751] FindNextFileA (in: hFindFile=0x25c650, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.751] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c66c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5e8 [0030.752] FindNextFileA (in: hFindFile=0x25c5e8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c66c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.752] FindNextFileA (in: hFindFile=0x25c5e8, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c66c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.752] FindClose (in: hFindFile=0x25c5e8 | out: hFindFile=0x25c5e8) returned 1 [0030.752] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949\\temporaryfile")) returned 1 [0030.752] FindNextFileA (in: hFindFile=0x25c650, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17640a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17640a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17640a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.752] FindClose (in: hFindFile=0x25c650 | out: hFindFile=0x25c650) returned 1 [0030.752] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099949" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099949")) returned 1 [0030.754] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\POP8pfc9QmIhWOQhe.avi") returned 0 [0030.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\POP8pfc9QmIhWOQhe.avi.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pxbnvbukulg\\pop8pfc9qmihwoqhe.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0030.757] WriteFile (in: hFile=0xd0, lpBuffer=0x271958*, nNumberOfBytesToWrite=0x143d0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x271958*, lpNumberOfBytesWritten=0x18fe38*=0x143d0, lpOverlapped=0x0) returned 1 [0030.768] CloseHandle (hObject=0xd0) returned 1 [0030.769] FindClose (in: hFindFile=0x25b5a0 | out: hFindFile=0x25b5a0) returned 1 [0030.770] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\\\pXbnvbUkulG\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c6a4eb0, ftCreationTime.dwHighDateTime=0x1d4c9a0, ftLastAccessTime.dwLowDateTime=0x17666b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17666b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25b5a0 [0030.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0030.770] FindClose (in: hFindFile=0x25b5a0 | out: hFindFile=0x25b5a0) returned 1 [0030.770] FindClose (in: hFindFile=0x2594e0 | out: hFindFile=0x2594e0) returned 1 [0030.770] SHGetSpecialFolderPathA (in: hwnd=0x0, pszPath=0x18fd80, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0030.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2f) returned 0x2594b0 [0030.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x33) returned 0x259580 [0030.771] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\*.*", lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b8e90, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa8b8e90, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x18fb3c, cFileName=".", cAlternateFileName="")) returned 0x259630 [0030.771] FindNextFileA (in: hFindFile=0x259630, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b8e90, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa8b8e90, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c, dwReserved1=0x18fb3c, cFileName="..", cAlternateFileName="")) returned 1 [0030.771] FindNextFileA (in: hFindFile=0x259630, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97835750, ftCreationTime.dwHighDateTime=0x1d4c7cc, ftLastAccessTime.dwLowDateTime=0xbef5d460, ftLastAccessTime.dwHighDateTime=0x1d4d3da, ftLastWriteTime.dwLowDateTime=0xbef5d460, ftLastWriteTime.dwHighDateTime=0x1d4d3da, nFileSizeHigh=0x0, nFileSizeLow=0x43cf, dwReserved0=0x1c, dwReserved1=0x18fb3c, cFileName="-IJUXNcRg2PG0aCimvIX.m4a", cAlternateFileName="-IJUXN~1.M4A")) returned 1 [0030.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19) returned 0x255ba8 [0030.772] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\-IJUXNcRg2PG0aCimvIX.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-ijuxncrg2pg0acimvix.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.772] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x43cf [0030.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x43d7) returned 0x25d578 [0030.772] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x43cf, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x43cf, lpOverlapped=0x0) returned 1 [0030.772] CloseHandle (hObject=0xc4) returned 1 [0030.773] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\-IJUXNcRg2PG0aCimvIX.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-ijuxncrg2pg0acimvix.m4a")) returned 1 [0030.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.774] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.774] GetTickCount () returned 0x1868d [0030.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.774] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.774] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\-IJUXNcRg2PG0aCimvIX.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-ijuxncrg2pg0acimvix.m4a"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981\\....\\temporaryfile")) returned 0 [0030.774] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981\\temporaryfile")) returned 1 [0030.776] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1768cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1768cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1768cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0xe, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.776] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1768cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1768cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1768cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0xe, cFileName="..", cAlternateFileName="")) returned 1 [0030.776] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1768cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1768cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1768cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0xe, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.776] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1768cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1768cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1768cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.776] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1768cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1768cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1768cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.776] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1768cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1768cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1768cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.776] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.776] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981\\temporaryfile")) returned 1 [0030.776] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1768cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1768cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1768cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240000, dwReserved1=0xe, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.776] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.776] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981")) returned 1 [0030.776] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\-IJUXNcRg2PG0aCimvIX.m4a") returned 0 [0030.777] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\-IJUXNcRg2PG0aCimvIX.m4a.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-ijuxncrg2pg0acimvix.m4a.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.777] WriteFile (in: hFile=0xc4, lpBuffer=0x261960*, nNumberOfBytesToWrite=0x43d8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x261960*, lpNumberOfBytesWritten=0x18fe58*=0x43d8, lpOverlapped=0x0) returned 1 [0030.778] CloseHandle (hObject=0xc4) returned 1 [0030.779] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\197VZVbvdT s2CUJs.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\197vzvbvdt s2cujs.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.779] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xae57 [0030.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xae5f) returned 0x25d578 [0030.779] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0xae57, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0xae57, lpOverlapped=0x0) returned 1 [0030.780] CloseHandle (hObject=0xc4) returned 1 [0030.780] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\197VZVbvdT s2CUJs.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\197vzvbvdt s2cujs.mp3")) returned 1 [0030.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.781] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.781] GetTickCount () returned 0x1868d [0030.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.784] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.785] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\197VZVbvdT s2CUJs.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\197vzvbvdt s2cujs.mp3"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981\\....\\temporaryfile")) returned 0 [0030.785] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981\\temporaryfile")) returned 1 [0030.786] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1768cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.786] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1768cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.786] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.786] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.786] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.786] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.786] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.786] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981\\temporaryfile")) returned 1 [0030.786] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.786] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.787] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099981" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099981")) returned 1 [0030.787] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\197VZVbvdT s2CUJs.mp3") returned 0 [0030.788] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\197VZVbvdT s2CUJs.mp3.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\197vzvbvdt s2cujs.mp3.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.788] WriteFile (in: hFile=0xc4, lpBuffer=0x2683e8*, nNumberOfBytesToWrite=0xae60, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x2683e8*, lpNumberOfBytesWritten=0x18fe58*=0xae60, lpOverlapped=0x0) returned 1 [0030.789] CloseHandle (hObject=0xc4) returned 1 [0030.790] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\5-OIo.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5-oio.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.790] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x13b12 [0030.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13b1a) returned 0x25d578 [0030.790] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x13b12, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x13b12, lpOverlapped=0x0) returned 1 [0030.791] CloseHandle (hObject=0xc4) returned 1 [0030.792] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\5-OIo.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5-oio.csv")) returned 1 [0030.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.795] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.795] GetTickCount () returned 0x1869c [0030.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.795] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099996\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099996\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.796] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\5-OIo.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5-oio.csv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099996\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099996\\....\\temporaryfile")) returned 0 [0030.796] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099996\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099996\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099996\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099996\\temporaryfile")) returned 1 [0030.797] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099996\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.797] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.797] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.797] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099996\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.798] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.798] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.798] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099996\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099996\\temporaryfile")) returned 1 [0030.798] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176b2e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176b2e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176b2e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.798] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18099996" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18099996")) returned 1 [0030.798] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\5-OIo.csv") returned 0 [0030.800] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\5-OIo.csv.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5-oio.csv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.800] WriteFile (in: hFile=0xc4, lpBuffer=0x2710a8*, nNumberOfBytesToWrite=0x13b18, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x2710a8*, lpNumberOfBytesWritten=0x18fe58*=0x13b18, lpOverlapped=0x0) returned 1 [0030.802] CloseHandle (hObject=0xc4) returned 1 [0030.803] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\7fgzkGfed5cplNOCn.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7fgzkgfed5cplnocn.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.803] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x3e4f [0030.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3e57) returned 0x25d578 [0030.803] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x3e4f, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x3e4f, lpOverlapped=0x0) returned 1 [0030.804] CloseHandle (hObject=0xc4) returned 1 [0030.804] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\7fgzkGfed5cplNOCn.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7fgzkgfed5cplnocn.gif")) returned 1 [0030.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.805] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.805] GetTickCount () returned 0x186ac [0030.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.806] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100012\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100012\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.806] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\7fgzkGfed5cplNOCn.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7fgzkgfed5cplnocn.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100012\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100012\\....\\temporaryfile")) returned 0 [0030.806] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100012\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100012\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100012\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100012\\temporaryfile")) returned 1 [0030.807] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100012\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176d8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176d8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176d8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.807] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176d8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176d8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176d8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.807] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176d8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176d8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176d8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.807] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100012\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176d8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176d8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176d8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.807] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176d8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176d8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176d8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.807] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176d8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176d8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176d8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.807] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.808] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100012\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100012\\temporaryfile")) returned 1 [0030.808] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176d8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176d8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176d8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.808] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.808] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100012" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100012")) returned 1 [0030.808] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\7fgzkGfed5cplNOCn.gif") returned 0 [0030.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\7fgzkGfed5cplNOCn.gif.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7fgzkgfed5cplnocn.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.809] WriteFile (in: hFile=0xc4, lpBuffer=0x2613e0*, nNumberOfBytesToWrite=0x3e58, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x2613e0*, lpNumberOfBytesWritten=0x18fe58*=0x3e58, lpOverlapped=0x0) returned 1 [0030.810] CloseHandle (hObject=0xc4) returned 1 [0030.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\7_2Pm_o.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7_2pm_o.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.811] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x4b7c [0030.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4b84) returned 0x25d578 [0030.811] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x4b7c, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x4b7c, lpOverlapped=0x0) returned 1 [0030.811] CloseHandle (hObject=0xc4) returned 1 [0030.811] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\7_2Pm_o.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7_2pm_o.bmp")) returned 1 [0030.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.813] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.813] GetTickCount () returned 0x186bb [0030.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.814] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.814] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\7_2Pm_o.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7_2pm_o.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027\\....\\temporaryfile")) returned 0 [0030.814] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027\\temporaryfile")) returned 1 [0030.815] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.815] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.815] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.815] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.815] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.816] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.816] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.816] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027\\temporaryfile")) returned 1 [0030.816] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.816] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.816] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027")) returned 1 [0030.816] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\7_2Pm_o.bmp") returned 0 [0030.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\7_2Pm_o.bmp.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7_2pm_o.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.817] WriteFile (in: hFile=0xc4, lpBuffer=0x262110*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x262110*, lpNumberOfBytesWritten=0x18fe58*=0x4b80, lpOverlapped=0x0) returned 1 [0030.818] CloseHandle (hObject=0xc4) returned 1 [0030.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\8RPUZRrEb-g13uY1.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8rpuzrreb-g13uy1.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.819] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x9d8 [0030.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9e0) returned 0x259670 [0030.819] ReadFile (in: hFile=0xc4, lpBuffer=0x259678, nNumberOfBytesToRead=0x9d8, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x259678*, lpNumberOfBytesRead=0x18fe70*=0x9d8, lpOverlapped=0x0) returned 1 [0030.820] CloseHandle (hObject=0xc4) returned 1 [0030.820] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\8RPUZRrEb-g13uY1.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8rpuzrreb-g13uy1.flv")) returned 1 [0030.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.821] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.821] GetTickCount () returned 0x186bb [0030.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.821] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.822] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\8RPUZRrEb-g13uY1.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8rpuzrreb-g13uy1.flv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027\\....\\temporaryfile")) returned 0 [0030.822] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027\\temporaryfile")) returned 1 [0030.823] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.823] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.823] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.823] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.823] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.823] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.824] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.824] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027\\temporaryfile")) returned 1 [0030.824] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x176ff100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x176ff100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x176ff100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.824] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.824] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100027" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100027")) returned 1 [0030.824] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\8RPUZRrEb-g13uY1.flv") returned 0 [0030.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\8RPUZRrEb-g13uY1.flv.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8rpuzrreb-g13uy1.flv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.825] WriteFile (in: hFile=0xc4, lpBuffer=0x25d580*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesWritten=0x18fe58*=0x9e0, lpOverlapped=0x0) returned 1 [0030.825] CloseHandle (hObject=0xc4) returned 1 [0030.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\9rfr3g.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\9rfr3g.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.826] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xb3db [0030.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb3e3) returned 0x25d578 [0030.826] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0xb3db, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0xb3db, lpOverlapped=0x0) returned 1 [0030.827] CloseHandle (hObject=0xc4) returned 1 [0030.827] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\9rfr3g.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\9rfr3g.ods")) returned 1 [0030.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.837] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.837] GetTickCount () returned 0x186cb [0030.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.837] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100043\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100043\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.838] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\9rfr3g.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\9rfr3g.ods"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100043\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100043\\....\\temporaryfile")) returned 0 [0030.838] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100043\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100043\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100043\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100043\\temporaryfile")) returned 1 [0030.839] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100043\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17725260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17725260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17725260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.839] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17725260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17725260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17725260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.839] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17725260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17725260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17725260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.839] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100043\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17725260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17725260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17725260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.839] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17725260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17725260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17725260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.839] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17725260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17725260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17725260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.839] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.839] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100043\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100043\\temporaryfile")) returned 1 [0030.839] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17725260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17725260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17725260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.839] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.840] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100043" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100043")) returned 1 [0030.840] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\9rfr3g.ods") returned 0 [0030.841] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\9rfr3g.ods.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\9rfr3g.ods.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.841] WriteFile (in: hFile=0xc4, lpBuffer=0x268970*, nNumberOfBytesToWrite=0xb3e0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x268970*, lpNumberOfBytesWritten=0x18fe58*=0xb3e0, lpOverlapped=0x0) returned 1 [0030.842] CloseHandle (hObject=0xc4) returned 1 [0030.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\aK8F9M7.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ak8f9m7.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.843] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x11141 [0030.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11149) returned 0x25d578 [0030.843] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x11141, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x11141, lpOverlapped=0x0) returned 1 [0030.845] CloseHandle (hObject=0xc4) returned 1 [0030.845] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\aK8F9M7.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ak8f9m7.jpg")) returned 1 [0030.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.846] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.846] GetTickCount () returned 0x186db [0030.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.849] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.849] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\aK8F9M7.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ak8f9m7.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059\\....\\temporaryfile")) returned 0 [0030.850] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059\\temporaryfile")) returned 1 [0030.851] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.851] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.851] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.851] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.851] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.851] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.851] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.851] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059\\temporaryfile")) returned 1 [0030.851] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.851] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.851] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059")) returned 1 [0030.852] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\aK8F9M7.jpg") returned 0 [0030.853] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\aK8F9M7.jpg.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ak8f9m7.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.853] WriteFile (in: hFile=0xc4, lpBuffer=0x26e6d8*, nNumberOfBytesToWrite=0x11148, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26e6d8*, lpNumberOfBytesWritten=0x18fe58*=0x11148, lpOverlapped=0x0) returned 1 [0030.855] CloseHandle (hObject=0xc4) returned 1 [0030.856] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\b1Al6ru.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b1al6ru.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.856] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x9c95 [0030.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9c9d) returned 0x25d578 [0030.856] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x9c95, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x9c95, lpOverlapped=0x0) returned 1 [0030.857] CloseHandle (hObject=0xc4) returned 1 [0030.857] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\b1Al6ru.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b1al6ru.mkv")) returned 1 [0030.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.859] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.859] GetTickCount () returned 0x186db [0030.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.859] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.860] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\b1Al6ru.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b1al6ru.mkv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059\\....\\temporaryfile")) returned 0 [0030.860] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059\\temporaryfile")) returned 1 [0030.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17771520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17771520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.861] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17771520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17771520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.861] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.861] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.861] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.861] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.861] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059\\temporaryfile")) returned 1 [0030.862] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1774b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1774b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1774b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.862] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100059" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100059")) returned 1 [0030.862] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\b1Al6ru.mkv") returned 0 [0030.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\b1Al6ru.mkv.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b1al6ru.mkv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.863] WriteFile (in: hFile=0xc4, lpBuffer=0x267228*, nNumberOfBytesToWrite=0x9ca0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x267228*, lpNumberOfBytesWritten=0x18fe58*=0x9ca0, lpOverlapped=0x0) returned 1 [0030.864] CloseHandle (hObject=0xc4) returned 1 [0030.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\DlRKCMr1kuUs99ccD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dlrkcmr1kuus99ccd.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.865] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x166c8 [0030.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x166d0) returned 0x25d578 [0030.865] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x166c8, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x166c8, lpOverlapped=0x0) returned 1 [0030.866] CloseHandle (hObject=0xc4) returned 1 [0030.867] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\DlRKCMr1kuUs99ccD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dlrkcmr1kuus99ccd.wav")) returned 1 [0030.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.868] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.868] GetTickCount () returned 0x186ea [0030.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.868] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100074\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100074\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.869] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\DlRKCMr1kuUs99ccD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dlrkcmr1kuus99ccd.wav"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100074\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100074\\....\\temporaryfile")) returned 0 [0030.869] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100074\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100074\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100074\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100074\\temporaryfile")) returned 1 [0030.870] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100074\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17771520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17771520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17771520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.870] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17771520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17771520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17771520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.870] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17771520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17771520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17771520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.870] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100074\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17771520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17771520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17771520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.870] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17771520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17771520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17771520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.870] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17771520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17771520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17771520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.870] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.871] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100074\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100074\\temporaryfile")) returned 1 [0030.871] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17771520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17771520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17771520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.871] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.871] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100074" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100074")) returned 1 [0030.871] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\DlRKCMr1kuUs99ccD.wav") returned 0 [0030.872] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\DlRKCMr1kuUs99ccD.wav.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dlrkcmr1kuus99ccd.wav.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.873] WriteFile (in: hFile=0xc4, lpBuffer=0x273c58*, nNumberOfBytesToWrite=0x166d0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x273c58*, lpNumberOfBytesWritten=0x18fe58*=0x166d0, lpOverlapped=0x0) returned 1 [0030.875] CloseHandle (hObject=0xc4) returned 1 [0030.878] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\ETUq1TsefE.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\etuq1tsefe.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.878] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x70d0 [0030.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x70d8) returned 0x25d578 [0030.878] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x70d0, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x70d0, lpOverlapped=0x0) returned 1 [0030.879] CloseHandle (hObject=0xc4) returned 1 [0030.879] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\ETUq1TsefE.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\etuq1tsefe.wav")) returned 1 [0030.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.880] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.880] GetTickCount () returned 0x186fa [0030.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.881] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.883] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\ETUq1TsefE.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\etuq1tsefe.wav"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090\\....\\temporaryfile")) returned 0 [0030.883] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090\\temporaryfile")) returned 1 [0030.884] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17797680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17797680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17797680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.884] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17797680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17797680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17797680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.884] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17797680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17797680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17797680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.884] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17797680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17797680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17797680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.884] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17797680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17797680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17797680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.884] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17797680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17797680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17797680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.884] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.884] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090\\temporaryfile")) returned 1 [0030.885] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17797680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17797680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17797680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.885] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.885] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090")) returned 1 [0030.885] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\ETUq1TsefE.wav") returned 0 [0030.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\ETUq1TsefE.wav.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\etuq1tsefe.wav.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.886] WriteFile (in: hFile=0xc4, lpBuffer=0x264660*, nNumberOfBytesToWrite=0x70d8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x264660*, lpNumberOfBytesWritten=0x18fe58*=0x70d8, lpOverlapped=0x0) returned 1 [0030.887] CloseHandle (hObject=0xc4) returned 1 [0030.888] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\eYRSDHH9d.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eyrsdhh9d.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.888] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x15ab3 [0030.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15abb) returned 0x25d578 [0030.888] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x15ab3, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x15ab3, lpOverlapped=0x0) returned 1 [0030.889] CloseHandle (hObject=0xc4) returned 1 [0030.889] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\eYRSDHH9d.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eyrsdhh9d.mp3")) returned 1 [0030.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.890] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.890] GetTickCount () returned 0x186fa [0030.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.891] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.891] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.892] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\eYRSDHH9d.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eyrsdhh9d.mp3"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090\\....\\temporaryfile")) returned 0 [0030.892] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090\\temporaryfile")) returned 1 [0030.893] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17797680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.893] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17797680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.893] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.893] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.893] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.893] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.893] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.893] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090\\temporaryfile")) returned 1 [0030.894] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.894] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.894] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100090" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100090")) returned 1 [0030.894] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\eYRSDHH9d.mp3") returned 0 [0030.895] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\eYRSDHH9d.mp3.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eyrsdhh9d.mp3.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.896] WriteFile (in: hFile=0xc4, lpBuffer=0x273048*, nNumberOfBytesToWrite=0x15ab8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x273048*, lpNumberOfBytesWritten=0x18fe58*=0x15ab8, lpOverlapped=0x0) returned 1 [0030.898] CloseHandle (hObject=0xc4) returned 1 [0030.899] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\fpkLEmTA.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fpklemta.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.899] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x13183 [0030.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1318b) returned 0x25d578 [0030.899] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x13183, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x13183, lpOverlapped=0x0) returned 1 [0030.900] CloseHandle (hObject=0xc4) returned 1 [0030.900] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\fpkLEmTA.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fpklemta.rtf")) returned 1 [0030.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.902] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.902] GetTickCount () returned 0x18709 [0030.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.902] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100105\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100105\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.903] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\fpkLEmTA.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fpklemta.rtf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100105\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100105\\....\\temporaryfile")) returned 0 [0030.903] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100105\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100105\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100105\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100105\\temporaryfile")) returned 1 [0030.904] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100105\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.904] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.904] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.904] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100105\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.904] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.904] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.904] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.905] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100105\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100105\\temporaryfile")) returned 1 [0030.905] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177bd7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177bd7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177bd7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.905] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.905] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100105" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100105")) returned 1 [0030.905] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\fpkLEmTA.rtf") returned 0 [0030.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\fpkLEmTA.rtf.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fpklemta.rtf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.907] WriteFile (in: hFile=0xc4, lpBuffer=0x270718*, nNumberOfBytesToWrite=0x13188, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x270718*, lpNumberOfBytesWritten=0x18fe58*=0x13188, lpOverlapped=0x0) returned 1 [0030.908] CloseHandle (hObject=0xc4) returned 1 [0030.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\HDB0GdLUiySD7s83WAzQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hdb0gdluiysd7s83wazq.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.910] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x220b [0030.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2213) returned 0x25d578 [0030.910] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x220b, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x220b, lpOverlapped=0x0) returned 1 [0030.910] CloseHandle (hObject=0xc4) returned 1 [0030.910] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\HDB0GdLUiySD7s83WAzQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hdb0gdluiysd7s83wazq.pptx")) returned 1 [0030.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.911] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.911] GetTickCount () returned 0x18719 [0030.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595d8 [0030.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c530 [0030.914] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100121\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100121\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.914] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\HDB0GdLUiySD7s83WAzQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hdb0gdluiysd7s83wazq.pptx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100121\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100121\\....\\temporaryfile")) returned 0 [0030.915] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100121\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100121\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100121\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100121\\temporaryfile")) returned 1 [0030.916] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100121\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177e3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177e3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177e3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c598 [0030.916] FindNextFileA (in: hFindFile=0x25c598, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177e3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177e3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177e3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.916] FindNextFileA (in: hFindFile=0x25c598, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177e3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177e3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177e3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.916] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100121\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177e3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177e3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177e3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c5b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.916] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177e3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177e3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177e3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c5b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.916] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177e3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177e3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177e3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c5b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.916] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.916] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100121\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100121\\temporaryfile")) returned 1 [0030.916] FindNextFileA (in: hFindFile=0x25c598, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x177e3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x177e3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x177e3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.916] FindClose (in: hFindFile=0x25c598 | out: hFindFile=0x25c598) returned 1 [0030.916] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100121" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100121")) returned 1 [0030.917] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\HDB0GdLUiySD7s83WAzQ.pptx") returned 0 [0030.917] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\HDB0GdLUiySD7s83WAzQ.pptx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hdb0gdluiysd7s83wazq.pptx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.917] WriteFile (in: hFile=0xc4, lpBuffer=0x25f7a0*, nNumberOfBytesToWrite=0x2210, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x25f7a0*, lpNumberOfBytesWritten=0x18fe58*=0x2210, lpOverlapped=0x0) returned 1 [0030.918] CloseHandle (hObject=0xc4) returned 1 [0030.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Hp9uEm2qgDx9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hp9uem2qgdx9.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.921] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x176cd [0030.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x176d5) returned 0x25d578 [0030.921] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x176cd, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x176cd, lpOverlapped=0x0) returned 1 [0030.923] CloseHandle (hObject=0xc4) returned 1 [0030.923] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Hp9uEm2qgDx9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hp9uem2qgdx9.mp4")) returned 1 [0030.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.925] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.925] GetTickCount () returned 0x18729 [0030.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.925] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.926] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Hp9uEm2qgDx9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hp9uem2qgdx9.mp4"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137\\....\\temporaryfile")) returned 0 [0030.926] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137\\temporaryfile")) returned 1 [0030.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.927] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.927] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.927] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.927] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.927] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.927] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137\\temporaryfile")) returned 1 [0030.927] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.927] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137")) returned 1 [0030.928] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Hp9uEm2qgDx9.mp4") returned 0 [0030.929] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Hp9uEm2qgDx9.mp4.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hp9uem2qgdx9.mp4.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.930] WriteFile (in: hFile=0xc4, lpBuffer=0x274c60*, nNumberOfBytesToWrite=0x176d8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x274c60*, lpNumberOfBytesWritten=0x18fe58*=0x176d8, lpOverlapped=0x0) returned 1 [0030.932] CloseHandle (hObject=0xc4) returned 1 [0030.933] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\hYLZvHOHq.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hylzvhohq.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.933] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x4ebf [0030.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4ec7) returned 0x25d578 [0030.933] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x4ebf, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x4ebf, lpOverlapped=0x0) returned 1 [0030.934] CloseHandle (hObject=0xc4) returned 1 [0030.934] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\hYLZvHOHq.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hylzvhohq.bmp")) returned 1 [0030.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.935] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.935] GetTickCount () returned 0x18729 [0030.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.936] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.937] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\hYLZvHOHq.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hylzvhohq.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137\\....\\temporaryfile")) returned 0 [0030.937] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137\\temporaryfile")) returned 1 [0030.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.938] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.938] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.938] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.938] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.938] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.938] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137\\temporaryfile")) returned 1 [0030.938] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17809aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17809aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17809aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.938] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.938] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100137" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100137")) returned 1 [0030.939] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\hYLZvHOHq.bmp") returned 0 [0030.939] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\hYLZvHOHq.bmp.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hylzvhohq.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.939] WriteFile (in: hFile=0xc4, lpBuffer=0x262450*, nNumberOfBytesToWrite=0x4ec8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x262450*, lpNumberOfBytesWritten=0x18fe58*=0x4ec8, lpOverlapped=0x0) returned 1 [0030.940] CloseHandle (hObject=0xc4) returned 1 [0030.941] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\koSBvQEvpYLBX86IlR C.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kosbvqevpylbx86ilr c.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.941] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x16b89 [0030.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16b91) returned 0x25d578 [0030.941] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x16b89, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x16b89, lpOverlapped=0x0) returned 1 [0030.943] CloseHandle (hObject=0xc4) returned 1 [0030.943] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\koSBvQEvpYLBX86IlR C.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kosbvqevpylbx86ilr c.mp4")) returned 1 [0030.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.944] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.944] GetTickCount () returned 0x18738 [0030.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.945] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100152\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100152\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.945] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\koSBvQEvpYLBX86IlR C.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kosbvqevpylbx86ilr c.mp4"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100152\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100152\\....\\temporaryfile")) returned 0 [0030.945] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100152\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100152\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100152\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100152\\temporaryfile")) returned 1 [0030.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100152\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1782fc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1782fc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1782fc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.946] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1782fc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1782fc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1782fc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.946] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1782fc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1782fc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1782fc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100152\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1782fc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1782fc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1782fc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.946] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1782fc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1782fc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1782fc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.946] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1782fc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1782fc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1782fc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.946] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100152\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100152\\temporaryfile")) returned 1 [0030.947] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1782fc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1782fc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1782fc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.947] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100152" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100152")) returned 1 [0030.947] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\koSBvQEvpYLBX86IlR C.mp4") returned 0 [0030.949] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\koSBvQEvpYLBX86IlR C.mp4.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kosbvqevpylbx86ilr c.mp4.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.949] WriteFile (in: hFile=0xc4, lpBuffer=0x274120*, nNumberOfBytesToWrite=0x16b90, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x274120*, lpNumberOfBytesWritten=0x18fe58*=0x16b90, lpOverlapped=0x0) returned 1 [0030.951] CloseHandle (hObject=0xc4) returned 1 [0030.952] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\K_ahl0R.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k_ahl0r.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.952] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x1556e [0030.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15576) returned 0x25d578 [0030.952] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x1556e, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x1556e, lpOverlapped=0x0) returned 1 [0030.954] CloseHandle (hObject=0xc4) returned 1 [0030.954] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\K_ahl0R.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k_ahl0r.swf")) returned 1 [0030.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.955] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.955] GetTickCount () returned 0x18748 [0030.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.956] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.956] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\K_ahl0R.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k_ahl0r.swf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168\\....\\temporaryfile")) returned 0 [0030.956] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168\\temporaryfile")) returned 1 [0030.957] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.958] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.958] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.958] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.958] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.958] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.958] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.958] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168\\temporaryfile")) returned 1 [0030.958] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.958] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.958] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168")) returned 1 [0030.958] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\K_ahl0R.swf") returned 0 [0030.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\K_ahl0R.swf.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k_ahl0r.swf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.960] WriteFile (in: hFile=0xc4, lpBuffer=0x272b00*, nNumberOfBytesToWrite=0x15578, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x272b00*, lpNumberOfBytesWritten=0x18fe58*=0x15578, lpOverlapped=0x0) returned 1 [0030.962] CloseHandle (hObject=0xc4) returned 1 [0030.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\lE3JQhfZrFvsQUDm.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\le3jqhfzrfvsqudm.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.963] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x13a7f [0030.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a87) returned 0x25d578 [0030.963] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x13a7f, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x13a7f, lpOverlapped=0x0) returned 1 [0030.964] CloseHandle (hObject=0xc4) returned 1 [0030.964] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\lE3JQhfZrFvsQUDm.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\le3jqhfzrfvsqudm.pps")) returned 1 [0030.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.966] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.966] GetTickCount () returned 0x18748 [0030.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.967] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.967] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\lE3JQhfZrFvsQUDm.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\le3jqhfzrfvsqudm.pps"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168\\....\\temporaryfile")) returned 0 [0030.967] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168\\temporaryfile")) returned 1 [0030.969] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.969] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.969] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.969] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.969] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.969] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.969] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.969] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168\\temporaryfile")) returned 1 [0030.969] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17855d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17855d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17855d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.969] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.970] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100168" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100168")) returned 1 [0030.970] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\lE3JQhfZrFvsQUDm.pps") returned 0 [0030.971] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\lE3JQhfZrFvsQUDm.pps.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\le3jqhfzrfvsqudm.pps.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.971] WriteFile (in: hFile=0xc4, lpBuffer=0x271010*, nNumberOfBytesToWrite=0x13a88, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x271010*, lpNumberOfBytesWritten=0x18fe58*=0x13a88, lpOverlapped=0x0) returned 1 [0030.975] CloseHandle (hObject=0xc4) returned 1 [0030.976] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\nBYfGQWP20W1fBYymA.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nbyfgqwp20w1fbyyma.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.976] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xdf28 [0030.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdf30) returned 0x25d578 [0030.976] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0xdf28, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0xdf28, lpOverlapped=0x0) returned 1 [0030.977] CloseHandle (hObject=0xc4) returned 1 [0030.977] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\nBYfGQWP20W1fBYymA.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nbyfgqwp20w1fbyyma.wav")) returned 1 [0030.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0030.980] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.980] GetTickCount () returned 0x18757 [0030.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0030.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.981] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100183\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100183\\...."), lpSecurityAttributes=0x256198) returned 1 [0030.981] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\nBYfGQWP20W1fBYymA.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nbyfgqwp20w1fbyyma.wav"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100183\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100183\\....\\temporaryfile")) returned 0 [0030.981] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100183\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100183\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100183\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100183\\temporaryfile")) returned 1 [0030.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100183\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1787bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1787bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1787bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.982] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1787bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1787bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1787bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.982] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1787bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1787bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1787bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100183\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1787bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1787bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1787bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.983] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1787bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1787bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1787bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.983] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1787bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1787bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1787bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.983] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100183\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100183\\temporaryfile")) returned 1 [0030.983] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1787bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1787bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1787bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.983] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100183" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100183")) returned 1 [0030.983] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\nBYfGQWP20W1fBYymA.wav") returned 0 [0030.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\nBYfGQWP20W1fBYymA.wav.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nbyfgqwp20w1fbyyma.wav.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.985] WriteFile (in: hFile=0xc4, lpBuffer=0x26b4b8*, nNumberOfBytesToWrite=0xdf30, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26b4b8*, lpNumberOfBytesWritten=0x18fe58*=0xdf30, lpOverlapped=0x0) returned 1 [0030.987] CloseHandle (hObject=0xc4) returned 1 [0030.988] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\OItGubAn-.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oitguban-.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.988] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xbfce [0030.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbfd6) returned 0x25d578 [0030.988] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0xbfce, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0xbfce, lpOverlapped=0x0) returned 1 [0030.989] CloseHandle (hObject=0xc4) returned 1 [0030.989] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\OItGubAn-.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oitguban-.bmp")) returned 1 [0030.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0030.990] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0030.990] GetTickCount () returned 0x18767 [0030.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0030.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0030.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0030.991] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0030.991] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\OItGubAn-.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oitguban-.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199\\....\\temporaryfile")) returned 0 [0030.991] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199\\temporaryfile")) returned 1 [0030.992] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178a2020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178a2020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178a2020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0030.992] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178a2020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178a2020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178a2020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.992] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178a2020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178a2020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178a2020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0030.993] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178a2020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178a2020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178a2020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0030.993] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178a2020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178a2020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178a2020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.993] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178a2020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178a2020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178a2020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.993] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0030.993] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199\\temporaryfile")) returned 1 [0030.993] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178a2020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178a2020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178a2020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0030.993] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0030.993] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199")) returned 1 [0030.993] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\OItGubAn-.bmp") returned 0 [0030.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\OItGubAn-.bmp.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oitguban-.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.994] WriteFile (in: hFile=0xc4, lpBuffer=0x269560*, nNumberOfBytesToWrite=0xbfd8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x269560*, lpNumberOfBytesWritten=0x18fe58*=0xbfd8, lpOverlapped=0x0) returned 1 [0030.996] CloseHandle (hObject=0xc4) returned 1 [0030.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\oOeIcMMwhOI.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ooeicmmwhoi.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0030.997] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x1135a [0030.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11362) returned 0x25d578 [0030.997] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x1135a, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x1135a, lpOverlapped=0x0) returned 1 [0030.998] CloseHandle (hObject=0xc4) returned 1 [0030.998] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\oOeIcMMwhOI.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ooeicmmwhoi.ppt")) returned 1 [0031.000] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0031.000] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.000] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.000] GetTickCount () returned 0x18767 [0031.000] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.000] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0031.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0031.001] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199\\...."), lpSecurityAttributes=0x256198) returned 1 [0031.002] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\oOeIcMMwhOI.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ooeicmmwhoi.ppt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199\\....\\temporaryfile")) returned 0 [0031.002] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199\\temporaryfile")) returned 1 [0031.003] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.003] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.003] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.003] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.003] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.003] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.003] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.003] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199\\temporaryfile")) returned 1 [0031.003] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.003] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.003] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100199" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100199")) returned 1 [0031.004] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\oOeIcMMwhOI.ppt") returned 0 [0031.005] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\oOeIcMMwhOI.ppt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ooeicmmwhoi.ppt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.005] WriteFile (in: hFile=0xc4, lpBuffer=0x26e8f0*, nNumberOfBytesToWrite=0x11360, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26e8f0*, lpNumberOfBytesWritten=0x18fe58*=0x11360, lpOverlapped=0x0) returned 1 [0031.007] CloseHandle (hObject=0xc4) returned 1 [0031.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\oX7qYv9qTw54L.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ox7qyv9qtw54l.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.008] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x924b [0031.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9253) returned 0x25d578 [0031.008] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x924b, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x924b, lpOverlapped=0x0) returned 1 [0031.008] CloseHandle (hObject=0xc4) returned 1 [0031.009] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\oX7qYv9qTw54L.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ox7qyv9qtw54l.mp3")) returned 1 [0031.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0031.010] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.010] GetTickCount () returned 0x18777 [0031.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0031.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0031.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0031.010] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100215\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100215\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0031.011] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\oX7qYv9qTw54L.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ox7qyv9qtw54l.mp3"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100215\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100215\\....\\temporaryfile")) returned 0 [0031.011] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100215\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100215\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100215\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100215\\temporaryfile")) returned 1 [0031.012] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100215\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.012] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.012] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.012] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100215\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.012] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.012] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.012] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.012] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100215\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100215\\temporaryfile")) returned 1 [0031.013] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178c8180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178c8180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178c8180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.013] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.013] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100215" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100215")) returned 1 [0031.013] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\oX7qYv9qTw54L.mp3") returned 0 [0031.014] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\oX7qYv9qTw54L.mp3.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ox7qyv9qtw54l.mp3.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.014] WriteFile (in: hFile=0xc4, lpBuffer=0x2667e0*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x2667e0*, lpNumberOfBytesWritten=0x18fe58*=0x9250, lpOverlapped=0x0) returned 1 [0031.015] CloseHandle (hObject=0xc4) returned 1 [0031.016] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\r4h7GGfytZNn.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\r4h7ggfytznn.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.016] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x65fe [0031.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6606) returned 0x25d578 [0031.017] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x65fe, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x65fe, lpOverlapped=0x0) returned 1 [0031.017] CloseHandle (hObject=0xc4) returned 1 [0031.017] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\r4h7GGfytZNn.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\r4h7ggfytznn.mp4")) returned 1 [0031.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0031.018] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.018] GetTickCount () returned 0x18786 [0031.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0031.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0031.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0031.018] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0031.019] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\r4h7GGfytZNn.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\r4h7ggfytznn.mp4"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230\\....\\temporaryfile")) returned 0 [0031.019] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230\\temporaryfile")) returned 1 [0031.020] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.020] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.020] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.020] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.020] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.020] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.020] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.020] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230\\temporaryfile")) returned 1 [0031.020] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.021] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.021] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230")) returned 1 [0031.021] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\r4h7GGfytZNn.mp4") returned 0 [0031.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\r4h7GGfytZNn.mp4.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\r4h7ggfytznn.mp4.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.022] WriteFile (in: hFile=0xc4, lpBuffer=0x263b90*, nNumberOfBytesToWrite=0x6608, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x263b90*, lpNumberOfBytesWritten=0x18fe58*=0x6608, lpOverlapped=0x0) returned 1 [0031.023] CloseHandle (hObject=0xc4) returned 1 [0031.024] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\r9fxrCjn_fvX0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\r9fxrcjn_fvx0.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.024] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xbfdb [0031.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbfe3) returned 0x25d578 [0031.024] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0xbfdb, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0xbfdb, lpOverlapped=0x0) returned 1 [0031.024] CloseHandle (hObject=0xc4) returned 1 [0031.024] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\r9fxrCjn_fvX0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\r9fxrcjn_fvx0.flv")) returned 1 [0031.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0031.026] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.026] GetTickCount () returned 0x18786 [0031.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0031.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0031.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0031.026] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0031.027] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\r9fxrCjn_fvX0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\r9fxrcjn_fvx0.flv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230\\....\\temporaryfile")) returned 0 [0031.027] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230\\temporaryfile")) returned 1 [0031.028] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.028] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.028] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.028] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.028] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.028] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.028] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.028] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230\\temporaryfile")) returned 1 [0031.029] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x178ee2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x178ee2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x178ee2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.029] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.029] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100230" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100230")) returned 1 [0031.029] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\r9fxrCjn_fvX0.flv") returned 0 [0031.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\r9fxrCjn_fvX0.flv.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\r9fxrcjn_fvx0.flv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.030] WriteFile (in: hFile=0xc4, lpBuffer=0x269570*, nNumberOfBytesToWrite=0xbfe0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x269570*, lpNumberOfBytesWritten=0x18fe58*=0xbfe0, lpOverlapped=0x0) returned 1 [0031.032] CloseHandle (hObject=0xc4) returned 1 [0031.033] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\RgphzL-7QJRwXkj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rgphzl-7qjrwxkj.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.033] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x7ede [0031.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ee6) returned 0x25d578 [0031.033] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x7ede, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x7ede, lpOverlapped=0x0) returned 1 [0031.034] CloseHandle (hObject=0xc4) returned 1 [0031.034] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\RgphzL-7QJRwXkj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rgphzl-7qjrwxkj.avi")) returned 1 [0031.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0031.035] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.035] GetTickCount () returned 0x18796 [0031.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0031.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0031.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0031.035] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100246\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100246\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0031.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\RgphzL-7QJRwXkj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rgphzl-7qjrwxkj.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100246\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100246\\....\\temporaryfile")) returned 0 [0031.036] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100246\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100246\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100246\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100246\\temporaryfile")) returned 1 [0031.037] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100246\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17914440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17914440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17914440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.037] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17914440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17914440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17914440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.037] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17914440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17914440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17914440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.037] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100246\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17914440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17914440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17914440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.037] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17914440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17914440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17914440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.037] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17914440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17914440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17914440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.037] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.037] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100246\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100246\\temporaryfile")) returned 1 [0031.038] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17914440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17914440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17914440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.038] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100246" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100246")) returned 1 [0031.038] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\RgphzL-7QJRwXkj.avi") returned 0 [0031.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\RgphzL-7QJRwXkj.avi.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rgphzl-7qjrwxkj.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.039] WriteFile (in: hFile=0xc4, lpBuffer=0x265470*, nNumberOfBytesToWrite=0x7ee8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x265470*, lpNumberOfBytesWritten=0x18fe58*=0x7ee8, lpOverlapped=0x0) returned 1 [0031.040] CloseHandle (hObject=0xc4) returned 1 [0031.041] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\tefEtu9q3KkgFxvT.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tefetu9q3kkgfxvt.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.041] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x52dd [0031.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x52e5) returned 0x25d578 [0031.041] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x52dd, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x52dd, lpOverlapped=0x0) returned 1 [0031.041] CloseHandle (hObject=0xc4) returned 1 [0031.041] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\tefEtu9q3KkgFxvT.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tefetu9q3kkgfxvt.ods")) returned 1 [0031.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0031.049] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.049] GetTickCount () returned 0x187a5 [0031.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0031.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0031.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0031.049] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0031.050] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\tefEtu9q3KkgFxvT.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tefetu9q3kkgfxvt.ods"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261\\....\\temporaryfile")) returned 0 [0031.050] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261\\temporaryfile")) returned 1 [0031.051] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.051] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.051] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.051] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.051] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.051] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.051] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.051] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261\\temporaryfile")) returned 1 [0031.051] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.051] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.051] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261")) returned 1 [0031.052] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\tefEtu9q3KkgFxvT.ods") returned 0 [0031.052] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\tefEtu9q3KkgFxvT.ods.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tefetu9q3kkgfxvt.ods.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.053] WriteFile (in: hFile=0xc4, lpBuffer=0x262870*, nNumberOfBytesToWrite=0x52e8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x262870*, lpNumberOfBytesWritten=0x18fe58*=0x52e8, lpOverlapped=0x0) returned 1 [0031.054] CloseHandle (hObject=0xc4) returned 1 [0031.054] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\UbpxQyPEL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ubpxqypel.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.054] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0xe0fc [0031.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe104) returned 0x25d578 [0031.054] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0xe0fc, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0xe0fc, lpOverlapped=0x0) returned 1 [0031.055] CloseHandle (hObject=0xc4) returned 1 [0031.055] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\UbpxQyPEL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ubpxqypel.avi")) returned 1 [0031.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0031.056] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.056] GetTickCount () returned 0x187a5 [0031.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0031.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0031.057] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261\\...."), lpSecurityAttributes=0x256198) returned 1 [0031.057] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\UbpxQyPEL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ubpxqypel.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261\\....\\temporaryfile")) returned 0 [0031.057] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261\\temporaryfile")) returned 1 [0031.058] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.058] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.058] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.059] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.059] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.059] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.059] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.059] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261\\temporaryfile")) returned 1 [0031.059] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1793a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1793a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1793a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.059] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.059] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100261" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100261")) returned 1 [0031.059] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\UbpxQyPEL.avi") returned 0 [0031.060] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\UbpxQyPEL.avi.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ubpxqypel.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.061] WriteFile (in: hFile=0xc4, lpBuffer=0x26b690*, nNumberOfBytesToWrite=0xe100, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x26b690*, lpNumberOfBytesWritten=0x18fe58*=0xe100, lpOverlapped=0x0) returned 1 [0031.062] CloseHandle (hObject=0xc4) returned 1 [0031.063] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\UTcXL9zykuS.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utcxl9zykus.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.064] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x59d1 [0031.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x59d9) returned 0x25d578 [0031.064] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x59d1, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x59d1, lpOverlapped=0x0) returned 1 [0031.064] CloseHandle (hObject=0xc4) returned 1 [0031.064] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\UTcXL9zykuS.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utcxl9zykus.mp4")) returned 1 [0031.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0031.065] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.065] GetTickCount () returned 0x187b5 [0031.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0031.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0031.066] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0031.069] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\UTcXL9zykuS.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utcxl9zykus.mp4"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277\\....\\temporaryfile")) returned 0 [0031.069] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277\\temporaryfile")) returned 1 [0031.070] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.070] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.070] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.070] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.070] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.070] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.070] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.070] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277\\temporaryfile")) returned 1 [0031.070] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.071] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.071] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277")) returned 1 [0031.071] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\UTcXL9zykuS.mp4") returned 0 [0031.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\UTcXL9zykuS.mp4.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utcxl9zykus.mp4.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.072] WriteFile (in: hFile=0xc4, lpBuffer=0x262f68*, nNumberOfBytesToWrite=0x59d8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x262f68*, lpNumberOfBytesWritten=0x18fe58*=0x59d8, lpOverlapped=0x0) returned 1 [0031.073] CloseHandle (hObject=0xc4) returned 1 [0031.074] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\w0Ctkj.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w0ctkj.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.074] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x18ea4 [0031.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18eac) returned 0x25d578 [0031.074] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x18ea4, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x18ea4, lpOverlapped=0x0) returned 1 [0031.074] CloseHandle (hObject=0xc4) returned 1 [0031.074] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\w0Ctkj.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w0ctkj.gif")) returned 1 [0031.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0031.076] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.077] GetTickCount () returned 0x187b5 [0031.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0031.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0031.077] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277\\...."), lpSecurityAttributes=0x256198) returned 1 [0031.078] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\w0Ctkj.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w0ctkj.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277\\....\\temporaryfile")) returned 0 [0031.078] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277\\temporaryfile")) returned 1 [0031.079] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.079] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.079] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.079] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.079] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.079] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.079] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277\\temporaryfile")) returned 1 [0031.080] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17960700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17960700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17960700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.080] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100277" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100277")) returned 1 [0031.080] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\w0Ctkj.gif") returned 0 [0031.082] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\w0Ctkj.gif.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w0ctkj.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.082] WriteFile (in: hFile=0xc4, lpBuffer=0x276438*, nNumberOfBytesToWrite=0x18ea8, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x276438*, lpNumberOfBytesWritten=0x18fe58*=0x18ea8, lpOverlapped=0x0) returned 1 [0031.084] CloseHandle (hObject=0xc4) returned 1 [0031.087] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\WtGBDq uSQoCPzY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wtgbdq usqocpzy.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.087] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x18369 [0031.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18371) returned 0x25d578 [0031.087] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x18369, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x18369, lpOverlapped=0x0) returned 1 [0031.088] CloseHandle (hObject=0xc4) returned 1 [0031.088] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\WtGBDq uSQoCPzY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wtgbdq usqocpzy.avi")) returned 1 [0031.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0031.089] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.090] GetTickCount () returned 0x187c5 [0031.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0031.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0031.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0031.090] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100293\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100293\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0031.091] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\WtGBDq uSQoCPzY.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wtgbdq usqocpzy.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100293\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100293\\....\\temporaryfile")) returned 0 [0031.091] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100293\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100293\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100293\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100293\\temporaryfile")) returned 1 [0031.092] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100293\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17986860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17986860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17986860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.092] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17986860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17986860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17986860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.092] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17986860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17986860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17986860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.092] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100293\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17986860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17986860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17986860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.092] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17986860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17986860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17986860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.092] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17986860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17986860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17986860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.092] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.092] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100293\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100293\\temporaryfile")) returned 1 [0031.092] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17986860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17986860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17986860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.093] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.093] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100293" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100293")) returned 1 [0031.093] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\WtGBDq uSQoCPzY.avi") returned 0 [0031.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x18378) returned 0x2758f8 [0031.095] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2150048 | out: hHeap=0x3f0000) returned 1 [0031.095] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\WtGBDq uSQoCPzY.avi.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wtgbdq usqocpzy.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.095] WriteFile (in: hFile=0xc4, lpBuffer=0x275900*, nNumberOfBytesToWrite=0x18370, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x275900*, lpNumberOfBytesWritten=0x18fe58*=0x18370, lpOverlapped=0x0) returned 1 [0031.097] CloseHandle (hObject=0xc4) returned 1 [0031.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\XUo1Tt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xuo1tt.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.099] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x7338 [0031.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7340) returned 0x25d578 [0031.099] ReadFile (in: hFile=0xc4, lpBuffer=0x25d580, nNumberOfBytesToRead=0x7338, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fe70*=0x7338, lpOverlapped=0x0) returned 1 [0031.099] CloseHandle (hObject=0xc4) returned 1 [0031.099] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\XUo1Tt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xuo1tt.jpg")) returned 1 [0031.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0031.101] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.101] GetTickCount () returned 0x187d4 [0031.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0031.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595b8 [0031.101] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100308\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100308\\...."), lpSecurityAttributes=0x256198) returned 1 [0031.102] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\XUo1Tt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xuo1tt.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100308\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100308\\....\\temporaryfile")) returned 0 [0031.102] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100308\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100308\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100308\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100308\\temporaryfile")) returned 1 [0031.103] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100308\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179ac9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179ac9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179ac9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.103] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179ac9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179ac9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179ac9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.103] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179ac9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179ac9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179ac9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.103] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100308\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179ac9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179ac9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179ac9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.103] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179ac9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179ac9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179ac9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.103] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179ac9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179ac9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179ac9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c54c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.103] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.103] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100308\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100308\\temporaryfile")) returned 1 [0031.103] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179ac9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179ac9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179ac9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.104] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100308" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100308")) returned 1 [0031.104] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\XUo1Tt.jpg") returned 0 [0031.105] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\XUo1Tt.jpg.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xuo1tt.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0031.105] WriteFile (in: hFile=0xc4, lpBuffer=0x2648c8*, nNumberOfBytesToWrite=0x7340, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x2648c8*, lpNumberOfBytesWritten=0x18fe58*=0x7340, lpOverlapped=0x0) returned 1 [0031.109] CloseHandle (hObject=0xc4) returned 1 [0031.110] FindClose (in: hFindFile=0x259630 | out: hFindFile=0x259630) returned 1 [0031.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\*.*", lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x179ac9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179ac9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x259630 [0031.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x2595c0 [0031.112] FindNextFileA (in: hFindFile=0x2595c0, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.112] FindNextFileA (in: hFindFile=0x2595c0, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0031.112] FindNextFileA (in: hFindFile=0x2595c0, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0031.113] FindNextFileA (in: hFindFile=0x2595c0, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0031.113] FindNextFileA (in: hFindFile=0x2595c0, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0031.113] FindNextFileA (in: hFindFile=0x2595c0, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0031.113] FindNextFileA (in: hFindFile=0x2595c0, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0031.113] FindClose (in: hFindFile=0x2595c0 | out: hFindFile=0x2595c0) returned 1 [0031.113] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x2595c0 [0031.114] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.114] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c5c0 [0031.114] FindNextFileA (in: hFindFile=0x25c5c0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.115] FindNextFileA (in: hFindFile=0x25c5c0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="10.0", cAlternateFileName="")) returned 1 [0031.115] FindNextFileA (in: hFindFile=0x25c5c0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="10.0", cAlternateFileName="")) returned 0 [0031.115] FindClose (in: hFindFile=0x25c5c0 | out: hFindFile=0x25c5c0) returned 1 [0031.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c5c0 [0031.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0031.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.115] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.115] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="Collab", cAlternateFileName="")) returned 1 [0031.115] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="Forms", cAlternateFileName="")) returned 1 [0031.115] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0031.115] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="Security", cAlternateFileName="")) returned 1 [0031.115] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName="Security", cAlternateFileName="")) returned 0 [0031.115] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd708940, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9c0 [0031.116] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Collab\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd9f48400, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.116] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd9f48400, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.116] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd9f48400, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 0 [0031.116] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Collab\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd9f48400, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0031.117] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Forms\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd9df17a0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.117] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd9df17a0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.117] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd9df17a0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 0 [0031.117] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Forms\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd9df17a0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9c0 [0031.117] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xec7c9cd0, dwReserved1=0x1d2ddf4, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.118] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xec7c9cd0, dwReserved1=0x1d2ddf4, cFileName="..", cAlternateFileName="")) returned 1 [0031.118] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xec7c9cd0, dwReserved1=0x1d2ddf4, cFileName="glob.js", cAlternateFileName="")) returned 1 [0031.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9e0 [0031.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.118] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x0 [0031.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9d0 [0031.119] ReadFile (in: hFile=0xdc, lpBuffer=0x25c9d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c9d8*, lpNumberOfBytesRead=0x18fdf0*=0x0, lpOverlapped=0x0) returned 1 [0031.119] CloseHandle (hObject=0xdc) returned 1 [0031.119] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js")) returned 1 [0031.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0031.119] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259600 [0031.119] GetTickCount () returned 0x187e4 [0031.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c6b8 [0031.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6f0 [0031.119] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100324\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100324\\...."), lpSecurityAttributes=0x256198) returned 1 [0031.120] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100324\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100324\\....\\temporaryfile")) returned 0 [0031.120] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100324\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100324\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100324\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100324\\temporaryfile")) returned 1 [0031.121] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100324\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179d2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179d2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179d2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName=".", cAlternateFileName="")) returned 0x25c758 [0031.121] FindNextFileA (in: hFindFile=0x25c758, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179d2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179d2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179d2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="..", cAlternateFileName="")) returned 1 [0031.121] FindNextFileA (in: hFindFile=0x25c758, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179d2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179d2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179d2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.121] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100324\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179d2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179d2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179d2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c774, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6f0 [0031.121] FindNextFileA (in: hFindFile=0x25c6f0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179d2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179d2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179d2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c774, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.121] FindNextFileA (in: hFindFile=0x25c6f0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179d2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179d2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179d2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c774, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.121] FindClose (in: hFindFile=0x25c6f0 | out: hFindFile=0x25c6f0) returned 1 [0031.121] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100324\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100324\\temporaryfile")) returned 1 [0031.122] FindNextFileA (in: hFindFile=0x25c758, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179d2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179d2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179d2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.122] FindClose (in: hFindFile=0x25c758 | out: hFindFile=0x25c758) returned 1 [0031.122] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100324" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100324")) returned 1 [0031.122] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js") returned 0 [0031.122] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.123] WriteFile (in: hFile=0xdc, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fdd8*=0x0, lpOverlapped=0x0) returned 1 [0031.123] CloseHandle (hObject=0xdc) returned 1 [0031.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.124] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa [0031.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdb0 [0031.124] ReadFile (in: hFile=0xdc, lpBuffer=0x25cdb8, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25cdb8*, lpNumberOfBytesRead=0x18fdf0*=0xa, lpOverlapped=0x0) returned 1 [0031.125] CloseHandle (hObject=0xdc) returned 1 [0031.125] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js")) returned 1 [0031.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0031.126] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259600 [0031.126] GetTickCount () returned 0x187f3 [0031.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c6c0 [0031.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6f8 [0031.127] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339\\...."), lpSecurityAttributes=0x256198) returned 1 [0031.128] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339\\....\\temporaryfile")) returned 0 [0031.128] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339\\temporaryfile")) returned 1 [0031.129] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c760 [0031.129] FindNextFileA (in: hFindFile=0x25c760, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.129] FindNextFileA (in: hFindFile=0x25c760, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.129] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c77c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6f8 [0031.129] FindNextFileA (in: hFindFile=0x25c6f8, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c77c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.129] FindNextFileA (in: hFindFile=0x25c6f8, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c77c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.130] FindClose (in: hFindFile=0x25c6f8 | out: hFindFile=0x25c6f8) returned 1 [0031.130] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339\\temporaryfile")) returned 1 [0031.130] FindNextFileA (in: hFindFile=0x25c760, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.130] FindClose (in: hFindFile=0x25c760 | out: hFindFile=0x25c760) returned 1 [0031.130] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339")) returned 1 [0031.130] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js") returned 0 [0031.130] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.131] WriteFile (in: hFile=0xdc, lpBuffer=0x25cdd8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25cdd8*, lpNumberOfBytesWritten=0x18fdd8*=0x10, lpOverlapped=0x0) returned 1 [0031.132] CloseHandle (hObject=0xdc) returned 1 [0031.132] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\JavaScripts\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0031.132] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xda28e240, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.133] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xda28e240, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.133] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0xda28e240, dwReserved1=0x1d2dda0, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0031.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15) returned 0x25cd90 [0031.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.134] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1517 [0031.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x151f) returned 0x261598 [0031.134] ReadFile (in: hFile=0xdc, lpBuffer=0x2615a0, nNumberOfBytesToRead=0x1517, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2615a0*, lpNumberOfBytesRead=0x18fdf0*=0x1517, lpOverlapped=0x0) returned 1 [0031.136] CloseHandle (hObject=0xdc) returned 1 [0031.136] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata")) returned 1 [0031.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0031.137] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259600 [0031.137] GetTickCount () returned 0x187f3 [0031.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c6c0 [0031.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6f8 [0031.137] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0031.138] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339\\....\\temporaryfile")) returned 0 [0031.138] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339\\temporaryfile")) returned 1 [0031.139] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x25c760 [0031.139] FindNextFileA (in: hFindFile=0x25c760, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0031.139] FindNextFileA (in: hFindFile=0x25c760, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.139] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c77c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6f8 [0031.139] FindNextFileA (in: hFindFile=0x25c6f8, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c77c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.139] FindNextFileA (in: hFindFile=0x25c6f8, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c77c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.139] FindClose (in: hFindFile=0x25c6f8 | out: hFindFile=0x25c6f8) returned 1 [0031.139] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339\\temporaryfile")) returned 1 [0031.140] FindNextFileA (in: hFindFile=0x25c760, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x179f8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.140] FindClose (in: hFindFile=0x25c760 | out: hFindFile=0x25c760) returned 1 [0031.140] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100339" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100339")) returned 1 [0031.140] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata") returned 0 [0031.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.141] WriteFile (in: hFile=0xdc, lpBuffer=0x262ac8*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x262ac8*, lpNumberOfBytesWritten=0x18fdd8*=0x1520, lpOverlapped=0x0) returned 1 [0031.142] CloseHandle (hObject=0xdc) returned 1 [0031.143] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x179f8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x179f8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0031.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xda2b43a0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c7d0 [0031.143] FindNextFileA (in: hFindFile=0x25c7d0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xda2b43a0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.143] FindNextFileA (in: hFindFile=0x25c7d0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0xda2b43a0, dwReserved1=0x1d2dda0, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 1 [0031.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d) returned 0x25c718 [0031.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0031.144] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3a5 [0031.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ad) returned 0x259670 [0031.144] ReadFile (in: hFile=0xe0, lpBuffer=0x259678, nNumberOfBytesToRead=0x3a5, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259678*, lpNumberOfBytesRead=0x18fdd0*=0x3a5, lpOverlapped=0x0) returned 1 [0031.145] CloseHandle (hObject=0xe0) returned 1 [0031.145] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl")) returned 1 [0031.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0031.146] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259600 [0031.146] GetTickCount () returned 0x18803 [0031.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0031.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c6b8 [0031.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c750 [0031.147] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100355\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100355\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0031.147] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100355\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100355\\....\\temporaryfile")) returned 0 [0031.147] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100355\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100355\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100355\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100355\\temporaryfile")) returned 1 [0031.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100355\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a1ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a1ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a1ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x17, cFileName=".", cAlternateFileName="")) returned 0x25c8a0 [0031.148] FindNextFileA (in: hFindFile=0x25c8a0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a1ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a1ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a1ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x17, cFileName="..", cAlternateFileName="")) returned 1 [0031.148] FindNextFileA (in: hFindFile=0x25c8a0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a1ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a1ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a1ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x17, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100355\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a1ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a1ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a1ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c8bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c750 [0031.148] FindNextFileA (in: hFindFile=0x25c750, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a1ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a1ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a1ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c8bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.148] FindNextFileA (in: hFindFile=0x25c750, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a1ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a1ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a1ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c8bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.148] FindClose (in: hFindFile=0x25c750 | out: hFindFile=0x25c750) returned 1 [0031.149] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100355\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100355\\temporaryfile")) returned 1 [0031.149] FindNextFileA (in: hFindFile=0x25c8a0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a1ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a1ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a1ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x17, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.149] FindClose (in: hFindFile=0x25c8a0 | out: hFindFile=0x25c8a0) returned 1 [0031.149] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100355" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100355")) returned 1 [0031.149] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned 0 [0031.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0031.150] WriteFile (in: hFile=0xe0, lpBuffer=0x259a30*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259a30*, lpNumberOfBytesWritten=0x18fdb8*=0x3b0, lpOverlapped=0x0) returned 1 [0031.151] CloseHandle (hObject=0xe0) returned 1 [0031.151] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0031.158] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x9347 [0031.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x934f) returned 0x2625a0 [0031.158] ReadFile (in: hFile=0xe0, lpBuffer=0x2625a8, nNumberOfBytesToRead=0x9347, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2625a8*, lpNumberOfBytesRead=0x18fdd0*=0x9347, lpOverlapped=0x0) returned 1 [0031.160] CloseHandle (hObject=0xe0) returned 1 [0031.160] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl")) returned 1 [0031.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0031.161] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259600 [0031.161] GetTickCount () returned 0x18813 [0031.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0031.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c780 [0031.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c810 [0031.162] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100371\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100371\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0031.162] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100371\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100371\\....\\temporaryfile")) returned 0 [0031.162] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100371\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100371\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100371\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100371\\temporaryfile")) returned 1 [0031.164] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100371\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a44f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a44f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a44f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c878 [0031.165] FindNextFileA (in: hFindFile=0x25c878, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a44f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a44f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a44f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.165] FindNextFileA (in: hFindFile=0x25c878, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a44f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a44f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a44f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.165] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100371\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a44f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a44f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a44f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c894, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c810 [0031.165] FindNextFileA (in: hFindFile=0x25c810, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a44f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a44f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a44f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c894, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.165] FindNextFileA (in: hFindFile=0x25c810, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a44f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a44f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a44f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c894, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.165] FindClose (in: hFindFile=0x25c810 | out: hFindFile=0x25c810) returned 1 [0031.165] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100371\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100371\\temporaryfile")) returned 1 [0031.165] FindNextFileA (in: hFindFile=0x25c878, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a44f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a44f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a44f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.165] FindClose (in: hFindFile=0x25c878 | out: hFindFile=0x25c878) returned 1 [0031.165] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100371" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100371")) returned 1 [0031.165] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl") returned 0 [0031.166] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0031.167] WriteFile (in: hFile=0xe0, lpBuffer=0x26b900*, nNumberOfBytesToWrite=0x9350, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x26b900*, lpNumberOfBytesWritten=0x18fdb8*=0x9350, lpOverlapped=0x0) returned 1 [0031.168] CloseHandle (hObject=0xe0) returned 1 [0031.169] FindClose (in: hFindFile=0x25c7d0 | out: hFindFile=0x25c7d0) returned 1 [0031.169] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x17a44f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a44f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c7d0 [0031.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0031.169] FindClose (in: hFindFile=0x25c7d0 | out: hFindFile=0x25c7d0) returned 1 [0031.169] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.169] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.169] FindClose (in: hFindFile=0x25c5c0 | out: hFindFile=0x25c5c0) returned 1 [0031.170] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Flash Player\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c5c8 [0031.171] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.171] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0031.171] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0 [0031.171] FindClose (in: hFindFile=0x25c5c8 | out: hFindFile=0x25c5c8) returned 1 [0031.171] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Flash Player\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c5c8 [0031.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.171] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Flash Player\\AssetCache\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c588 [0031.172] FindNextFileA (in: hFindFile=0x25c588, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.172] FindNextFileA (in: hFindFile=0x25c588, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0031.172] FindNextFileA (in: hFindFile=0x25c588, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 0 [0031.172] FindClose (in: hFindFile=0x25c588 | out: hFindFile=0x25c588) returned 1 [0031.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Flash Player\\AssetCache\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c588 [0031.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0031.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d40bff0, dwReserved1=0x1d35d06, cFileName=".", cAlternateFileName="")) returned 0x25c790 [0031.176] FindNextFileA (in: hFindFile=0x25c790, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d40bff0, dwReserved1=0x1d35d06, cFileName="..", cAlternateFileName="")) returned 1 [0031.176] FindNextFileA (in: hFindFile=0x25c790, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d40bff0, dwReserved1=0x1d35d06, cFileName="..", cAlternateFileName="")) returned 0 [0031.176] FindClose (in: hFindFile=0x25c790 | out: hFindFile=0x25c790) returned 1 [0031.176] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d40bff0, dwReserved1=0x1d35d06, cFileName=".", cAlternateFileName="")) returned 0x25c790 [0031.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.176] FindClose (in: hFindFile=0x25c790 | out: hFindFile=0x25c790) returned 1 [0031.176] FindClose (in: hFindFile=0x25c588 | out: hFindFile=0x25c588) returned 1 [0031.176] FindClose (in: hFindFile=0x25c5c8 | out: hFindFile=0x25c5c8) returned 1 [0031.176] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Headlights\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c5c0 [0031.177] FindNextFileA (in: hFindFile=0x25c5c0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.177] FindNextFileA (in: hFindFile=0x25c5c0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 0 [0031.177] FindClose (in: hFindFile=0x25c5c0 | out: hFindFile=0x25c5c0) returned 1 [0031.177] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Headlights\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c5c0 [0031.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0031.177] FindClose (in: hFindFile=0x25c5c0 | out: hFindFile=0x25c5c0) returned 1 [0031.177] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c5c8 [0031.178] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.178] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0031.178] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0031.178] FindClose (in: hFindFile=0x25c5c8 | out: hFindFile=0x25c5c8) returned 1 [0031.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c5c8 [0031.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c588 [0031.178] FindNextFileA (in: hFindFile=0x25c588, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.178] FindNextFileA (in: hFindFile=0x25c588, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 0 [0031.178] FindClose (in: hFindFile=0x25c588 | out: hFindFile=0x25c588) returned 1 [0031.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c588 [0031.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0031.178] FindClose (in: hFindFile=0x25c588 | out: hFindFile=0x25c588) returned 1 [0031.179] FindClose (in: hFindFile=0x25c5c8 | out: hFindFile=0x25c5c8) returned 1 [0031.179] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\LogTransport2\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c5c8 [0031.179] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.179] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 0 [0031.179] FindClose (in: hFindFile=0x25c5c8 | out: hFindFile=0x25c5c8) returned 1 [0031.179] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Adobe\\LogTransport2\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c5c8 [0031.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.179] FindClose (in: hFindFile=0x25c5c8 | out: hFindFile=0x25c5c8) returned 1 [0031.179] FindClose (in: hFindFile=0x2595c0 | out: hFindFile=0x2595c0) returned 1 [0031.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Identities\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.180] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0031.180] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0031.180] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0031.180] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Identities\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x2595f0 [0031.181] FindNextFileA (in: hFindFile=0x2595f0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0031.181] FindNextFileA (in: hFindFile=0x2595f0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 0 [0031.181] FindClose (in: hFindFile=0x2595f0 | out: hFindFile=0x2595f0) returned 1 [0031.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x2595f0 [0031.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0031.182] FindClose (in: hFindFile=0x2595f0 | out: hFindFile=0x2595f0) returned 1 [0031.182] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.182] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName="..", cAlternateFileName="")) returned 1 [0031.182] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0031.182] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0031.182] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0031.183] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName="..", cAlternateFileName="")) returned 1 [0031.183] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0031.183] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0031.183] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0031.183] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0031.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0031.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0031.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\#SharedObjects\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4582b0, dwReserved1=0x1d35d06, cFileName=".", cAlternateFileName="")) returned 0x259580 [0031.184] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4582b0, dwReserved1=0x1d35d06, cFileName="..", cAlternateFileName="")) returned 1 [0031.184] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4582b0, dwReserved1=0x1d35d06, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0031.184] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4582b0, dwReserved1=0x1d35d06, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0031.184] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0031.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\#SharedObjects\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4582b0, dwReserved1=0x1d35d06, cFileName=".", cAlternateFileName="")) returned 0x259580 [0031.184] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4582b0, dwReserved1=0x1d35d06, cFileName=".", cAlternateFileName="")) returned 0x25c778 [0031.185] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4582b0, dwReserved1=0x1d35d06, cFileName="..", cAlternateFileName="")) returned 1 [0031.185] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4582b0, dwReserved1=0x1d35d06, cFileName="..", cAlternateFileName="")) returned 0 [0031.185] FindClose (in: hFindFile=0x25c778 | out: hFindFile=0x25c778) returned 1 [0031.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4582b0, dwReserved1=0x1d35d06, cFileName=".", cAlternateFileName="")) returned 0x25c778 [0031.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0031.186] FindClose (in: hFindFile=0x25c778 | out: hFindFile=0x25c778) returned 1 [0031.186] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0031.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName=".", cAlternateFileName="")) returned 0x259580 [0031.186] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName="..", cAlternateFileName="")) returned 1 [0031.186] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName="support", cAlternateFileName="")) returned 1 [0031.186] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName="support", cAlternateFileName="")) returned 0 [0031.187] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0031.187] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6b695060, dwReserved1=0x1d2dda5, cFileName=".", cAlternateFileName="")) returned 0x259580 [0031.187] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.187] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d241020, dwReserved1=0x1d2dda5, cFileName=".", cAlternateFileName="")) returned 0x25c778 [0031.188] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d241020, dwReserved1=0x1d2dda5, cFileName="..", cAlternateFileName="")) returned 1 [0031.188] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d241020, dwReserved1=0x1d2dda5, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0031.188] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d241020, dwReserved1=0x1d2dda5, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0 [0031.188] FindClose (in: hFindFile=0x25c778 | out: hFindFile=0x25c778) returned 1 [0031.188] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d241020, dwReserved1=0x1d2dda5, cFileName=".", cAlternateFileName="")) returned 0x25c778 [0031.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0031.188] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d9d7640, dwReserved1=0x1d2dda5, cFileName=".", cAlternateFileName="")) returned 0x25c728 [0031.189] FindNextFileA (in: hFindFile=0x25c728, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d9d7640, dwReserved1=0x1d2dda5, cFileName="..", cAlternateFileName="")) returned 1 [0031.189] FindNextFileA (in: hFindFile=0x25c728, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d9d7640, dwReserved1=0x1d2dda5, cFileName="sys", cAlternateFileName="")) returned 1 [0031.189] FindNextFileA (in: hFindFile=0x25c728, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d9d7640, dwReserved1=0x1d2dda5, cFileName="sys", cAlternateFileName="")) returned 0 [0031.189] FindClose (in: hFindFile=0x25c728 | out: hFindFile=0x25c728) returned 1 [0031.189] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d9d7640, dwReserved1=0x1d2dda5, cFileName=".", cAlternateFileName="")) returned 0x25c728 [0031.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.189] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d9d7640, dwReserved1=0x1d2dda5, cFileName=".", cAlternateFileName="")) returned 0x25c8a8 [0031.189] FindNextFileA (in: hFindFile=0x25c8a8, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d9d7640, dwReserved1=0x1d2dda5, cFileName="..", cAlternateFileName="")) returned 1 [0031.189] FindNextFileA (in: hFindFile=0x25c8a8, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x6d9d7640, dwReserved1=0x1d2dda5, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0031.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561f8 [0031.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0031.190] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x1d6 [0031.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1de) returned 0x259670 [0031.190] ReadFile (in: hFile=0xe4, lpBuffer=0x259678, nNumberOfBytesToRead=0x1d6, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259678*, lpNumberOfBytesRead=0x18fdb0*=0x1d6, lpOverlapped=0x0) returned 1 [0031.191] CloseHandle (hObject=0xe4) returned 1 [0031.191] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol")) returned 1 [0031.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0031.192] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.192] GetTickCount () returned 0x18832 [0031.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0031.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c7b8 [0031.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c7f0 [0031.193] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100402\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100402\\...."), lpSecurityAttributes=0x256210) returned 1 [0031.193] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100402\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100402\\....\\temporaryfile")) returned 0 [0031.193] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100402\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100402\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100402\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100402\\temporaryfile")) returned 1 [0031.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100402\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a91200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a91200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a91200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1e, cFileName=".", cAlternateFileName="")) returned 0x25c858 [0031.195] FindNextFileA (in: hFindFile=0x25c858, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a91200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a91200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a91200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1e, cFileName="..", cAlternateFileName="")) returned 1 [0031.195] FindNextFileA (in: hFindFile=0x25c858, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a91200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a91200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a91200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1e, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100402\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a91200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a91200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a91200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c874, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7f0 [0031.195] FindNextFileA (in: hFindFile=0x25c7f0, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a91200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a91200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a91200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c874, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.195] FindNextFileA (in: hFindFile=0x25c7f0, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a91200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a91200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a91200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c874, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.195] FindClose (in: hFindFile=0x25c7f0 | out: hFindFile=0x25c7f0) returned 1 [0031.195] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100402\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100402\\temporaryfile")) returned 1 [0031.195] FindNextFileA (in: hFindFile=0x25c858, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17a91200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17a91200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a91200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1e, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.195] FindClose (in: hFindFile=0x25c858 | out: hFindFile=0x25c858) returned 1 [0031.195] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100402" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100402")) returned 1 [0031.196] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned 0 [0031.196] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0031.196] WriteFile (in: hFile=0xe4, lpBuffer=0x259860*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x259860*, lpNumberOfBytesWritten=0x18fd98*=0x1e0, lpOverlapped=0x0) returned 1 [0031.197] CloseHandle (hObject=0xe4) returned 1 [0031.198] FindClose (in: hFindFile=0x25c8a8 | out: hFindFile=0x25c8a8) returned 1 [0031.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x17a91200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17a91200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c8a8 [0031.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0031.198] FindClose (in: hFindFile=0x25c8a8 | out: hFindFile=0x25c8a8) returned 1 [0031.198] FindClose (in: hFindFile=0x25c728 | out: hFindFile=0x25c728) returned 1 [0031.198] FindClose (in: hFindFile=0x25c778 | out: hFindFile=0x25c778) returned 1 [0031.199] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0031.199] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0031.199] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.199] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="AddIns", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Crypto", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Excel", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="IME12", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="MMC", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Network", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Office", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Outlook", cAlternateFileName="")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0031.199] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Proof", cAlternateFileName="")) returned 1 [0031.200] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Protect", cAlternateFileName="")) returned 1 [0031.200] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0031.200] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0031.200] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Speech", cAlternateFileName="")) returned 1 [0031.200] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0031.200] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0031.200] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="UProof", cAlternateFileName="")) returned 1 [0031.200] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Windows", cAlternateFileName="")) returned 1 [0031.200] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Word", cAlternateFileName="")) returned 1 [0031.200] FindNextFileA (in: hFindFile=0x25c530, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Word", cAlternateFileName="")) returned 0 [0031.200] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0031.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c530 [0031.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\AddIns\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c36290, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.201] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c36290, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0031.201] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c36290, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 0 [0031.201] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.201] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\AddIns\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c36290, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.201] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0031.202] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0031.202] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 0 [0031.202] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0031.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0031.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.202] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0031.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.203] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0031.203] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="RSA", cAlternateFileName="")) returned 1 [0031.203] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="RSA", cAlternateFileName="")) returned 0 [0031.203] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.203] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.203] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c5b0 [0031.204] FindNextFileA (in: hFindFile=0x25c5b0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0031.204] FindNextFileA (in: hFindFile=0x25c5b0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0031.204] FindNextFileA (in: hFindFile=0x25c5b0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0031.204] FindClose (in: hFindFile=0x25c5b0 | out: hFindFile=0x25c5b0) returned 1 [0031.204] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c5b0 [0031.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.204] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x681f1360, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.206] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x681f1360, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 1 [0031.206] FindNextFileA (in: hFindFile=0x2595b8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x681f1360, dwReserved1=0x1d2dd9e, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 1 [0031.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x46) returned 0x25a590 [0031.206] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.207] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2d [0031.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x35) returned 0x25c6b8 [0031.207] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6c0, nNumberOfBytesToRead=0x2d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6c0*, lpNumberOfBytesRead=0x18fdf0*=0x2d, lpOverlapped=0x0) returned 1 [0031.208] CloseHandle (hObject=0xdc) returned 1 [0031.208] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 1 [0031.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0031.209] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.209] GetTickCount () returned 0x18841 [0031.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0031.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595f8 [0031.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6f8 [0031.210] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417\\...."), lpSecurityAttributes=0x256198) returned 1 [0031.210] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417\\....\\temporaryfile")) returned 0 [0031.210] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417\\temporaryfile")) returned 1 [0031.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17ab7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17ab7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17ab7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1f, cFileName=".", cAlternateFileName="")) returned 0x25c760 [0031.211] FindNextFileA (in: hFindFile=0x25c760, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17ab7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17ab7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17ab7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1f, cFileName="..", cAlternateFileName="")) returned 1 [0031.211] FindNextFileA (in: hFindFile=0x25c760, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17ab7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17ab7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17ab7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1f, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17ab7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17ab7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17ab7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c77c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6f8 [0031.212] FindNextFileA (in: hFindFile=0x25c6f8, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17ab7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17ab7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17ab7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c77c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.212] FindNextFileA (in: hFindFile=0x25c6f8, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17ab7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17ab7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17ab7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c77c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.212] FindClose (in: hFindFile=0x25c6f8 | out: hFindFile=0x25c6f8) returned 1 [0031.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417\\temporaryfile")) returned 1 [0031.212] FindNextFileA (in: hFindFile=0x25c760, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17ab7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17ab7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17ab7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1f, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.212] FindClose (in: hFindFile=0x25c760 | out: hFindFile=0x25c760) returned 1 [0031.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417")) returned 1 [0031.212] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 0 [0031.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.213] WriteFile (in: hFile=0xdc, lpBuffer=0x257a18*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x257a18*, lpNumberOfBytesWritten=0x18fdd8*=0x38, lpOverlapped=0x0) returned 1 [0031.214] CloseHandle (hObject=0xdc) returned 1 [0031.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.216] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x57 [0031.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5f) returned 0x25c6b8 [0031.216] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6c0, nNumberOfBytesToRead=0x57, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6c0*, lpNumberOfBytesRead=0x18fdf0*=0x57, lpOverlapped=0x0) returned 1 [0031.217] CloseHandle (hObject=0xdc) returned 1 [0031.217] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 1 [0031.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0031.218] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.218] GetTickCount () returned 0x18841 [0031.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0031.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595f8 [0031.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c720 [0031.219] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417\\...."), lpSecurityAttributes=0x256198) returned 1 [0031.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417\\....\\temporaryfile")) returned 0 [0031.219] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417\\temporaryfile")) returned 1 [0031.221] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17ab7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c788 [0031.221] FindNextFileA (in: hFindFile=0x25c788, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17ab7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.221] FindNextFileA (in: hFindFile=0x25c788, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.221] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c720 [0031.221] FindNextFileA (in: hFindFile=0x25c720, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.221] FindNextFileA (in: hFindFile=0x25c720, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.221] FindClose (in: hFindFile=0x25c720 | out: hFindFile=0x25c720) returned 1 [0031.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417\\temporaryfile")) returned 1 [0031.221] FindNextFileA (in: hFindFile=0x25c788, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.221] FindClose (in: hFindFile=0x25c788 | out: hFindFile=0x25c788) returned 1 [0031.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100417" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100417")) returned 1 [0031.222] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 0 [0031.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.222] WriteFile (in: hFile=0xdc, lpBuffer=0x25c7f8*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25c7f8*, lpNumberOfBytesWritten=0x18fdd8*=0x60, lpOverlapped=0x0) returned 1 [0031.223] CloseHandle (hObject=0xdc) returned 1 [0031.224] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.226] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d [0031.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x45) returned 0x25a5e0 [0031.226] ReadFile (in: hFile=0xdc, lpBuffer=0x25a5e8, nNumberOfBytesToRead=0x3d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25a5e8*, lpNumberOfBytesRead=0x18fdf0*=0x3d, lpOverlapped=0x0) returned 1 [0031.227] CloseHandle (hObject=0xdc) returned 1 [0031.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 1 [0031.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0031.228] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.228] GetTickCount () returned 0x18851 [0031.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0031.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595f8 [0031.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6b8 [0031.228] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100433\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100433\\...."), lpSecurityAttributes=0x256198) returned 1 [0031.229] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100433\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100433\\....\\temporaryfile")) returned 0 [0031.229] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100433\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100433\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100433\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100433\\temporaryfile")) returned 1 [0031.230] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100433\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c720 [0031.230] FindNextFileA (in: hFindFile=0x25c720, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.230] FindNextFileA (in: hFindFile=0x25c720, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.230] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100433\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c73c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6b8 [0031.230] FindNextFileA (in: hFindFile=0x25c6b8, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c73c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.231] FindNextFileA (in: hFindFile=0x25c6b8, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c73c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.231] FindClose (in: hFindFile=0x25c6b8 | out: hFindFile=0x25c6b8) returned 1 [0031.231] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100433\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100433\\temporaryfile")) returned 1 [0031.231] FindNextFileA (in: hFindFile=0x25c720, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17add4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.231] FindClose (in: hFindFile=0x25c720 | out: hFindFile=0x25c720) returned 1 [0031.231] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100433" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100433")) returned 1 [0031.231] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 0 [0031.231] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.232] WriteFile (in: hFile=0xdc, lpBuffer=0x25c790*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25c790*, lpNumberOfBytesWritten=0x18fdd8*=0x48, lpOverlapped=0x0) returned 1 [0031.233] CloseHandle (hObject=0xdc) returned 1 [0031.233] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.234] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x17add4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17add4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x2595b8 [0031.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0031.234] FindClose (in: hFindFile=0x2595b8 | out: hFindFile=0x2595b8) returned 1 [0031.234] FindClose (in: hFindFile=0x25c5b0 | out: hFindFile=0x25c5b0) returned 1 [0031.234] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.234] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Document Building Blocks\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x2595e0 [0031.235] FindNextFileA (in: hFindFile=0x2595e0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0031.235] FindNextFileA (in: hFindFile=0x2595e0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName="1033", cAlternateFileName="")) returned 1 [0031.235] FindNextFileA (in: hFindFile=0x2595e0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName="1033", cAlternateFileName="")) returned 0 [0031.235] FindClose (in: hFindFile=0x2595e0 | out: hFindFile=0x2595e0) returned 1 [0031.235] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Document Building Blocks\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x2595e0 [0031.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0031.235] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Document Building Blocks\\1033\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x25c6f8 [0031.236] FindNextFileA (in: hFindFile=0x25c6f8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0031.236] FindNextFileA (in: hFindFile=0x25c6f8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName="14", cAlternateFileName="")) returned 1 [0031.236] FindNextFileA (in: hFindFile=0x25c6f8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName="14", cAlternateFileName="")) returned 0 [0031.236] FindClose (in: hFindFile=0x25c6f8 | out: hFindFile=0x25c6f8) returned 1 [0031.236] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Document Building Blocks\\1033\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x25c6f8 [0031.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.237] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Document Building Blocks\\1033\\14\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x25c6a0 [0031.237] FindNextFileA (in: hFindFile=0x25c6a0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0031.237] FindNextFileA (in: hFindFile=0x25c6a0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x4f766d30, dwReserved1=0x1d2dda4, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0031.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e) returned 0x255c70 [0031.237] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.241] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3fe4ab [0031.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3fe4b3) returned 0x2250020 [0031.241] ReadFile (in: hFile=0xdc, lpBuffer=0x2250028, nNumberOfBytesToRead=0x3fe4ab, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdf0*=0x3fe4ab, lpOverlapped=0x0) returned 1 [0031.353] CloseHandle (hObject=0xdc) returned 1 [0031.353] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx")) returned 1 [0031.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0031.361] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.361] GetTickCount () returned 0x188dd [0031.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0031.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c638 [0031.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c738 [0031.362] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100573\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100573\\...."), lpSecurityAttributes=0x256198) returned 1 [0031.362] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100573\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100573\\....\\temporaryfile")) returned 0 [0031.362] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100573\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100573\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100573\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100573\\temporaryfile")) returned 1 [0031.364] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100573\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17c34120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17c34120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17c34120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName=".", cAlternateFileName="")) returned 0x25c7a0 [0031.364] FindNextFileA (in: hFindFile=0x25c7a0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17c34120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17c34120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17c34120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName="..", cAlternateFileName="")) returned 1 [0031.364] FindNextFileA (in: hFindFile=0x25c7a0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17c34120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17c34120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17c34120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.364] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100573\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17c34120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17c34120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17c34120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c738 [0031.364] FindNextFileA (in: hFindFile=0x25c738, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17c34120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17c34120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17c34120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.364] FindNextFileA (in: hFindFile=0x25c738, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17c34120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17c34120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17c34120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.364] FindClose (in: hFindFile=0x25c738 | out: hFindFile=0x25c738) returned 1 [0031.364] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100573\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100573\\temporaryfile")) returned 1 [0031.364] FindNextFileA (in: hFindFile=0x25c7a0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17c34120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17c34120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17c34120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.364] FindClose (in: hFindFile=0x25c7a0 | out: hFindFile=0x25c7a0) returned 1 [0031.365] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100573" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100573")) returned 1 [0031.365] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx") returned 0 [0031.531] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\built-in building blocks.dotx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0031.532] WriteFile (in: hFile=0xdc, lpBuffer=0x2a50028*, nNumberOfBytesToWrite=0x3fe4b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a50028*, lpNumberOfBytesWritten=0x18fdd8*=0x3fe4b0, lpOverlapped=0x0) returned 1 [0031.605] CloseHandle (hObject=0xdc) returned 1 [0031.722] FindClose (in: hFindFile=0x25c6a0 | out: hFindFile=0x25c6a0) returned 1 [0031.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Document Building Blocks\\1033\\14\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x17dd7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17dd7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c6a0 [0031.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.722] FindClose (in: hFindFile=0x25c6a0 | out: hFindFile=0x25c6a0) returned 1 [0031.723] FindClose (in: hFindFile=0x25c6f8 | out: hFindFile=0x25c6f8) returned 1 [0031.723] FindClose (in: hFindFile=0x2595e0 | out: hFindFile=0x2595e0) returned 1 [0031.723] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Excel\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c1e0470, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.723] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c1e0470, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0031.723] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c1e0470, dwReserved1=0x1d2dda4, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0031.723] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c1e0470, dwReserved1=0x1d2dda4, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0031.723] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.723] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Excel\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c1e0470, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Excel\\XLSTART\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd01394e0, dwReserved1=0x1d301bc, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0031.724] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd01394e0, dwReserved1=0x1d301bc, cFileName="..", cAlternateFileName="")) returned 1 [0031.724] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd01394e0, dwReserved1=0x1d301bc, cFileName="..", cAlternateFileName="")) returned 0 [0031.724] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0031.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Excel\\XLSTART\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd01394e0, dwReserved1=0x1d301bc, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0031.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0031.724] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0031.724] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\IME12\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.726] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.726] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 0 [0031.726] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.726] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\IME12\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0031.726] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.726] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.727] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.727] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 0 [0031.727] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.727] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.728] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.728] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 0 [0031.728] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.728] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.728] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.728] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.728] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0031.728] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 0 [0031.728] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0031.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0031.729] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0031.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c618 [0031.729] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0031.729] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0031.729] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="UserData", cAlternateFileName="")) returned 1 [0031.729] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="UserData", cAlternateFileName="")) returned 0 [0031.729] FindClose (in: hFindFile=0x25c618 | out: hFindFile=0x25c618) returned 1 [0031.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c618 [0031.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c5d0 [0031.729] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0031.729] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0031.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561e0 [0031.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0031.730] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xdd [0031.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe5) returned 0x25c6c8 [0031.730] ReadFile (in: hFile=0xd8, lpBuffer=0x25c6d0, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c6d0*, lpNumberOfBytesRead=0x18fe10*=0xdd, lpOverlapped=0x0) returned 1 [0031.730] CloseHandle (hObject=0xd8) returned 1 [0031.730] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 1 [0031.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0031.731] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.731] GetTickCount () returned 0x18a44 [0031.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0031.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595d8 [0031.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c7b8 [0031.732] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100932\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0031.732] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100932\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100932\\....\\temporaryfile")) returned 0 [0031.732] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100932\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100932\\temporaryfile")) returned 1 [0031.734] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100932\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fa00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fa00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fa00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName=".", cAlternateFileName="")) returned 0x25c820 [0031.734] FindNextFileA (in: hFindFile=0x25c820, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fa00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fa00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fa00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName="..", cAlternateFileName="")) returned 1 [0031.734] FindNextFileA (in: hFindFile=0x25c820, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fa00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fa00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fa00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.734] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100932\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fa00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fa00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fa00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c83c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7b8 [0031.734] FindNextFileA (in: hFindFile=0x25c7b8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fa00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fa00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fa00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c83c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.734] FindNextFileA (in: hFindFile=0x25c7b8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fa00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fa00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fa00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c83c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.734] FindClose (in: hFindFile=0x25c7b8 | out: hFindFile=0x25c7b8) returned 1 [0031.734] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100932\\temporaryfile")) returned 1 [0031.737] FindNextFileA (in: hFindFile=0x25c820, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fa00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fa00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fa00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.737] FindClose (in: hFindFile=0x25c820 | out: hFindFile=0x25c820) returned 1 [0031.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100932" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100932")) returned 1 [0031.737] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned 0 [0031.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0031.738] WriteFile (in: hFile=0xd8, lpBuffer=0x25c838*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c838*, lpNumberOfBytesWritten=0x18fdf8*=0xe8, lpOverlapped=0x0) returned 1 [0031.739] CloseHandle (hObject=0xd8) returned 1 [0031.739] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0031.740] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x8e9 [0031.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8f1) returned 0x259670 [0031.740] ReadFile (in: hFile=0xd8, lpBuffer=0x259678, nNumberOfBytesToRead=0x8e9, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259678*, lpNumberOfBytesRead=0x18fe10*=0x8e9, lpOverlapped=0x0) returned 1 [0031.742] CloseHandle (hObject=0xd8) returned 1 [0031.742] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk")) returned 1 [0031.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0031.743] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2594e8 [0031.743] GetTickCount () returned 0x18a54 [0031.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595d8 [0031.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6d0 [0031.743] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100948\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100948\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0031.745] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100948\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100948\\....\\temporaryfile")) returned 0 [0031.745] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100948\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100948\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100948\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100948\\temporaryfile")) returned 1 [0031.746] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100948\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fc6220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fc6220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fc6220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c738 [0031.746] FindNextFileA (in: hFindFile=0x25c738, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fc6220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fc6220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fc6220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.746] FindNextFileA (in: hFindFile=0x25c738, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fc6220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fc6220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fc6220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.746] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100948\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fc6220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fc6220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fc6220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c754, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6d0 [0031.747] FindNextFileA (in: hFindFile=0x25c6d0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fc6220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fc6220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fc6220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c754, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.747] FindNextFileA (in: hFindFile=0x25c6d0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fc6220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fc6220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fc6220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c754, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.747] FindClose (in: hFindFile=0x25c6d0 | out: hFindFile=0x25c6d0) returned 1 [0031.747] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100948\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100948\\temporaryfile")) returned 1 [0031.747] FindNextFileA (in: hFindFile=0x25c738, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fc6220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fc6220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fc6220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.747] FindClose (in: hFindFile=0x25c738 | out: hFindFile=0x25c738) returned 1 [0031.747] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100948" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100948")) returned 1 [0031.747] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned 0 [0031.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0031.748] WriteFile (in: hFile=0xd8, lpBuffer=0x260598*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x260598*, lpNumberOfBytesWritten=0x18fdf8*=0x8f0, lpOverlapped=0x0) returned 1 [0031.750] CloseHandle (hObject=0xd8) returned 1 [0031.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0031.751] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x5a7 [0031.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5af) returned 0x259670 [0031.751] ReadFile (in: hFile=0xd8, lpBuffer=0x259678, nNumberOfBytesToRead=0x5a7, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259678*, lpNumberOfBytesRead=0x18fe10*=0x5a7, lpOverlapped=0x0) returned 1 [0031.753] CloseHandle (hObject=0xd8) returned 1 [0031.753] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk")) returned 1 [0031.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0031.754] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2595d8 [0031.754] GetTickCount () returned 0x18a63 [0031.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c6e0 [0031.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x2595d8 [0031.754] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0031.755] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963\\....\\temporaryfile")) returned 0 [0031.755] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963\\temporaryfile")) returned 1 [0031.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0031.756] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.756] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2595f4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7a0 [0031.756] FindNextFileA (in: hFindFile=0x25c7a0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2595f4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.756] FindNextFileA (in: hFindFile=0x25c7a0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2595f4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.756] FindClose (in: hFindFile=0x25c7a0 | out: hFindFile=0x25c7a0) returned 1 [0031.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963\\temporaryfile")) returned 1 [0031.757] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.757] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0031.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963")) returned 1 [0031.757] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk") returned 0 [0031.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0031.758] WriteFile (in: hFile=0xd8, lpBuffer=0x259c30*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259c30*, lpNumberOfBytesWritten=0x18fdf8*=0x5b0, lpOverlapped=0x0) returned 1 [0031.758] CloseHandle (hObject=0xd8) returned 1 [0031.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0031.760] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x122 [0031.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12a) returned 0x25c6d0 [0031.761] ReadFile (in: hFile=0xd8, lpBuffer=0x25c6d8, nNumberOfBytesToRead=0x122, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c6d8*, lpNumberOfBytesRead=0x18fe10*=0x122, lpOverlapped=0x0) returned 1 [0031.761] CloseHandle (hObject=0xd8) returned 1 [0031.761] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 1 [0031.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0031.762] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0031.762] GetTickCount () returned 0x18a63 [0031.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595d8 [0031.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c808 [0031.763] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0031.763] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963\\....\\temporaryfile")) returned 0 [0031.764] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963\\temporaryfile")) returned 1 [0031.791] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c870 [0031.791] FindNextFileA (in: hFindFile=0x25c870, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.791] FindNextFileA (in: hFindFile=0x25c870, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.791] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c88c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c938 [0031.791] FindNextFileA (in: hFindFile=0x25c938, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c88c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.791] FindNextFileA (in: hFindFile=0x25c938, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c88c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.791] FindClose (in: hFindFile=0x25c938 | out: hFindFile=0x25c938) returned 1 [0031.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963\\temporaryfile")) returned 1 [0031.792] FindNextFileA (in: hFindFile=0x25c870, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x17fec380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x17fec380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x17fec380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.792] FindClose (in: hFindFile=0x25c870 | out: hFindFile=0x25c870) returned 1 [0031.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18100963" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18100963")) returned 1 [0031.792] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned 0 [0031.792] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0031.793] WriteFile (in: hFile=0xd8, lpBuffer=0x25c810*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c810*, lpNumberOfBytesWritten=0x18fdf8*=0x128, lpOverlapped=0x0) returned 1 [0031.793] CloseHandle (hObject=0xd8) returned 1 [0031.794] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0031.795] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x110 [0031.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x118) returned 0x25c6d0 [0031.795] ReadFile (in: hFile=0xd8, lpBuffer=0x25c6d8, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c6d8*, lpNumberOfBytesRead=0x18fe10*=0x110, lpOverlapped=0x0) returned 1 [0031.795] CloseHandle (hObject=0xd8) returned 1 [0031.796] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 1 [0031.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0031.797] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0031.797] GetTickCount () returned 0x18a92 [0031.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0031.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595d8 [0031.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c7f0 [0031.797] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0031.798] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010\\....\\temporaryfile")) returned 0 [0031.798] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010\\temporaryfile")) returned 1 [0031.799] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c858 [0031.799] FindNextFileA (in: hFindFile=0x25c858, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.799] FindNextFileA (in: hFindFile=0x25c858, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.799] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c874, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c920 [0031.799] FindNextFileA (in: hFindFile=0x25c920, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c874, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.799] FindNextFileA (in: hFindFile=0x25c920, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c874, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0031.799] FindClose (in: hFindFile=0x25c920 | out: hFindFile=0x25c920) returned 1 [0031.799] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010\\temporaryfile")) returned 1 [0031.800] FindNextFileA (in: hFindFile=0x25c858, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0031.800] FindClose (in: hFindFile=0x25c858 | out: hFindFile=0x25c858) returned 1 [0031.800] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010")) returned 1 [0031.800] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned 0 [0031.800] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0031.803] WriteFile (in: hFile=0xd8, lpBuffer=0x25c7f8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c7f8*, lpNumberOfBytesWritten=0x18fdf8*=0x118, lpOverlapped=0x0) returned 1 [0031.804] CloseHandle (hObject=0xd8) returned 1 [0031.805] FindClose (in: hFindFile=0x25c5d0 | out: hFindFile=0x25c5d0) returned 1 [0031.805] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c5d0 [0031.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.805] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0031.805] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0031.805] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0031.805] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0031.805] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0031.805] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0031.805] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0031.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0031.805] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c8e0 [0031.806] FindNextFileA (in: hFindFile=0x25c8e0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0031.806] FindNextFileA (in: hFindFile=0x25c8e0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 0 [0031.806] FindClose (in: hFindFile=0x25c8e0 | out: hFindFile=0x25c8e0) returned 1 [0031.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c8e0 [0031.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0031.806] FindClose (in: hFindFile=0x25c8e0 | out: hFindFile=0x25c8e0) returned 1 [0031.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c8a0 [0031.807] FindNextFileA (in: hFindFile=0x25c8a0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0031.807] FindNextFileA (in: hFindFile=0x25c8a0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0031.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561c8 [0031.807] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0031.807] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x19c [0031.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a4) returned 0x259e70 [0031.807] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x19c, lpOverlapped=0x0) returned 1 [0031.808] CloseHandle (hObject=0xe0) returned 1 [0031.808] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 1 [0031.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561f8 [0031.809] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0031.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0031.809] GetTickCount () returned 0x18a92 [0031.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0031.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c8e0 [0031.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c918 [0031.809] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010\\...."), lpSecurityAttributes=0x2561f8) returned 1 [0031.810] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010\\....\\temporaryfile")) returned 0 [0031.810] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010\\temporaryfile")) returned 1 [0031.811] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0x25c918 [0031.811] FindNextFileA (in: hFindFile=0x25c918, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1d, cFileName="..", cAlternateFileName="")) returned 1 [0031.811] FindNextFileA (in: hFindFile=0x25c918, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1d, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0031.811] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c934, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7c8 [0032.208] FindNextFileA (in: hFindFile=0x25c7c8, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c934, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.209] FindNextFileA (in: hFindFile=0x25c7c8, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c934, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.209] FindClose (in: hFindFile=0x25c7c8 | out: hFindFile=0x25c7c8) returned 1 [0032.209] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010\\temporaryfile")) returned 1 [0032.209] FindNextFileA (in: hFindFile=0x25c918, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1805e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1805e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1805e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1d, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.209] FindClose (in: hFindFile=0x25c918 | out: hFindFile=0x25c918) returned 1 [0032.209] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101010" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101010")) returned 1 [0032.209] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned 0 [0032.209] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.211] WriteFile (in: hFile=0xe0, lpBuffer=0x25a028*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25a028*, lpNumberOfBytesWritten=0x18fdb8*=0x1a0, lpOverlapped=0x0) returned 1 [0032.211] CloseHandle (hObject=0xe0) returned 1 [0032.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.213] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8dd [0032.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8e5) returned 0x2625a0 [0032.213] ReadFile (in: hFile=0xe0, lpBuffer=0x2625a8, nNumberOfBytesToRead=0x8dd, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2625a8*, lpNumberOfBytesRead=0x18fdd0*=0x8dd, lpOverlapped=0x0) returned 1 [0032.213] CloseHandle (hObject=0xe0) returned 1 [0032.213] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk")) returned 1 [0032.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.215] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.215] GetTickCount () returned 0x18c28 [0032.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c740 [0032.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c778 [0032.218] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101416\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101416\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.218] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101416\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101416\\....\\temporaryfile")) returned 0 [0032.219] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101416\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101416\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101416\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101416\\temporaryfile")) returned 1 [0032.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101416\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1843cb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7e0 [0032.220] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1843cb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.220] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101416\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c778 [0032.220] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.220] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.220] FindClose (in: hFindFile=0x25c778 | out: hFindFile=0x25c778) returned 1 [0032.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101416\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101416\\temporaryfile")) returned 1 [0032.221] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.221] FindClose (in: hFindFile=0x25c7e0 | out: hFindFile=0x25c7e0) returned 1 [0032.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101416" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101416")) returned 1 [0032.221] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk") returned 0 [0032.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.222] WriteFile (in: hFile=0xe0, lpBuffer=0x262e98*, nNumberOfBytesToWrite=0x8e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x262e98*, lpNumberOfBytesWritten=0x18fdb8*=0x8e8, lpOverlapped=0x0) returned 1 [0032.223] CloseHandle (hObject=0xe0) returned 1 [0032.224] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.224] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5ad [0032.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b5) returned 0x259e70 [0032.224] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x5ad, lpOverlapped=0x0) returned 1 [0032.225] CloseHandle (hObject=0xe0) returned 1 [0032.225] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 1 [0032.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.226] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.226] GetTickCount () returned 0x18c37 [0032.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a430 [0032.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a468 [0032.227] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101431\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101431\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.227] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101431\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101431\\....\\temporaryfile")) returned 0 [0032.228] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101431\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101431\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101431\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101431\\temporaryfile")) returned 1 [0032.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101431\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a4d0 [0032.229] FindNextFileA (in: hFindFile=0x25a4d0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.229] FindNextFileA (in: hFindFile=0x25a4d0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101431\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a468 [0032.229] FindNextFileA (in: hFindFile=0x25a468, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.229] FindNextFileA (in: hFindFile=0x25a468, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.229] FindClose (in: hFindFile=0x25a468 | out: hFindFile=0x25a468) returned 1 [0032.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101431\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101431\\temporaryfile")) returned 1 [0032.229] FindNextFileA (in: hFindFile=0x25a4d0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18462cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18462cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18462cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.229] FindClose (in: hFindFile=0x25a4d0 | out: hFindFile=0x25a4d0) returned 1 [0032.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101431" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101431")) returned 1 [0032.230] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk") returned 0 [0032.230] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.231] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0x5b8, lpOverlapped=0x0) returned 1 [0032.232] CloseHandle (hObject=0xe0) returned 1 [0032.233] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.235] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5a9 [0032.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b1) returned 0x259e70 [0032.235] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5a9, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x5a9, lpOverlapped=0x0) returned 1 [0032.237] CloseHandle (hObject=0xe0) returned 1 [0032.237] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 1 [0032.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.238] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.238] GetTickCount () returned 0x18c47 [0032.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a430 [0032.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a468 [0032.238] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.238] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447\\....\\temporaryfile")) returned 0 [0032.239] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447\\temporaryfile")) returned 1 [0032.240] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a4d0 [0032.240] FindNextFileA (in: hFindFile=0x25a4d0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.240] FindNextFileA (in: hFindFile=0x25a4d0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.240] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a468 [0032.240] FindNextFileA (in: hFindFile=0x25a468, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.240] FindNextFileA (in: hFindFile=0x25a468, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.240] FindClose (in: hFindFile=0x25a468 | out: hFindFile=0x25a468) returned 1 [0032.240] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447\\temporaryfile")) returned 1 [0032.240] FindNextFileA (in: hFindFile=0x25a4d0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.240] FindClose (in: hFindFile=0x25a4d0 | out: hFindFile=0x25a4d0) returned 1 [0032.240] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447")) returned 1 [0032.241] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk") returned 0 [0032.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.241] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0x5b0, lpOverlapped=0x0) returned 1 [0032.242] CloseHandle (hObject=0xe0) returned 1 [0032.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.243] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x491 [0032.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x499) returned 0x259e70 [0032.243] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x491, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x491, lpOverlapped=0x0) returned 1 [0032.244] CloseHandle (hObject=0xe0) returned 1 [0032.244] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk")) returned 1 [0032.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.245] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.245] GetTickCount () returned 0x18c47 [0032.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c740 [0032.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c778 [0032.245] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447\\....\\temporaryfile")) returned 0 [0032.246] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447\\temporaryfile")) returned 1 [0032.247] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7e0 [0032.247] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.247] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.247] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c778 [0032.247] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.247] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.247] FindClose (in: hFindFile=0x25c778 | out: hFindFile=0x25c778) returned 1 [0032.247] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447\\temporaryfile")) returned 1 [0032.248] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18488e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18488e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18488e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.248] FindClose (in: hFindFile=0x25c7e0 | out: hFindFile=0x25c7e0) returned 1 [0032.248] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101447" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101447")) returned 1 [0032.248] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk") returned 0 [0032.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.261] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x498, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0x498, lpOverlapped=0x0) returned 1 [0032.262] CloseHandle (hObject=0xe0) returned 1 [0032.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.263] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4cc [0032.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4d4) returned 0x259e70 [0032.263] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x4cc, lpOverlapped=0x0) returned 1 [0032.265] CloseHandle (hObject=0xe0) returned 1 [0032.265] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 1 [0032.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.266] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.266] GetTickCount () returned 0x18c66 [0032.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c740 [0032.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c778 [0032.267] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.267] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478\\....\\temporaryfile")) returned 0 [0032.267] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478\\temporaryfile")) returned 1 [0032.268] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7e0 [0032.268] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.268] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.269] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c778 [0032.269] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.269] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.269] FindClose (in: hFindFile=0x25c778 | out: hFindFile=0x25c778) returned 1 [0032.269] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478\\temporaryfile")) returned 1 [0032.269] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.269] FindClose (in: hFindFile=0x25c7e0 | out: hFindFile=0x25c7e0) returned 1 [0032.269] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478")) returned 1 [0032.269] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk") returned 0 [0032.269] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.270] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0x4d0, lpOverlapped=0x0) returned 1 [0032.271] CloseHandle (hObject=0xe0) returned 1 [0032.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.273] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4cc [0032.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4d4) returned 0x259e70 [0032.273] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x4cc, lpOverlapped=0x0) returned 1 [0032.274] CloseHandle (hObject=0xe0) returned 1 [0032.274] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 1 [0032.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.275] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.275] GetTickCount () returned 0x18c66 [0032.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c740 [0032.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c778 [0032.275] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.276] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478\\....\\temporaryfile")) returned 0 [0032.276] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478\\temporaryfile")) returned 1 [0032.277] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7e0 [0032.277] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.277] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.277] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c778 [0032.277] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.277] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.277] FindClose (in: hFindFile=0x25c778 | out: hFindFile=0x25c778) returned 1 [0032.278] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478\\temporaryfile")) returned 1 [0032.278] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184d50e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184d50e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184d50e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.278] FindClose (in: hFindFile=0x25c7e0 | out: hFindFile=0x25c7e0) returned 1 [0032.278] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101478" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101478")) returned 1 [0032.278] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk") returned 0 [0032.278] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.279] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0x4d0, lpOverlapped=0x0) returned 1 [0032.280] CloseHandle (hObject=0xe0) returned 1 [0032.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.280] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x60b [0032.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x613) returned 0x259e70 [0032.280] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x60b, lpOverlapped=0x0) returned 1 [0032.281] CloseHandle (hObject=0xe0) returned 1 [0032.281] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 1 [0032.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.282] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.282] GetTickCount () returned 0x18c76 [0032.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a490 [0032.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a4c8 [0032.283] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.283] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494\\....\\temporaryfile")) returned 0 [0032.283] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494\\temporaryfile")) returned 1 [0032.284] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a4c8 [0032.284] FindNextFileA (in: hFindFile=0x25a4c8, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.284] FindNextFileA (in: hFindFile=0x25a4c8, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.285] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4e4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c740 [0032.285] FindNextFileA (in: hFindFile=0x25c740, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.285] FindNextFileA (in: hFindFile=0x25c740, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.285] FindClose (in: hFindFile=0x25c740 | out: hFindFile=0x25c740) returned 1 [0032.285] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494\\temporaryfile")) returned 1 [0032.285] FindNextFileA (in: hFindFile=0x25a4c8, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.285] FindClose (in: hFindFile=0x25a4c8 | out: hFindFile=0x25a4c8) returned 1 [0032.285] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494")) returned 1 [0032.285] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk") returned 0 [0032.285] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.286] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0x610, lpOverlapped=0x0) returned 1 [0032.287] CloseHandle (hObject=0xe0) returned 1 [0032.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.288] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x60b [0032.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x613) returned 0x259e70 [0032.288] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x60b, lpOverlapped=0x0) returned 1 [0032.290] CloseHandle (hObject=0xe0) returned 1 [0032.290] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 1 [0032.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.290] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.291] GetTickCount () returned 0x18c76 [0032.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a490 [0032.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a4c8 [0032.291] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.294] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494\\....\\temporaryfile")) returned 0 [0032.294] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494\\temporaryfile")) returned 1 [0032.308] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a4c8 [0032.308] FindNextFileA (in: hFindFile=0x25a4c8, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.308] FindNextFileA (in: hFindFile=0x25a4c8, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.308] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4e4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7c8 [0032.308] FindNextFileA (in: hFindFile=0x25c7c8, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.309] FindNextFileA (in: hFindFile=0x25c7c8, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.309] FindClose (in: hFindFile=0x25c7c8 | out: hFindFile=0x25c7c8) returned 1 [0032.309] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494\\temporaryfile")) returned 1 [0032.309] FindNextFileA (in: hFindFile=0x25a4c8, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x184fb240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x184fb240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x184fb240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.309] FindClose (in: hFindFile=0x25a4c8 | out: hFindFile=0x25a4c8) returned 1 [0032.309] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101494" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101494")) returned 1 [0032.309] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk") returned 0 [0032.309] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.310] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0x610, lpOverlapped=0x0) returned 1 [0032.312] CloseHandle (hObject=0xe0) returned 1 [0032.312] FindClose (in: hFindFile=0x25c8a0 | out: hFindFile=0x25c8a0) returned 1 [0032.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x185213a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x185213a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c828 [0032.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0032.313] FindClose (in: hFindFile=0x25c828 | out: hFindFile=0x25c828) returned 1 [0032.313] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0032.313] FindClose (in: hFindFile=0x25c5d0 | out: hFindFile=0x25c5d0) returned 1 [0032.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b77470, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x25c5d0 [0032.322] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b77470, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 1 [0032.322] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b77470, dwReserved1=0x1d2dd9e, cFileName="Low", cAlternateFileName="")) returned 1 [0032.322] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b77470, dwReserved1=0x1d2dd9e, cFileName="Low", cAlternateFileName="")) returned 0 [0032.322] FindClose (in: hFindFile=0x25c5d0 | out: hFindFile=0x25c5d0) returned 1 [0032.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b77470, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x25c5d0 [0032.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0032.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b77470, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0032.323] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b77470, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 1 [0032.323] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b77470, dwReserved1=0x1d2dd9e, cFileName="65UX3YG0", cAlternateFileName="")) returned 1 [0032.323] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b77470, dwReserved1=0x1d2dd9e, cFileName="AY721QDR", cAlternateFileName="")) returned 1 [0032.323] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b77470, dwReserved1=0x1d2dd9e, cFileName="DZBKZBIC", cAlternateFileName="")) returned 1 [0032.323] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x54b77470, dwReserved1=0x1d2dd9e, cFileName="index.dat", cAlternateFileName="")) returned 1 [0032.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256198 [0032.323] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.323] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8000 [0032.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8008) returned 0x2649f0 [0032.323] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x8000, lpOverlapped=0x0) returned 1 [0032.325] CloseHandle (hObject=0xdc) returned 1 [0032.325] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat")) returned 1 [0032.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.326] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.326] GetTickCount () returned 0x18ca5 [0032.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c728 [0032.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c760 [0032.327] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101541\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101541\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.327] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101541\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101541\\....\\temporaryfile")) returned 0 [0032.327] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101541\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101541\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101541\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101541\\temporaryfile")) returned 1 [0032.328] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101541\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1856d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1856d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1856d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName=".", cAlternateFileName="")) returned 0x25c7c8 [0032.328] FindNextFileA (in: hFindFile=0x25c7c8, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1856d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1856d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1856d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName="..", cAlternateFileName="")) returned 1 [0032.328] FindNextFileA (in: hFindFile=0x25c7c8, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1856d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1856d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1856d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.328] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101541\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1856d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1856d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1856d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7e4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c760 [0032.328] FindNextFileA (in: hFindFile=0x25c760, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1856d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1856d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1856d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.329] FindNextFileA (in: hFindFile=0x25c760, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1856d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1856d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1856d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.329] FindClose (in: hFindFile=0x25c760 | out: hFindFile=0x25c760) returned 1 [0032.329] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101541\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101541\\temporaryfile")) returned 1 [0032.329] FindNextFileA (in: hFindFile=0x25c7c8, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1856d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1856d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1856d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.329] FindClose (in: hFindFile=0x25c7c8 | out: hFindFile=0x25c7c8) returned 1 [0032.329] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101541" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101541")) returned 1 [0032.329] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat") returned 0 [0032.330] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.330] WriteFile (in: hFile=0xdc, lpBuffer=0x26ca08*, nNumberOfBytesToWrite=0x8008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x26ca08*, lpNumberOfBytesWritten=0x18fdd8*=0x8008, lpOverlapped=0x0) returned 1 [0032.331] CloseHandle (hObject=0xdc) returned 1 [0032.332] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0032.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x1856d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1856d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0032.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0032.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x25c870 [0032.333] FindNextFileA (in: hFindFile=0x25c870, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 1 [0032.333] FindNextFileA (in: hFindFile=0x25c870, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 0 [0032.333] FindClose (in: hFindFile=0x25c870 | out: hFindFile=0x25c870) returned 1 [0032.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x25c920 [0032.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0032.334] FindClose (in: hFindFile=0x25c920 | out: hFindFile=0x25c920) returned 1 [0032.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x25c870 [0032.334] FindNextFileA (in: hFindFile=0x25c870, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 1 [0032.334] FindNextFileA (in: hFindFile=0x25c870, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 0 [0032.334] FindClose (in: hFindFile=0x25c870 | out: hFindFile=0x25c870) returned 1 [0032.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x25c920 [0032.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0032.335] FindClose (in: hFindFile=0x25c920 | out: hFindFile=0x25c920) returned 1 [0032.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x25c870 [0032.335] FindNextFileA (in: hFindFile=0x25c870, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 1 [0032.335] FindNextFileA (in: hFindFile=0x25c870, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 0 [0032.335] FindClose (in: hFindFile=0x25c870 | out: hFindFile=0x25c870) returned 1 [0032.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x25c920 [0032.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0032.335] FindClose (in: hFindFile=0x25c920 | out: hFindFile=0x25c920) returned 1 [0032.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x25c870 [0032.336] FindNextFileA (in: hFindFile=0x25c870, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 1 [0032.336] FindNextFileA (in: hFindFile=0x25c870, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 0 [0032.336] FindClose (in: hFindFile=0x25c870 | out: hFindFile=0x25c870) returned 1 [0032.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54b9d5d0, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x25c920 [0032.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0032.336] FindClose (in: hFindFile=0x25c920 | out: hFindFile=0x25c920) returned 1 [0032.336] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0032.337] FindClose (in: hFindFile=0x25c5d0 | out: hFindFile=0x25c5d0) returned 1 [0032.337] FindClose (in: hFindFile=0x25c618 | out: hFindFile=0x25c618) returned 1 [0032.338] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MMC\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2f5d6350, dwReserved1=0x1d2fa9b, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.339] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2f5d6350, dwReserved1=0x1d2fa9b, cFileName="..", cAlternateFileName="")) returned 1 [0032.339] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2f5d6350, dwReserved1=0x1d2fa9b, cFileName="..", cAlternateFileName="")) returned 0 [0032.339] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.339] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MMC\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2f5d6350, dwReserved1=0x1d2fa9b, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0032.339] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MS Project\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.340] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName="..", cAlternateFileName="")) returned 1 [0032.340] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName="14", cAlternateFileName="")) returned 1 [0032.341] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName="14", cAlternateFileName="")) returned 0 [0032.341] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MS Project\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0032.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MS Project\\14\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.342] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName="..", cAlternateFileName="")) returned 1 [0032.342] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName="1033", cAlternateFileName="")) returned 1 [0032.342] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName="1033", cAlternateFileName="")) returned 0 [0032.342] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.342] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MS Project\\14\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0032.343] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MS Project\\14\\1033\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName=".", cAlternateFileName="")) returned 0x25c5c8 [0032.344] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName="..", cAlternateFileName="")) returned 1 [0032.344] FindNextFileA (in: hFindFile=0x25c5c8, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x8d940a0, dwReserved1=0x1d305fe, cFileName="Global.MPT", cAlternateFileName="")) returned 1 [0032.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x2561c8 [0032.344] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.344] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5f600 [0032.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5f608) returned 0x2649f0 [0032.345] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x5f600, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x5f600, lpOverlapped=0x0) returned 1 [0032.352] CloseHandle (hObject=0xdc) returned 1 [0032.352] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt")) returned 1 [0032.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0032.356] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.356] GetTickCount () returned 0x18cb4 [0032.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0032.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6b0 [0032.356] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101556\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101556\\...."), lpSecurityAttributes=0x256198) returned 1 [0032.357] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MS Project\\14\\1033\\Global.MPT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101556\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101556\\....\\temporaryfile")) returned 0 [0032.357] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101556\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101556\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101556\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101556\\temporaryfile")) returned 1 [0032.358] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101556\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x185937c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x185937c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x185937c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x25c718 [0032.358] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x185937c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x185937c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x185937c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0032.358] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x185937c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x185937c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x185937c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.358] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101556\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x185937c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x185937c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x185937c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6b0 [0032.358] FindNextFileA (in: hFindFile=0x25c6b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x185937c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x185937c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x185937c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.358] FindNextFileA (in: hFindFile=0x25c6b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x185937c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x185937c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x185937c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.358] FindClose (in: hFindFile=0x25c6b0 | out: hFindFile=0x25c6b0) returned 1 [0032.358] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101556\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101556\\temporaryfile")) returned 1 [0032.358] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x185937c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x185937c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x185937c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.358] FindClose (in: hFindFile=0x25c718 | out: hFindFile=0x25c718) returned 1 [0032.358] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101556" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101556")) returned 1 [0032.359] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MS Project\\14\\1033\\Global.MPT") returned 0 [0032.372] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MS Project\\14\\1033\\Global.MPT.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\global.mpt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.373] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4008*, nNumberOfBytesToWrite=0x5f608, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4008*, lpNumberOfBytesWritten=0x18fdd8*=0x5f608, lpOverlapped=0x0) returned 1 [0032.379] CloseHandle (hObject=0xdc) returned 1 [0032.386] FindClose (in: hFindFile=0x25c5c8 | out: hFindFile=0x25c5c8) returned 1 [0032.387] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\MS Project\\14\\1033\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x185b9920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x185b9920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c5c8 [0032.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0032.387] FindClose (in: hFindFile=0x25c5c8 | out: hFindFile=0x25c5c8) returned 1 [0032.387] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.387] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.387] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.387] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.387] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0032.387] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0032.388] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.388] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0032.388] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c680 [0032.388] FindNextFileA (in: hFindFile=0x25c680, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.388] FindNextFileA (in: hFindFile=0x25c680, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName="Pbk", cAlternateFileName="")) returned 1 [0032.388] FindNextFileA (in: hFindFile=0x25c680, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName="Pbk", cAlternateFileName="")) returned 0 [0032.388] FindClose (in: hFindFile=0x25c680 | out: hFindFile=0x25c680) returned 1 [0032.388] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c680 [0032.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0032.388] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\Connections\\Pbk\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c630 [0032.395] FindNextFileA (in: hFindFile=0x25c630, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.395] FindNextFileA (in: hFindFile=0x25c630, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1 [0032.395] FindNextFileA (in: hFindFile=0x25c630, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0 [0032.395] FindClose (in: hFindFile=0x25c630 | out: hFindFile=0x25c630) returned 1 [0032.396] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\Connections\\Pbk\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c630 [0032.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0032.396] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c5d0 [0032.396] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.396] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31a325d0, dwReserved1=0x1d2dd9c, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1 [0032.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256198 [0032.396] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.396] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x0 [0032.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9b0 [0032.396] ReadFile (in: hFile=0xe0, lpBuffer=0x25c9b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25c9b8*, lpNumberOfBytesRead=0x18fdd0*=0x0, lpOverlapped=0x0) returned 1 [0032.396] CloseHandle (hObject=0xe0) returned 1 [0032.397] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk")) returned 1 [0032.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561f8 [0032.398] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.398] GetTickCount () returned 0x18ce3 [0032.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0032.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c7a0 [0032.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c7d8 [0032.398] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101603\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101603\\...."), lpSecurityAttributes=0x2561f8) returned 1 [0032.398] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101603\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101603\\....\\temporaryfile")) returned 0 [0032.398] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101603\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101603\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101603\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101603\\temporaryfile")) returned 1 [0032.399] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101603\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18605be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18605be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18605be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName=".", cAlternateFileName="")) returned 0x25c840 [0032.400] FindNextFileA (in: hFindFile=0x25c840, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18605be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18605be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18605be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName="..", cAlternateFileName="")) returned 1 [0032.400] FindNextFileA (in: hFindFile=0x25c840, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18605be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18605be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18605be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.400] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101603\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18605be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18605be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18605be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c85c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7d8 [0032.400] FindNextFileA (in: hFindFile=0x25c7d8, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18605be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18605be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18605be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c85c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.400] FindNextFileA (in: hFindFile=0x25c7d8, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18605be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18605be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18605be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c85c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.400] FindClose (in: hFindFile=0x25c7d8 | out: hFindFile=0x25c7d8) returned 1 [0032.400] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101603\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101603\\temporaryfile")) returned 1 [0032.400] FindNextFileA (in: hFindFile=0x25c840, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18605be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18605be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18605be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.400] FindClose (in: hFindFile=0x25c840 | out: hFindFile=0x25c840) returned 1 [0032.400] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101603" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101603")) returned 1 [0032.401] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk") returned 0 [0032.401] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0032.401] WriteFile (in: hFile=0xe0, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fdb8*=0x0, lpOverlapped=0x0) returned 1 [0032.401] CloseHandle (hObject=0xe0) returned 1 [0032.402] FindClose (in: hFindFile=0x25c5d0 | out: hFindFile=0x25c5d0) returned 1 [0032.402] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x18605be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18605be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c5d0 [0032.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0032.402] FindClose (in: hFindFile=0x25c5d0 | out: hFindFile=0x25c5d0) returned 1 [0032.402] FindClose (in: hFindFile=0x25c630 | out: hFindFile=0x25c630) returned 1 [0032.402] FindClose (in: hFindFile=0x25c680 | out: hFindFile=0x25c680) returned 1 [0032.402] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.402] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43c8ae30, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.405] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43c8ae30, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0032.405] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ce7b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f6ce7b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f6ce7b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x43c8ae30, dwReserved1=0x1d2dda4, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0032.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561e0 [0032.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.417] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x9382 [0032.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x938a) returned 0x2659f8 [0032.417] ReadFile (in: hFile=0xd4, lpBuffer=0x265a00, nNumberOfBytesToRead=0x9382, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x265a00*, lpNumberOfBytesRead=0x18fe30*=0x9382, lpOverlapped=0x0) returned 1 [0032.419] CloseHandle (hObject=0xd4) returned 1 [0032.419] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl")) returned 1 [0032.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.420] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.420] GetTickCount () returned 0x18d02 [0032.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0032.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595d8 [0032.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5b0 [0032.421] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.421] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634\\....\\temporaryfile")) returned 0 [0032.421] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634\\temporaryfile")) returned 1 [0032.422] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x25c618 [0032.422] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0032.422] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.422] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c634, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5b0 [0032.422] FindNextFileA (in: hFindFile=0x25c5b0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c634, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.422] FindNextFileA (in: hFindFile=0x25c5b0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c634, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.422] FindClose (in: hFindFile=0x25c5b0 | out: hFindFile=0x25c5b0) returned 1 [0032.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634\\temporaryfile")) returned 1 [0032.423] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163c74, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.423] FindClose (in: hFindFile=0x25c618 | out: hFindFile=0x25c618) returned 1 [0032.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634")) returned 1 [0032.423] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\MSO1033.acl") returned 0 [0032.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\MSO1033.acl.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\mso1033.acl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.425] WriteFile (in: hFile=0xd4, lpBuffer=0x26ed98*, nNumberOfBytesToWrite=0x9388, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x26ed98*, lpNumberOfBytesWritten=0x18fe18*=0x9388, lpOverlapped=0x0) returned 1 [0032.426] CloseHandle (hObject=0xd4) returned 1 [0032.427] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.427] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0032.427] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5dae0390, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0032.428] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5dae0390, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0032.428] FindNextFileA (in: hFindFile=0x2595d8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90b3d80, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x5dae0390, dwReserved1=0x1d2dda4, cFileName="Global.LNK", cAlternateFileName="")) returned 1 [0032.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x2561e0 [0032.429] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.429] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x59a [0032.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5a2) returned 0x259e70 [0032.429] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x59a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x59a, lpOverlapped=0x0) returned 1 [0032.430] CloseHandle (hObject=0xd8) returned 1 [0032.430] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk")) returned 1 [0032.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.431] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.431] GetTickCount () returned 0x18d02 [0032.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0032.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0032.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a420 [0032.432] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634\\....\\temporaryfile")) returned 0 [0032.433] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634\\temporaryfile")) returned 1 [0032.434] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x25a488 [0032.434] FindNextFileA (in: hFindFile=0x25a488, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0032.434] FindNextFileA (in: hFindFile=0x25a488, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.434] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a4c8 [0032.434] FindNextFileA (in: hFindFile=0x25a4c8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.434] FindNextFileA (in: hFindFile=0x25a4c8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a4a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.434] FindClose (in: hFindFile=0x25a4c8 | out: hFindFile=0x25a4c8) returned 1 [0032.434] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634\\temporaryfile")) returned 1 [0032.434] FindNextFileA (in: hFindFile=0x25a488, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18651ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18651ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18651ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.434] FindClose (in: hFindFile=0x25a488 | out: hFindFile=0x25a488) returned 1 [0032.434] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101634" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101634")) returned 1 [0032.435] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\Global.LNK") returned 0 [0032.435] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\Global.LNK.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.435] WriteFile (in: hFile=0xd8, lpBuffer=0x260598*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x260598*, lpNumberOfBytesWritten=0x18fdf8*=0x5a0, lpOverlapped=0x0) returned 1 [0032.436] CloseHandle (hObject=0xd8) returned 1 [0032.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.438] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x34 [0032.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3c) returned 0x257a10 [0032.438] ReadFile (in: hFile=0xd8, lpBuffer=0x257a18, nNumberOfBytesToRead=0x34, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x257a18*, lpNumberOfBytesRead=0x18fe10*=0x34, lpOverlapped=0x0) returned 1 [0032.439] CloseHandle (hObject=0xd8) returned 1 [0032.439] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat")) returned 1 [0032.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.440] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.440] GetTickCount () returned 0x18d12 [0032.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0032.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0032.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c610 [0032.440] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.441] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650\\....\\temporaryfile")) returned 0 [0032.441] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650\\temporaryfile")) returned 1 [0032.442] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18678000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18678000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18678000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c678 [0032.442] FindNextFileA (in: hFindFile=0x25c678, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18678000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18678000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18678000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.442] FindNextFileA (in: hFindFile=0x25c678, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18678000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18678000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18678000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.442] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18678000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18678000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18678000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c694, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.442] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18678000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18678000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18678000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c694, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.442] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18678000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18678000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18678000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c694, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.442] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.442] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650\\temporaryfile")) returned 1 [0032.442] FindNextFileA (in: hFindFile=0x25c678, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18678000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18678000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18678000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.442] FindClose (in: hFindFile=0x25c678 | out: hFindFile=0x25c678) returned 1 [0032.443] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650")) returned 1 [0032.443] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\index.dat") returned 0 [0032.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\index.dat.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.446] WriteFile (in: hFile=0xd8, lpBuffer=0x257a60*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x257a60*, lpNumberOfBytesWritten=0x18fdf8*=0x38, lpOverlapped=0x0) returned 1 [0032.447] CloseHandle (hObject=0xd8) returned 1 [0032.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.448] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x472 [0032.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x47a) returned 0x259e70 [0032.448] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x472, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x472, lpOverlapped=0x0) returned 1 [0032.450] CloseHandle (hObject=0xd8) returned 1 [0032.450] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk")) returned 1 [0032.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.451] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.451] GetTickCount () returned 0x18d12 [0032.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0032.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259580 [0032.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25a2f8 [0032.451] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.452] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650\\....\\temporaryfile")) returned 0 [0032.452] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650\\temporaryfile")) returned 1 [0032.453] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1869e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1869e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1869e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a360 [0032.453] FindNextFileA (in: hFindFile=0x25a360, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1869e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1869e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1869e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.453] FindNextFileA (in: hFindFile=0x25a360, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1869e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1869e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1869e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.453] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1869e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1869e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1869e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a37c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25a2f8 [0032.453] FindNextFileA (in: hFindFile=0x25a2f8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1869e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1869e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1869e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a37c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.453] FindNextFileA (in: hFindFile=0x25a2f8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1869e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1869e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1869e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25a37c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.453] FindClose (in: hFindFile=0x25a2f8 | out: hFindFile=0x25a2f8) returned 1 [0032.453] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650\\temporaryfile")) returned 1 [0032.454] FindNextFileA (in: hFindFile=0x25a360, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1869e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1869e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1869e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.454] FindClose (in: hFindFile=0x25a360 | out: hFindFile=0x25a360) returned 1 [0032.454] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101650" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101650")) returned 1 [0032.454] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\Templates.LNK") returned 0 [0032.454] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\Templates.LNK.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.454] WriteFile (in: hFile=0xd8, lpBuffer=0x260598*, nNumberOfBytesToWrite=0x478, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x260598*, lpNumberOfBytesWritten=0x18fdf8*=0x478, lpOverlapped=0x0) returned 1 [0032.455] CloseHandle (hObject=0xd8) returned 1 [0032.456] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0032.456] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Office\\Recent\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x1869e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1869e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x2595d8 [0032.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0032.456] FindClose (in: hFindFile=0x2595d8 | out: hFindFile=0x2595d8) returned 1 [0032.456] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.457] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c734300, dwReserved1=0x1d2fad7, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.465] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c734300, dwReserved1=0x1d2fad7, cFileName="..", cAlternateFileName="")) returned 1 [0032.465] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5e0c9040, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x5c734300, dwReserved1=0x1d2fad7, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0032.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561e0 [0032.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.467] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xa00 [0032.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa08) returned 0x25f588 [0032.467] ReadFile (in: hFile=0xd4, lpBuffer=0x25f590, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x25f590*, lpNumberOfBytesRead=0x18fe30*=0xa00, lpOverlapped=0x0) returned 1 [0032.468] CloseHandle (hObject=0xd4) returned 1 [0032.468] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs")) returned 1 [0032.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.469] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.469] GetTickCount () returned 0x18d31 [0032.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0032.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0032.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5a8 [0032.470] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101681\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101681\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.470] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101681\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101681\\....\\temporaryfile")) returned 0 [0032.470] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101681\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101681\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101681\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101681\\temporaryfile")) returned 1 [0032.471] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101681\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186c42c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186c42c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186c42c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x65, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.471] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186c42c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186c42c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186c42c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x65, cFileName="..", cAlternateFileName="")) returned 1 [0032.472] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186c42c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186c42c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186c42c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x65, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.472] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101681\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186c42c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186c42c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186c42c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5a8 [0032.472] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186c42c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186c42c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186c42c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.472] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186c42c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186c42c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186c42c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.472] FindClose (in: hFindFile=0x25c5a8 | out: hFindFile=0x25c5a8) returned 1 [0032.472] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101681\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101681\\temporaryfile")) returned 1 [0032.472] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186c42c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186c42c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186c42c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x65, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.472] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.472] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101681" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101681")) returned 1 [0032.472] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\Outlook.srs") returned 0 [0032.473] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\Outlook.srs.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.473] WriteFile (in: hFile=0xd4, lpBuffer=0x25ffa0*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x25ffa0*, lpNumberOfBytesWritten=0x18fe18*=0xa08, lpOverlapped=0x0) returned 1 [0032.474] CloseHandle (hObject=0xd4) returned 1 [0032.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.475] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x9a2 [0032.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9aa) returned 0x25f588 [0032.475] ReadFile (in: hFile=0xd4, lpBuffer=0x25f590, nNumberOfBytesToRead=0x9a2, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x25f590*, lpNumberOfBytesRead=0x18fe30*=0x9a2, lpOverlapped=0x0) returned 1 [0032.482] CloseHandle (hObject=0xd4) returned 1 [0032.482] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml")) returned 1 [0032.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.483] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.483] GetTickCount () returned 0x18d41 [0032.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0032.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0032.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5a8 [0032.484] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101697\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101697\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.484] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101697\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101697\\....\\temporaryfile")) returned 0 [0032.484] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101697\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101697\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101697\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101697\\temporaryfile")) returned 1 [0032.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101697\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186ea420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186ea420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186ea420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.485] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186ea420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186ea420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186ea420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.485] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186ea420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186ea420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186ea420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101697\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186ea420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186ea420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186ea420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5a8 [0032.485] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186ea420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186ea420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186ea420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.485] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186ea420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186ea420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186ea420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.485] FindClose (in: hFindFile=0x25c5a8 | out: hFindFile=0x25c5a8) returned 1 [0032.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101697\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101697\\temporaryfile")) returned 1 [0032.486] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x186ea420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x186ea420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186ea420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.486] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101697" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101697")) returned 1 [0032.486] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\Outlook.xml") returned 0 [0032.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\Outlook.xml.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.487] WriteFile (in: hFile=0xd4, lpBuffer=0x25ff48*, nNumberOfBytesToWrite=0x9a8, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x25ff48*, lpNumberOfBytesWritten=0x18fe18*=0x9a8, lpOverlapped=0x0) returned 1 [0032.487] CloseHandle (hObject=0xd4) returned 1 [0032.488] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.488] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x186ea420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x186ea420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0032.488] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.488] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\PowerPoint\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33c0ebb0, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.492] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33c0ebb0, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0032.492] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33c0ebb0, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 0 [0032.492] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.492] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\PowerPoint\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33c0ebb0, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0032.492] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.492] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Proof\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x510b16f0, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.496] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x510b16f0, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0032.496] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x510b16f0, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 0 [0032.496] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.496] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Proof\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x510b16f0, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0032.496] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.497] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.497] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.497] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0032.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.498] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x138 [0032.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x140) returned 0x25c570 [0032.498] ReadFile (in: hFile=0xd4, lpBuffer=0x25c578, nNumberOfBytesToRead=0x138, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe30*=0x138, lpOverlapped=0x0) returned 1 [0032.499] CloseHandle (hObject=0xd4) returned 1 [0032.499] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist")) returned 1 [0032.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.500] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.500] GetTickCount () returned 0x18d50 [0032.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0032.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c6b8 [0032.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6f0 [0032.501] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.501] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712\\....\\temporaryfile")) returned 0 [0032.501] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712\\temporaryfile")) returned 1 [0032.502] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x25c758 [0032.502] FindNextFileA (in: hFindFile=0x25c758, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0032.502] FindNextFileA (in: hFindFile=0x25c758, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.502] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c774, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6f0 [0032.503] FindNextFileA (in: hFindFile=0x25c6f0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c774, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.503] FindNextFileA (in: hFindFile=0x25c6f0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c774, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.503] FindClose (in: hFindFile=0x25c6f0 | out: hFindFile=0x25c6f0) returned 1 [0032.503] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712\\temporaryfile")) returned 1 [0032.503] FindNextFileA (in: hFindFile=0x25c758, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.503] FindClose (in: hFindFile=0x25c758 | out: hFindFile=0x25c758) returned 1 [0032.503] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712")) returned 1 [0032.503] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\CREDHIST") returned 0 [0032.503] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\CREDHIST.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.504] WriteFile (in: hFile=0xd4, lpBuffer=0x25c720*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x25c720*, lpNumberOfBytesWritten=0x18fe18*=0x140, lpOverlapped=0x0) returned 1 [0032.505] CloseHandle (hObject=0xd4) returned 1 [0032.505] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.506] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x4c [0032.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54) returned 0x25c570 [0032.506] ReadFile (in: hFile=0xd4, lpBuffer=0x25c578, nNumberOfBytesToRead=0x4c, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe30*=0x4c, lpOverlapped=0x0) returned 1 [0032.507] CloseHandle (hObject=0xd4) returned 1 [0032.507] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist")) returned 1 [0032.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.508] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.508] GetTickCount () returned 0x18d50 [0032.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0032.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5d0 [0032.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c608 [0032.508] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.509] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712\\....\\temporaryfile")) returned 0 [0032.509] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712\\temporaryfile")) returned 1 [0032.510] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c670 [0032.510] FindNextFileA (in: hFindFile=0x25c670, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.510] FindNextFileA (in: hFindFile=0x25c670, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.510] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c68c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c608 [0032.510] FindNextFileA (in: hFindFile=0x25c608, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c68c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.511] FindNextFileA (in: hFindFile=0x25c608, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c68c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.511] FindClose (in: hFindFile=0x25c608 | out: hFindFile=0x25c608) returned 1 [0032.511] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712\\temporaryfile")) returned 1 [0032.511] FindNextFileA (in: hFindFile=0x25c670, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18710580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.511] FindClose (in: hFindFile=0x25c670 | out: hFindFile=0x25c670) returned 1 [0032.511] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101712" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101712")) returned 1 [0032.511] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\SYNCHIST") returned 0 [0032.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\SYNCHIST.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.512] WriteFile (in: hFile=0xd4, lpBuffer=0x25c638*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x25c638*, lpNumberOfBytesWritten=0x18fe18*=0x50, lpOverlapped=0x0) returned 1 [0032.513] CloseHandle (hObject=0xd4) returned 1 [0032.513] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x18710580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18710580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0032.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c6d8 [0032.516] FindNextFileA (in: hFindFile=0x25c6d8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.516] FindNextFileA (in: hFindFile=0x25c6d8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0032.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25) returned 0x259688 [0032.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.516] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1d4 [0032.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1dc) returned 0x25c718 [0032.516] ReadFile (in: hFile=0xd8, lpBuffer=0x25c720, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c720*, lpNumberOfBytesRead=0x18fe10*=0x1d4, lpOverlapped=0x0) returned 1 [0032.517] CloseHandle (hObject=0xd8) returned 1 [0032.517] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9")) returned 1 [0032.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.518] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.518] GetTickCount () returned 0x18d60 [0032.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595f8 [0032.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c688 [0032.519] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.519] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728\\....\\temporaryfile")) returned 0 [0032.519] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728\\temporaryfile")) returned 1 [0032.520] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1e, cFileName=".", cAlternateFileName="")) returned 0x25c688 [0032.520] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1e, cFileName="..", cAlternateFileName="")) returned 1 [0032.520] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1e, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.520] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c900 [0032.521] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.521] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.521] FindClose (in: hFindFile=0x25c900 | out: hFindFile=0x25c900) returned 1 [0032.521] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728\\temporaryfile")) returned 1 [0032.521] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1e, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.521] FindClose (in: hFindFile=0x25c688 | out: hFindFile=0x25c688) returned 1 [0032.521] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728")) returned 1 [0032.521] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9") returned 0 [0032.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.522] WriteFile (in: hFile=0xd8, lpBuffer=0x259f20*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259f20*, lpNumberOfBytesWritten=0x18fdf8*=0x1d8, lpOverlapped=0x0) returned 1 [0032.523] CloseHandle (hObject=0xd8) returned 1 [0032.523] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.525] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x18 [0032.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x255c70 [0032.525] ReadFile (in: hFile=0xd8, lpBuffer=0x255c78, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x255c78*, lpNumberOfBytesRead=0x18fe10*=0x18, lpOverlapped=0x0) returned 1 [0032.526] CloseHandle (hObject=0xd8) returned 1 [0032.526] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred")) returned 1 [0032.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.527] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.527] GetTickCount () returned 0x18d60 [0032.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0032.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595f8 [0032.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c670 [0032.527] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.528] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728\\....\\temporaryfile")) returned 0 [0032.528] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728\\temporaryfile")) returned 1 [0032.529] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c718 [0032.529] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.529] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.529] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c670 [0032.530] FindNextFileA (in: hFindFile=0x25c670, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.530] FindNextFileA (in: hFindFile=0x25c670, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.530] FindClose (in: hFindFile=0x25c670 | out: hFindFile=0x25c670) returned 1 [0032.530] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728\\temporaryfile")) returned 1 [0032.530] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187366e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187366e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187366e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.530] FindClose (in: hFindFile=0x25c718 | out: hFindFile=0x25c718) returned 1 [0032.530] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101728" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101728")) returned 1 [0032.530] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred") returned 0 [0032.530] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.531] WriteFile (in: hFile=0xd8, lpBuffer=0x259690*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259690*, lpNumberOfBytesWritten=0x18fdf8*=0x20, lpOverlapped=0x0) returned 1 [0032.532] CloseHandle (hObject=0xd8) returned 1 [0032.532] FindClose (in: hFindFile=0x25c6d8 | out: hFindFile=0x25c6d8) returned 1 [0032.532] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1875c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1875c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c6d8 [0032.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0032.533] FindClose (in: hFindFile=0x25c6d8 | out: hFindFile=0x25c6d8) returned 1 [0032.533] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x541f1c70, dwReserved1=0x1d2dd9e, cFileName=".", cAlternateFileName="")) returned 0x25c6d8 [0032.544] FindNextFileA (in: hFindFile=0x25c6d8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x541f1c70, dwReserved1=0x1d2dd9e, cFileName="..", cAlternateFileName="")) returned 1 [0032.545] FindNextFileA (in: hFindFile=0x25c6d8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x541f1c70, dwReserved1=0x1d2dd9e, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 1 [0032.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25) returned 0x259688 [0032.545] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.546] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1d4 [0032.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1dc) returned 0x25c718 [0032.546] ReadFile (in: hFile=0xd8, lpBuffer=0x25c720, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c720*, lpNumberOfBytesRead=0x18fe10*=0x1d4, lpOverlapped=0x0) returned 1 [0032.547] CloseHandle (hObject=0xd8) returned 1 [0032.547] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c")) returned 1 [0032.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.548] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.548] GetTickCount () returned 0x18d7f [0032.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0032.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c688 [0032.548] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101759\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101759\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.549] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101759\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101759\\....\\temporaryfile")) returned 0 [0032.549] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101759\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101759\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101759\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101759\\temporaryfile")) returned 1 [0032.550] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101759\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187829a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187829a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187829a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1e, cFileName=".", cAlternateFileName="")) returned 0x25c688 [0032.550] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187829a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187829a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187829a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1e, cFileName="..", cAlternateFileName="")) returned 1 [0032.550] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187829a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187829a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187829a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1e, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.550] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101759\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187829a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187829a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187829a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c900 [0032.550] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187829a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187829a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187829a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.550] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187829a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187829a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187829a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.550] FindClose (in: hFindFile=0x25c900 | out: hFindFile=0x25c900) returned 1 [0032.550] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101759\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101759\\temporaryfile")) returned 1 [0032.551] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187829a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187829a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187829a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1e, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.551] FindClose (in: hFindFile=0x25c688 | out: hFindFile=0x25c688) returned 1 [0032.551] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101759" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101759")) returned 1 [0032.551] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c") returned 0 [0032.551] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.558] WriteFile (in: hFile=0xd8, lpBuffer=0x259f20*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259f20*, lpNumberOfBytesWritten=0x18fdf8*=0x1d8, lpOverlapped=0x0) returned 1 [0032.558] CloseHandle (hObject=0xd8) returned 1 [0032.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.562] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1d4 [0032.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1dc) returned 0x25c718 [0032.562] ReadFile (in: hFile=0xd8, lpBuffer=0x25c720, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c720*, lpNumberOfBytesRead=0x18fe10*=0x1d4, lpOverlapped=0x0) returned 1 [0032.563] CloseHandle (hObject=0xd8) returned 1 [0032.563] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c")) returned 1 [0032.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.564] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.564] GetTickCount () returned 0x18d8f [0032.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0032.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c688 [0032.565] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.565] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775\\....\\temporaryfile")) returned 0 [0032.565] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775\\temporaryfile")) returned 1 [0032.566] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c688 [0032.566] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.566] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.566] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c900 [0032.566] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.566] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.566] FindClose (in: hFindFile=0x25c900 | out: hFindFile=0x25c900) returned 1 [0032.567] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775\\temporaryfile")) returned 1 [0032.567] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.567] FindClose (in: hFindFile=0x25c688 | out: hFindFile=0x25c688) returned 1 [0032.567] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775")) returned 1 [0032.567] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c") returned 0 [0032.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\0e15476d-d8fe-46ca-8099-ebdcf80f637c.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.568] WriteFile (in: hFile=0xd8, lpBuffer=0x259f20*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259f20*, lpNumberOfBytesWritten=0x18fdf8*=0x1d8, lpOverlapped=0x0) returned 1 [0032.569] CloseHandle (hObject=0xd8) returned 1 [0032.569] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.570] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1d4 [0032.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1dc) returned 0x25c718 [0032.570] ReadFile (in: hFile=0xd8, lpBuffer=0x25c720, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c720*, lpNumberOfBytesRead=0x18fe10*=0x1d4, lpOverlapped=0x0) returned 1 [0032.572] CloseHandle (hObject=0xd8) returned 1 [0032.572] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2")) returned 1 [0032.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.573] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.573] GetTickCount () returned 0x18d8f [0032.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0032.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c688 [0032.573] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.574] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775\\....\\temporaryfile")) returned 0 [0032.574] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775\\temporaryfile")) returned 1 [0032.575] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c688 [0032.575] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.575] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.575] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c900 [0032.575] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.575] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.575] FindClose (in: hFindFile=0x25c900 | out: hFindFile=0x25c900) returned 1 [0032.575] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775\\temporaryfile")) returned 1 [0032.576] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187a8b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187a8b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187a8b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.576] FindClose (in: hFindFile=0x25c688 | out: hFindFile=0x25c688) returned 1 [0032.576] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101775" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101775")) returned 1 [0032.576] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2") returned 0 [0032.576] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\102a7bc8-3f85-4bb4-840a-38257d2965d2.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.577] WriteFile (in: hFile=0xd8, lpBuffer=0x259f20*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259f20*, lpNumberOfBytesWritten=0x18fdf8*=0x1d8, lpOverlapped=0x0) returned 1 [0032.578] CloseHandle (hObject=0xd8) returned 1 [0032.578] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.586] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1d4 [0032.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1dc) returned 0x25c718 [0032.586] ReadFile (in: hFile=0xd8, lpBuffer=0x25c720, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c720*, lpNumberOfBytesRead=0x18fe10*=0x1d4, lpOverlapped=0x0) returned 1 [0032.587] CloseHandle (hObject=0xd8) returned 1 [0032.587] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d")) returned 1 [0032.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.588] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.588] GetTickCount () returned 0x18d9e [0032.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0032.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c688 [0032.589] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101790\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101790\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.589] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101790\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101790\\....\\temporaryfile")) returned 0 [0032.589] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101790\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101790\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101790\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101790\\temporaryfile")) returned 1 [0032.590] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101790\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187cec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187cec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187cec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c688 [0032.590] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187cec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187cec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187cec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.590] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187cec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187cec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187cec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.590] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101790\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187cec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187cec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187cec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c900 [0032.590] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187cec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187cec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187cec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.590] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187cec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187cec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187cec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.590] FindClose (in: hFindFile=0x25c900 | out: hFindFile=0x25c900) returned 1 [0032.591] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101790\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101790\\temporaryfile")) returned 1 [0032.591] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187cec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187cec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187cec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.591] FindClose (in: hFindFile=0x25c688 | out: hFindFile=0x25c688) returned 1 [0032.591] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101790" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101790")) returned 1 [0032.591] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d") returned 0 [0032.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.592] WriteFile (in: hFile=0xd8, lpBuffer=0x259f20*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259f20*, lpNumberOfBytesWritten=0x18fdf8*=0x1d8, lpOverlapped=0x0) returned 1 [0032.593] CloseHandle (hObject=0xd8) returned 1 [0032.594] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.594] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1d4 [0032.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1dc) returned 0x25c718 [0032.594] ReadFile (in: hFile=0xd8, lpBuffer=0x25c720, nNumberOfBytesToRead=0x1d4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c720*, lpNumberOfBytesRead=0x18fe10*=0x1d4, lpOverlapped=0x0) returned 1 [0032.595] CloseHandle (hObject=0xd8) returned 1 [0032.595] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d")) returned 1 [0032.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.596] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.596] GetTickCount () returned 0x18dae [0032.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0032.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c688 [0032.597] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.597] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806\\....\\temporaryfile")) returned 0 [0032.597] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806\\temporaryfile")) returned 1 [0032.598] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c688 [0032.598] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.598] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.598] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c900 [0032.598] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.598] FindNextFileA (in: hFindFile=0x25c900, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6a4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.598] FindClose (in: hFindFile=0x25c900 | out: hFindFile=0x25c900) returned 1 [0032.598] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806\\temporaryfile")) returned 1 [0032.599] FindNextFileA (in: hFindFile=0x25c688, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.599] FindClose (in: hFindFile=0x25c688 | out: hFindFile=0x25c688) returned 1 [0032.599] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806")) returned 1 [0032.599] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d") returned 0 [0032.599] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.599] WriteFile (in: hFile=0xd8, lpBuffer=0x259f20*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259f20*, lpNumberOfBytesWritten=0x18fdf8*=0x1d8, lpOverlapped=0x0) returned 1 [0032.600] CloseHandle (hObject=0xd8) returned 1 [0032.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.601] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x18 [0032.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x255c70 [0032.602] ReadFile (in: hFile=0xd8, lpBuffer=0x255c78, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x255c78*, lpNumberOfBytesRead=0x18fe10*=0x18, lpOverlapped=0x0) returned 1 [0032.602] CloseHandle (hObject=0xd8) returned 1 [0032.602] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred")) returned 1 [0032.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.603] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.603] GetTickCount () returned 0x18dae [0032.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0032.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0032.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c670 [0032.604] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.605] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806\\....\\temporaryfile")) returned 0 [0032.605] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806\\temporaryfile")) returned 1 [0032.606] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c718 [0032.606] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.606] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.606] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c670 [0032.606] FindNextFileA (in: hFindFile=0x25c670, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.606] FindNextFileA (in: hFindFile=0x25c670, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.606] FindClose (in: hFindFile=0x25c670 | out: hFindFile=0x25c670) returned 1 [0032.606] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806\\temporaryfile")) returned 1 [0032.607] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x187f4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.607] FindClose (in: hFindFile=0x25c718 | out: hFindFile=0x25c718) returned 1 [0032.607] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101806" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101806")) returned 1 [0032.607] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred") returned 0 [0032.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.608] WriteFile (in: hFile=0xd8, lpBuffer=0x259690*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259690*, lpNumberOfBytesWritten=0x18fdf8*=0x20, lpOverlapped=0x0) returned 1 [0032.609] CloseHandle (hObject=0xd8) returned 1 [0032.610] FindClose (in: hFindFile=0x25c6d8 | out: hFindFile=0x25c6d8) returned 1 [0032.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x187f4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x187f4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c6d8 [0032.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0032.610] FindClose (in: hFindFile=0x25c6d8 | out: hFindFile=0x25c6d8) returned 1 [0032.610] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43bcc750, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.612] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43bcc750, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0032.612] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43bcc750, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 0 [0032.612] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.612] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43bcc750, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0032.612] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.612] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Publisher Building Blocks\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4bb4c1b0, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x2595e0 [0032.614] FindNextFileA (in: hFindFile=0x2595e0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4bb4c1b0, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0032.614] FindNextFileA (in: hFindFile=0x2595e0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x4bb4c1b0, dwReserved1=0x1d2dda4, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 1 [0032.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11) returned 0x25cd90 [0032.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.615] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xa8 [0032.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0) returned 0x25c570 [0032.615] ReadFile (in: hFile=0xd4, lpBuffer=0x25c578, nNumberOfBytesToRead=0xa8, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe30*=0xa8, lpOverlapped=0x0) returned 1 [0032.616] CloseHandle (hObject=0xd4) returned 1 [0032.616] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml")) returned 1 [0032.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.617] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.617] GetTickCount () returned 0x18dbd [0032.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c628 [0032.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c660 [0032.617] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101821\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101821\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.618] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101821\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101821\\....\\temporaryfile")) returned 0 [0032.618] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101821\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101821\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101821\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101821\\temporaryfile")) returned 1 [0032.619] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101821\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1881af20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1881af20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1881af20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17, cFileName=".", cAlternateFileName="")) returned 0x25c6c8 [0032.619] FindNextFileA (in: hFindFile=0x25c6c8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1881af20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1881af20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1881af20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17, cFileName="..", cAlternateFileName="")) returned 1 [0032.619] FindNextFileA (in: hFindFile=0x25c6c8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1881af20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1881af20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1881af20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.619] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101821\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1881af20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1881af20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1881af20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6e4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c660 [0032.619] FindNextFileA (in: hFindFile=0x25c660, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1881af20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1881af20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1881af20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.619] FindNextFileA (in: hFindFile=0x25c660, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1881af20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1881af20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1881af20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.619] FindClose (in: hFindFile=0x25c660 | out: hFindFile=0x25c660) returned 1 [0032.619] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101821\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101821\\temporaryfile")) returned 1 [0032.620] FindNextFileA (in: hFindFile=0x25c6c8, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1881af20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1881af20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1881af20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x17, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.620] FindClose (in: hFindFile=0x25c6c8 | out: hFindFile=0x25c6c8) returned 1 [0032.620] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101821" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101821")) returned 1 [0032.620] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Publisher Building Blocks\\ContentStore.xml") returned 0 [0032.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.621] WriteFile (in: hFile=0xd4, lpBuffer=0x25c630*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x25c630*, lpNumberOfBytesWritten=0x18fe18*=0xb0, lpOverlapped=0x0) returned 1 [0032.621] CloseHandle (hObject=0xd4) returned 1 [0032.622] FindClose (in: hFindFile=0x2595e0 | out: hFindFile=0x2595e0) returned 1 [0032.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Publisher Building Blocks\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x1881af20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1881af20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x2595e0 [0032.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0032.622] FindClose (in: hFindFile=0x2595e0 | out: hFindFile=0x2595e0) returned 1 [0032.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Speech\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.623] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 1 [0032.623] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName="..", cAlternateFileName="")) returned 0 [0032.623] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Speech\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd72eaa0, dwReserved1=0x1d2dda0, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0032.623] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c618 [0032.624] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.624] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="My", cAlternateFileName="")) returned 1 [0032.624] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="My", cAlternateFileName="")) returned 0 [0032.624] FindClose (in: hFindFile=0x25c618 | out: hFindFile=0x25c618) returned 1 [0032.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c618 [0032.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0032.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c5d0 [0032.624] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.625] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0032.625] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="CRLs", cAlternateFileName="")) returned 1 [0032.625] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="CTLs", cAlternateFileName="")) returned 1 [0032.625] FindNextFileA (in: hFindFile=0x25c5d0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="CTLs", cAlternateFileName="")) returned 0 [0032.625] FindClose (in: hFindFile=0x25c5d0 | out: hFindFile=0x25c5d0) returned 1 [0032.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c5d0 [0032.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0032.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.625] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.625] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 0 [0032.625] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0032.625] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c770 [0032.626] FindNextFileA (in: hFindFile=0x25c770, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.626] FindNextFileA (in: hFindFile=0x25c770, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 0 [0032.626] FindClose (in: hFindFile=0x25c770 | out: hFindFile=0x25c770) returned 1 [0032.626] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c770 [0032.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0032.626] FindClose (in: hFindFile=0x25c770 | out: hFindFile=0x25c770) returned 1 [0032.626] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c770 [0032.626] FindNextFileA (in: hFindFile=0x25c770, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.626] FindNextFileA (in: hFindFile=0x25c770, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 0 [0032.626] FindClose (in: hFindFile=0x25c770 | out: hFindFile=0x25c770) returned 1 [0032.626] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c770 [0032.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0032.627] FindClose (in: hFindFile=0x25c770 | out: hFindFile=0x25c770) returned 1 [0032.627] FindClose (in: hFindFile=0x25c5d0 | out: hFindFile=0x25c5d0) returned 1 [0032.627] FindClose (in: hFindFile=0x25c618 | out: hFindFile=0x25c618) returned 1 [0032.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Templates\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31d42f10, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.628] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31d42f10, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0032.628] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x31d42f10, dwReserved1=0x1d2dda4, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0032.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561c8 [0032.628] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.629] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x509b [0032.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x50a3) returned 0x2649f0 [0032.629] ReadFile (in: hFile=0xd4, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x509b, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe30*=0x509b, lpOverlapped=0x0) returned 1 [0032.637] CloseHandle (hObject=0xd4) returned 1 [0032.637] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm")) returned 1 [0032.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0032.638] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.638] GetTickCount () returned 0x18ddd [0032.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0032.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5a8 [0032.639] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853\\...."), lpSecurityAttributes=0x256198) returned 1 [0032.639] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853\\....\\temporaryfile")) returned 0 [0032.639] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853\\temporaryfile")) returned 1 [0032.640] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.640] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.640] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.640] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5a8 [0032.641] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.641] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.641] FindClose (in: hFindFile=0x25c5a8 | out: hFindFile=0x25c5a8) returned 1 [0032.641] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853\\temporaryfile")) returned 1 [0032.641] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.641] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.641] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853")) returned 1 [0032.641] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Templates\\Normal.dotm") returned 0 [0032.642] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Templates\\Normal.dotm.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\normal.dotm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.642] WriteFile (in: hFile=0xd4, lpBuffer=0x269aa8*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x269aa8*, lpNumberOfBytesWritten=0x18fe18*=0x50a0, lpOverlapped=0x0) returned 1 [0032.644] CloseHandle (hObject=0xd4) returned 1 [0032.644] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Templates\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0032.646] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\UProof\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbab2410, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.647] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbab2410, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0032.647] FindNextFileA (in: hFindFile=0x25c570, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0xbab2410, dwReserved1=0x1d2dda4, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1 [0032.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x2561e0 [0032.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.648] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x2 [0032.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x2561c8 [0032.648] ReadFile (in: hFile=0xd4, lpBuffer=0x2561d0, nNumberOfBytesToRead=0x2, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2561d0*, lpNumberOfBytesRead=0x18fe30*=0x2, lpOverlapped=0x0) returned 1 [0032.649] CloseHandle (hObject=0xd4) returned 1 [0032.649] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic")) returned 1 [0032.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0032.650] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.650] GetTickCount () returned 0x18ddd [0032.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0032.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595d8 [0032.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5b0 [0032.650] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853\\...."), lpSecurityAttributes=0x256198) returned 1 [0032.651] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853\\....\\temporaryfile")) returned 0 [0032.651] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853\\temporaryfile")) returned 1 [0032.652] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x25c618 [0032.652] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0032.652] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.652] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c634, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5b0 [0032.652] FindNextFileA (in: hFindFile=0x25c5b0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c634, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.652] FindNextFileA (in: hFindFile=0x25c5b0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c634, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.653] FindClose (in: hFindFile=0x25c5b0 | out: hFindFile=0x25c5b0) returned 1 [0032.653] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853\\temporaryfile")) returned 1 [0032.653] FindNextFileA (in: hFindFile=0x25c618, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188671e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.653] FindClose (in: hFindFile=0x25c618 | out: hFindFile=0x25c618) returned 1 [0032.653] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101853" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101853")) returned 1 [0032.653] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\UProof\\CUSTOM.DIC") returned 0 [0032.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\UProof\\CUSTOM.DIC.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\custom.dic.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0032.654] WriteFile (in: hFile=0xd4, lpBuffer=0x2561a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2561a0*, lpNumberOfBytesWritten=0x18fe18*=0x8, lpOverlapped=0x0) returned 1 [0032.655] CloseHandle (hObject=0xd4) returned 1 [0032.655] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\UProof\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x188671e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188671e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c570 [0032.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0032.656] FindClose (in: hFindFile=0x25c570 | out: hFindFile=0x25c570) returned 1 [0032.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Cookies", cAlternateFileName="")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xec6a030, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xec6a030, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Recent", cAlternateFileName="")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="SendTo", cAlternateFileName="")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Themes", cAlternateFileName="")) returned 1 [0032.656] FindNextFileA (in: hFindFile=0x259580, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Themes", cAlternateFileName="")) returned 0 [0032.656] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0032.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x259580 [0032.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0032.657] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c670 [0032.657] FindNextFileA (in: hFindFile=0x25c670, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.657] FindNextFileA (in: hFindFile=0x25c670, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0032.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22) returned 0x259688 [0032.657] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.658] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x53 [0032.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b) returned 0x25c570 [0032.658] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x53, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x53, lpOverlapped=0x0) returned 1 [0032.659] CloseHandle (hObject=0xd8) returned 1 [0032.659] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt")) returned 1 [0032.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.660] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.660] GetTickCount () returned 0x18dec [0032.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5d8 [0032.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c610 [0032.661] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868\\....\\temporaryfile")) returned 0 [0032.661] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868\\temporaryfile")) returned 1 [0032.662] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1888d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1888d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1888d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.662] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1888d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1888d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1888d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0032.662] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1888d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1888d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1888d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.662] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1888d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1888d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1888d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c738 [0032.663] FindNextFileA (in: hFindFile=0x25c738, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1888d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1888d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1888d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.663] FindNextFileA (in: hFindFile=0x25c738, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1888d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1888d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1888d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.663] FindClose (in: hFindFile=0x25c738 | out: hFindFile=0x25c738) returned 1 [0032.663] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868\\temporaryfile")) returned 1 [0032.663] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1888d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1888d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1888d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.663] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.663] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868")) returned 1 [0032.663] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt") returned 0 [0032.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.664] WriteFile (in: hFile=0xd8, lpBuffer=0x25c5e0*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c5e0*, lpNumberOfBytesWritten=0x18fdf8*=0x58, lpOverlapped=0x0) returned 1 [0032.665] CloseHandle (hObject=0xd8) returned 1 [0032.665] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.667] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x227 [0032.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22f) returned 0x25c6b0 [0032.667] ReadFile (in: hFile=0xd8, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fe10*=0x227, lpOverlapped=0x0) returned 1 [0032.668] CloseHandle (hObject=0xd8) returned 1 [0032.668] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt")) returned 1 [0032.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.669] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.669] GetTickCount () returned 0x18dec [0032.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c8e8 [0032.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c920 [0032.669] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.670] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868\\....\\temporaryfile")) returned 0 [0032.670] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868\\temporaryfile")) returned 1 [0032.671] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1888d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c920 [0032.671] FindNextFileA (in: hFindFile=0x25c920, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1888d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.671] FindNextFileA (in: hFindFile=0x25c920, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.671] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c93c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5f8 [0032.671] FindNextFileA (in: hFindFile=0x25c5f8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c93c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.671] FindNextFileA (in: hFindFile=0x25c5f8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c93c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.671] FindClose (in: hFindFile=0x25c5f8 | out: hFindFile=0x25c5f8) returned 1 [0032.671] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868\\temporaryfile")) returned 1 [0032.672] FindNextFileA (in: hFindFile=0x25c920, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.672] FindClose (in: hFindFile=0x25c920 | out: hFindFile=0x25c920) returned 1 [0032.672] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101868" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101868")) returned 1 [0032.672] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt") returned 0 [0032.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.673] WriteFile (in: hFile=0xd8, lpBuffer=0x2625a0*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesWritten=0x18fdf8*=0x230, lpOverlapped=0x0) returned 1 [0032.674] CloseHandle (hObject=0xd8) returned 1 [0032.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.677] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf1 [0032.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf9) returned 0x25c6b0 [0032.677] ReadFile (in: hFile=0xd8, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0xf1, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fe10*=0xf1, lpOverlapped=0x0) returned 1 [0032.677] CloseHandle (hObject=0xd8) returned 1 [0032.678] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt")) returned 1 [0032.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.678] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.678] GetTickCount () returned 0x18dfc [0032.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0032.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5a8 [0032.679] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101884\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101884\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.679] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101884\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101884\\....\\temporaryfile")) returned 0 [0032.680] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101884\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101884\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101884\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101884\\temporaryfile")) returned 1 [0032.694] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101884\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.694] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.694] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.694] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101884\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5a8 [0032.694] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.694] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.694] FindClose (in: hFindFile=0x25c5a8 | out: hFindFile=0x25c5a8) returned 1 [0032.694] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101884\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101884\\temporaryfile")) returned 1 [0032.695] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188b34a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188b34a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188b34a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.695] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.695] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101884" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101884")) returned 1 [0032.695] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt") returned 0 [0032.695] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.696] WriteFile (in: hFile=0xd8, lpBuffer=0x25c7c0*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c7c0*, lpNumberOfBytesWritten=0x18fdf8*=0xf8, lpOverlapped=0x0) returned 1 [0032.697] CloseHandle (hObject=0xd8) returned 1 [0032.697] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.698] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x6f [0032.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x77) returned 0x24f858 [0032.698] ReadFile (in: hFile=0xd8, lpBuffer=0x24f860, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x24f860*, lpNumberOfBytesRead=0x18fe10*=0x6f, lpOverlapped=0x0) returned 1 [0032.699] CloseHandle (hObject=0xd8) returned 1 [0032.699] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt")) returned 1 [0032.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.700] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.700] GetTickCount () returned 0x18e0b [0032.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0032.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5a8 [0032.700] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101899\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101899\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.701] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101899\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101899\\....\\temporaryfile")) returned 0 [0032.701] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101899\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101899\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101899\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101899\\temporaryfile")) returned 1 [0032.702] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101899\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188d9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.702] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188d9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.702] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.702] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101899\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5a8 [0032.702] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.703] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.703] FindClose (in: hFindFile=0x25c5a8 | out: hFindFile=0x25c5a8) returned 1 [0032.703] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101899\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101899\\temporaryfile")) returned 1 [0032.703] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.703] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.703] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101899" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101899")) returned 1 [0032.703] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned 0 [0032.703] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.704] WriteFile (in: hFile=0xd8, lpBuffer=0x25c6b8*, nNumberOfBytesToWrite=0x78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesWritten=0x18fdf8*=0x78, lpOverlapped=0x0) returned 1 [0032.705] CloseHandle (hObject=0xd8) returned 1 [0032.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.706] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x6e [0032.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x76) returned 0x24f8d8 [0032.706] ReadFile (in: hFile=0xd8, lpBuffer=0x24f8e0, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x24f8e0*, lpNumberOfBytesRead=0x18fe10*=0x6e, lpOverlapped=0x0) returned 1 [0032.707] CloseHandle (hObject=0xd8) returned 1 [0032.707] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt")) returned 1 [0032.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.708] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.708] GetTickCount () returned 0x18e1b [0032.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0032.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5a8 [0032.708] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101915\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101915\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.709] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101915\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101915\\....\\temporaryfile")) returned 0 [0032.709] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101915\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101915\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101915\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101915\\temporaryfile")) returned 1 [0032.710] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101915\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.710] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.710] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.710] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101915\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5a8 [0032.710] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.710] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.710] FindClose (in: hFindFile=0x25c5a8 | out: hFindFile=0x25c5a8) returned 1 [0032.711] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101915\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101915\\temporaryfile")) returned 1 [0032.711] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x188ff760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x188ff760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x188ff760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.711] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.711] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101915" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101915")) returned 1 [0032.711] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned 0 [0032.711] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.712] WriteFile (in: hFile=0xd8, lpBuffer=0x25c6b8*, nNumberOfBytesToWrite=0x78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesWritten=0x18fdf8*=0x78, lpOverlapped=0x0) returned 1 [0032.713] CloseHandle (hObject=0xd8) returned 1 [0032.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.715] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x114 [0032.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11c) returned 0x25c6b0 [0032.715] ReadFile (in: hFile=0xd8, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fe10*=0x114, lpOverlapped=0x0) returned 1 [0032.716] CloseHandle (hObject=0xd8) returned 1 [0032.716] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt")) returned 1 [0032.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.717] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.717] GetTickCount () returned 0x18e2b [0032.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0032.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5a8 [0032.717] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.718] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931\\....\\temporaryfile")) returned 0 [0032.718] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931\\temporaryfile")) returned 1 [0032.719] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.719] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.719] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.719] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5a8 [0032.719] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.719] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.719] FindClose (in: hFindFile=0x25c5a8 | out: hFindFile=0x25c5a8) returned 1 [0032.719] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931\\temporaryfile")) returned 1 [0032.720] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.720] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.720] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931")) returned 1 [0032.720] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt") returned 0 [0032.720] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.721] WriteFile (in: hFile=0xd8, lpBuffer=0x25c7e0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c7e0*, lpNumberOfBytesWritten=0x18fdf8*=0x118, lpOverlapped=0x0) returned 1 [0032.721] CloseHandle (hObject=0xd8) returned 1 [0032.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.722] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x56 [0032.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5e) returned 0x25c570 [0032.723] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x56, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x56, lpOverlapped=0x0) returned 1 [0032.723] CloseHandle (hObject=0xd8) returned 1 [0032.723] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt")) returned 1 [0032.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.724] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.724] GetTickCount () returned 0x18e2b [0032.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5d8 [0032.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c610 [0032.725] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.728] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931\\....\\temporaryfile")) returned 0 [0032.728] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931\\temporaryfile")) returned 1 [0032.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.729] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.729] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c738 [0032.729] FindNextFileA (in: hFindFile=0x25c738, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.729] FindNextFileA (in: hFindFile=0x25c738, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.729] FindClose (in: hFindFile=0x25c738 | out: hFindFile=0x25c738) returned 1 [0032.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931\\temporaryfile")) returned 1 [0032.729] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189258c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189258c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189258c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.729] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.730] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101931" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101931")) returned 1 [0032.730] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt") returned 0 [0032.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.730] WriteFile (in: hFile=0xd8, lpBuffer=0x2605b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2605b0*, lpNumberOfBytesWritten=0x18fdf8*=0x60, lpOverlapped=0x0) returned 1 [0032.731] CloseHandle (hObject=0xd8) returned 1 [0032.776] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.777] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x19e [0032.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a6) returned 0x25c6b0 [0032.777] ReadFile (in: hFile=0xd8, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fe10*=0x19e, lpOverlapped=0x0) returned 1 [0032.778] CloseHandle (hObject=0xd8) returned 1 [0032.778] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt")) returned 1 [0032.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.780] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.780] GetTickCount () returned 0x18e69 [0032.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0032.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c5a8 [0032.781] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.781] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993\\....\\temporaryfile")) returned 0 [0032.781] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993\\temporaryfile")) returned 1 [0032.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c610 [0032.783] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.783] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c5a8 [0032.783] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.783] FindNextFileA (in: hFindFile=0x25c5a8, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c62c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.783] FindClose (in: hFindFile=0x25c5a8 | out: hFindFile=0x25c5a8) returned 1 [0032.783] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993\\temporaryfile")) returned 1 [0032.783] FindNextFileA (in: hFindFile=0x25c610, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.783] FindClose (in: hFindFile=0x25c610 | out: hFindFile=0x25c610) returned 1 [0032.783] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993")) returned 1 [0032.784] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned 0 [0032.784] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.784] WriteFile (in: hFile=0xd8, lpBuffer=0x2625a0*, nNumberOfBytesToWrite=0x1a8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesWritten=0x18fdf8*=0x1a8, lpOverlapped=0x0) returned 1 [0032.785] CloseHandle (hObject=0xd8) returned 1 [0032.787] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.787] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x8000 [0032.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8008) returned 0x2649f0 [0032.787] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x8000, lpOverlapped=0x0) returned 1 [0032.788] CloseHandle (hObject=0xd8) returned 1 [0032.788] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")) returned 0 [0032.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0032.788] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.788] GetTickCount () returned 0x18e69 [0032.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0032.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5d0 [0032.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c608 [0032.789] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0032.789] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993\\....\\temporaryfile")) returned 0 [0032.790] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993\\temporaryfile")) returned 1 [0032.791] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6b0 [0032.791] FindNextFileA (in: hFindFile=0x25c6b0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.791] FindNextFileA (in: hFindFile=0x25c6b0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.791] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6cc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c608 [0032.791] FindNextFileA (in: hFindFile=0x25c608, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.791] FindNextFileA (in: hFindFile=0x25c608, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c6cc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.791] FindClose (in: hFindFile=0x25c608 | out: hFindFile=0x25c608) returned 1 [0032.791] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993\\temporaryfile")) returned 1 [0032.791] FindNextFileA (in: hFindFile=0x25c6b0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x189bde40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.791] FindClose (in: hFindFile=0x25c6b0 | out: hFindFile=0x25c6b0) returned 1 [0032.791] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18101993" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18101993")) returned 1 [0032.792] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\index.dat") returned 1 [0032.793] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\index.dat.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0032.793] WriteFile (in: hFile=0xd8, lpBuffer=0x26ca08*, nNumberOfBytesToWrite=0x8008, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x26ca08*, lpNumberOfBytesWritten=0x18fdf8*=0x8008, lpOverlapped=0x0) returned 1 [0032.796] CloseHandle (hObject=0xd8) returned 1 [0032.796] FindClose (in: hFindFile=0x25c670 | out: hFindFile=0x25c670) returned 1 [0032.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x189bde40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x189bde40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x25c670 [0032.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0032.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2bc9ae40, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x25c628 [0032.800] FindNextFileA (in: hFindFile=0x25c628, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2bc9ae40, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0032.810] FindNextFileA (in: hFindFile=0x25c628, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x2bc9ae40, dwReserved1=0x1d2dd9c, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 1 [0032.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x31) returned 0x25c6b0 [0032.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.812] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x66 [0032.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6e) returned 0x25e598 [0032.812] ReadFile (in: hFile=0xdc, lpBuffer=0x25e5a0, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25e5a0*, lpNumberOfBytesRead=0x18fdf0*=0x66, lpOverlapped=0x0) returned 1 [0032.813] CloseHandle (hObject=0xdc) returned 1 [0032.813] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt")) returned 1 [0032.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.814] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.814] GetTickCount () returned 0x18e88 [0032.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c778 [0032.814] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.815] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024\\....\\temporaryfile")) returned 0 [0032.815] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024\\temporaryfile")) returned 1 [0032.816] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName=".", cAlternateFileName="")) returned 0x25c7e0 [0032.816] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="..", cAlternateFileName="")) returned 1 [0032.816] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.816] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c778 [0032.816] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.816] FindNextFileA (in: hFindFile=0x25c778, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c7fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.816] FindClose (in: hFindFile=0x25c778 | out: hFindFile=0x25c778) returned 1 [0032.816] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024\\temporaryfile")) returned 1 [0032.817] FindNextFileA (in: hFindFile=0x25c7e0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.817] FindClose (in: hFindFile=0x25c7e0 | out: hFindFile=0x25c7e0) returned 1 [0032.817] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024")) returned 1 [0032.817] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned 0 [0032.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.818] WriteFile (in: hFile=0xdc, lpBuffer=0x24f860*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x24f860*, lpNumberOfBytesWritten=0x18fdd8*=0x70, lpOverlapped=0x0) returned 1 [0032.818] CloseHandle (hObject=0xdc) returned 1 [0032.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.820] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x66 [0032.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6e) returned 0x25e598 [0032.820] ReadFile (in: hFile=0xdc, lpBuffer=0x25e5a0, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25e5a0*, lpNumberOfBytesRead=0x18fdf0*=0x66, lpOverlapped=0x0) returned 1 [0032.821] CloseHandle (hObject=0xdc) returned 1 [0032.821] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt")) returned 1 [0032.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.822] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.822] GetTickCount () returned 0x18e88 [0032.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c738 [0032.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c770 [0032.822] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.823] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024\\....\\temporaryfile")) returned 0 [0032.823] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024\\temporaryfile")) returned 1 [0032.824] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7d8 [0032.824] FindNextFileA (in: hFindFile=0x25c7d8, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.825] FindNextFileA (in: hFindFile=0x25c7d8, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.825] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2abe, dwReserved1=0x18f5b0, cFileName=".", cAlternateFileName="")) returned 0x25c770 [0032.825] FindNextFileA (in: hFindFile=0x25c770, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2abe, dwReserved1=0x18f5b0, cFileName="..", cAlternateFileName="")) returned 1 [0032.825] FindNextFileA (in: hFindFile=0x25c770, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2abe, dwReserved1=0x18f5b0, cFileName="..", cAlternateFileName="")) returned 0 [0032.825] FindClose (in: hFindFile=0x25c770 | out: hFindFile=0x25c770) returned 1 [0032.826] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024\\temporaryfile")) returned 1 [0032.826] FindNextFileA (in: hFindFile=0x25c7d8, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a0a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a0a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a0a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.826] FindClose (in: hFindFile=0x25c7d8 | out: hFindFile=0x25c7d8) returned 1 [0032.826] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102024" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102024")) returned 1 [0032.826] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned 0 [0032.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.827] WriteFile (in: hFile=0xdc, lpBuffer=0x24f860*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x24f860*, lpNumberOfBytesWritten=0x18fdd8*=0x70, lpOverlapped=0x0) returned 1 [0032.828] CloseHandle (hObject=0xdc) returned 1 [0032.828] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.830] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5d [0032.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x65) returned 0x2605a8 [0032.830] ReadFile (in: hFile=0xdc, lpBuffer=0x2605b0, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2605b0*, lpNumberOfBytesRead=0x18fdf0*=0x5d, lpOverlapped=0x0) returned 1 [0032.831] CloseHandle (hObject=0xdc) returned 1 [0032.831] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt")) returned 1 [0032.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.832] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.832] GetTickCount () returned 0x18e98 [0032.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6b0 [0032.832] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102040\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102040\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.832] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102040\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102040\\....\\temporaryfile")) returned 0 [0032.833] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102040\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102040\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102040\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102040\\temporaryfile")) returned 1 [0032.834] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102040\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a30260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a30260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a30260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c718 [0032.834] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a30260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a30260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a30260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.834] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a30260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a30260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a30260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.834] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102040\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a30260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a30260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a30260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6b0 [0032.834] FindNextFileA (in: hFindFile=0x25c6b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a30260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a30260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a30260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.834] FindNextFileA (in: hFindFile=0x25c6b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a30260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a30260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a30260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.834] FindClose (in: hFindFile=0x25c6b0 | out: hFindFile=0x25c6b0) returned 1 [0032.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102040\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102040\\temporaryfile")) returned 1 [0032.834] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a30260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a30260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a30260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.834] FindClose (in: hFindFile=0x25c718 | out: hFindFile=0x25c718) returned 1 [0032.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102040" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102040")) returned 1 [0032.834] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned 0 [0032.835] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.835] WriteFile (in: hFile=0xdc, lpBuffer=0x25e5a0*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25e5a0*, lpNumberOfBytesWritten=0x18fdd8*=0x68, lpOverlapped=0x0) returned 1 [0032.836] CloseHandle (hObject=0xdc) returned 1 [0032.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.844] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xea [0032.844] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf2) returned 0x25c6b0 [0032.844] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0xea, lpOverlapped=0x0) returned 1 [0032.845] CloseHandle (hObject=0xdc) returned 1 [0032.845] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt")) returned 1 [0032.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.846] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.846] GetTickCount () returned 0x18ea7 [0032.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c7b0 [0032.846] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.847] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055\\....\\temporaryfile")) returned 0 [0032.847] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055\\temporaryfile")) returned 1 [0032.848] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c818 [0032.848] FindNextFileA (in: hFindFile=0x25c818, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.848] FindNextFileA (in: hFindFile=0x25c818, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.848] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c834, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7b0 [0032.848] FindNextFileA (in: hFindFile=0x25c7b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c834, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.848] FindNextFileA (in: hFindFile=0x25c7b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c834, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.848] FindClose (in: hFindFile=0x25c7b0 | out: hFindFile=0x25c7b0) returned 1 [0032.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055\\temporaryfile")) returned 1 [0032.849] FindNextFileA (in: hFindFile=0x25c818, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.849] FindClose (in: hFindFile=0x25c818 | out: hFindFile=0x25c818) returned 1 [0032.849] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055")) returned 1 [0032.849] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt") returned 0 [0032.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.850] WriteFile (in: hFile=0xdc, lpBuffer=0x25c840*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25c840*, lpNumberOfBytesWritten=0x18fdd8*=0xf0, lpOverlapped=0x0) returned 1 [0032.850] CloseHandle (hObject=0xdc) returned 1 [0032.851] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.852] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x242 [0032.852] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24a) returned 0x25c6b0 [0032.852] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0x242, lpOverlapped=0x0) returned 1 [0032.854] CloseHandle (hObject=0xdc) returned 1 [0032.854] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt")) returned 1 [0032.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.855] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.855] GetTickCount () returned 0x18ea7 [0032.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c908 [0032.855] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.856] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055\\....\\temporaryfile")) returned 0 [0032.856] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055\\temporaryfile")) returned 1 [0032.857] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x262598 [0032.857] FindNextFileA (in: hFindFile=0x262598, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.857] FindNextFileA (in: hFindFile=0x262598, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.857] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2625b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c908 [0032.858] FindNextFileA (in: hFindFile=0x25c908, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2625b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.858] FindNextFileA (in: hFindFile=0x25c908, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2625b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.858] FindClose (in: hFindFile=0x25c908 | out: hFindFile=0x25c908) returned 1 [0032.858] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055\\temporaryfile")) returned 1 [0032.858] FindNextFileA (in: hFindFile=0x262598, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a563c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a563c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a563c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.858] FindClose (in: hFindFile=0x262598 | out: hFindFile=0x262598) returned 1 [0032.858] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102055" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102055")) returned 1 [0032.858] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned 0 [0032.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.859] WriteFile (in: hFile=0xdc, lpBuffer=0x2625a0*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesWritten=0x18fdd8*=0x248, lpOverlapped=0x0) returned 1 [0032.860] CloseHandle (hObject=0xdc) returned 1 [0032.860] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.865] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x65 [0032.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6d) returned 0x25e610 [0032.865] ReadFile (in: hFile=0xdc, lpBuffer=0x25e618, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25e618*, lpNumberOfBytesRead=0x18fdf0*=0x65, lpOverlapped=0x0) returned 1 [0032.868] CloseHandle (hObject=0xdc) returned 1 [0032.869] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt")) returned 1 [0032.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.869] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.870] GetTickCount () returned 0x18eb7 [0032.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6b0 [0032.870] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102071\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102071\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.871] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102071\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102071\\....\\temporaryfile")) returned 0 [0032.871] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102071\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102071\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102071\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102071\\temporaryfile")) returned 1 [0032.872] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102071\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a7c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a7c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a7c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c718 [0032.872] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a7c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a7c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a7c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.872] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a7c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a7c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a7c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.872] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102071\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a7c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a7c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a7c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6b0 [0032.873] FindNextFileA (in: hFindFile=0x25c6b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a7c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a7c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a7c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.873] FindNextFileA (in: hFindFile=0x25c6b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a7c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a7c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a7c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.873] FindClose (in: hFindFile=0x25c6b0 | out: hFindFile=0x25c6b0) returned 1 [0032.873] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102071\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102071\\temporaryfile")) returned 1 [0032.873] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18a7c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18a7c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18a7c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.873] FindClose (in: hFindFile=0x25c718 | out: hFindFile=0x25c718) returned 1 [0032.873] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102071" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102071")) returned 1 [0032.873] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt") returned 0 [0032.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.874] WriteFile (in: hFile=0xdc, lpBuffer=0x24f860*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x24f860*, lpNumberOfBytesWritten=0x18fdd8*=0x70, lpOverlapped=0x0) returned 1 [0032.875] CloseHandle (hObject=0xdc) returned 1 [0032.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.876] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x52 [0032.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5a) returned 0x25c6b0 [0032.876] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0x52, lpOverlapped=0x0) returned 1 [0032.877] CloseHandle (hObject=0xdc) returned 1 [0032.877] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt")) returned 1 [0032.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.878] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.878] GetTickCount () returned 0x18ec7 [0032.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c718 [0032.878] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.879] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087\\....\\temporaryfile")) returned 0 [0032.879] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087\\temporaryfile")) returned 1 [0032.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c780 [0032.880] FindNextFileA (in: hFindFile=0x25c780, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.880] FindNextFileA (in: hFindFile=0x25c780, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c79c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c718 [0032.880] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c79c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.880] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c79c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.880] FindClose (in: hFindFile=0x25c718 | out: hFindFile=0x25c718) returned 1 [0032.880] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087\\temporaryfile")) returned 1 [0032.881] FindNextFileA (in: hFindFile=0x25c780, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.881] FindClose (in: hFindFile=0x25c780 | out: hFindFile=0x25c780) returned 1 [0032.881] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087")) returned 1 [0032.881] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned 0 [0032.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.882] WriteFile (in: hFile=0xdc, lpBuffer=0x25c7a8*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25c7a8*, lpNumberOfBytesWritten=0x18fdd8*=0x58, lpOverlapped=0x0) returned 1 [0032.882] CloseHandle (hObject=0xdc) returned 1 [0032.883] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.884] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x125 [0032.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12d) returned 0x25c6b0 [0032.884] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0x125, lpOverlapped=0x0) returned 1 [0032.885] CloseHandle (hObject=0xdc) returned 1 [0032.885] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt")) returned 1 [0032.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.885] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.886] GetTickCount () returned 0x18ec7 [0032.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c7e8 [0032.886] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087\\....\\temporaryfile")) returned 0 [0032.887] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087\\temporaryfile")) returned 1 [0032.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c850 [0032.888] FindNextFileA (in: hFindFile=0x25c850, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.888] FindNextFileA (in: hFindFile=0x25c850, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c86c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c918 [0032.888] FindNextFileA (in: hFindFile=0x25c918, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c86c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.888] FindNextFileA (in: hFindFile=0x25c918, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c86c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.888] FindClose (in: hFindFile=0x25c918 | out: hFindFile=0x25c918) returned 1 [0032.888] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087\\temporaryfile")) returned 1 [0032.889] FindNextFileA (in: hFindFile=0x25c850, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aa2680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aa2680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aa2680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.889] FindClose (in: hFindFile=0x25c850 | out: hFindFile=0x25c850) returned 1 [0032.889] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102087" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102087")) returned 1 [0032.889] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt") returned 0 [0032.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.890] WriteFile (in: hFile=0xdc, lpBuffer=0x2625a0*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesWritten=0x18fdd8*=0x130, lpOverlapped=0x0) returned 1 [0032.890] CloseHandle (hObject=0xdc) returned 1 [0032.891] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.892] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdd [0032.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe5) returned 0x25c6b0 [0032.892] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0xdd, lpOverlapped=0x0) returned 1 [0032.893] CloseHandle (hObject=0xdc) returned 1 [0032.893] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt")) returned 1 [0032.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.894] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.894] GetTickCount () returned 0x18ed6 [0032.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.895] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c7a0 [0032.895] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102\\....\\temporaryfile")) returned 0 [0032.895] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102\\temporaryfile")) returned 1 [0032.896] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ac87e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ac87e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ac87e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c808 [0032.896] FindNextFileA (in: hFindFile=0x25c808, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ac87e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ac87e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ac87e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.896] FindNextFileA (in: hFindFile=0x25c808, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ac87e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ac87e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ac87e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.896] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ac87e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ac87e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ac87e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c824, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c7a0 [0032.897] FindNextFileA (in: hFindFile=0x25c7a0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ac87e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ac87e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ac87e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c824, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.897] FindNextFileA (in: hFindFile=0x25c7a0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ac87e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ac87e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ac87e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c824, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.897] FindClose (in: hFindFile=0x25c7a0 | out: hFindFile=0x25c7a0) returned 1 [0032.897] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102\\temporaryfile")) returned 1 [0032.897] FindNextFileA (in: hFindFile=0x25c808, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ac87e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ac87e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ac87e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.897] FindClose (in: hFindFile=0x25c808 | out: hFindFile=0x25c808) returned 1 [0032.897] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102")) returned 1 [0032.897] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned 0 [0032.897] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.898] WriteFile (in: hFile=0xdc, lpBuffer=0x25c830*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25c830*, lpNumberOfBytesWritten=0x18fdd8*=0xe8, lpOverlapped=0x0) returned 1 [0032.899] CloseHandle (hObject=0xdc) returned 1 [0032.899] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.901] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x201 [0032.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x209) returned 0x25c6b0 [0032.901] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0x201, lpOverlapped=0x0) returned 1 [0032.902] CloseHandle (hObject=0xdc) returned 1 [0032.902] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt")) returned 1 [0032.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.903] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.903] GetTickCount () returned 0x18ed6 [0032.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c8c8 [0032.904] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.904] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102\\....\\temporaryfile")) returned 0 [0032.905] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102\\temporaryfile")) returned 1 [0032.906] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ac87e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c930 [0032.906] FindNextFileA (in: hFindFile=0x25c930, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ac87e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.906] FindNextFileA (in: hFindFile=0x25c930, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.906] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c94c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c8c8 [0032.906] FindNextFileA (in: hFindFile=0x25c8c8, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c94c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.906] FindNextFileA (in: hFindFile=0x25c8c8, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c94c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.906] FindClose (in: hFindFile=0x25c8c8 | out: hFindFile=0x25c8c8) returned 1 [0032.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102\\temporaryfile")) returned 1 [0032.906] FindNextFileA (in: hFindFile=0x25c930, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.906] FindClose (in: hFindFile=0x25c930 | out: hFindFile=0x25c930) returned 1 [0032.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102102" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102102")) returned 1 [0032.906] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned 0 [0032.907] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.907] WriteFile (in: hFile=0xdc, lpBuffer=0x2625a0*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesWritten=0x18fdd8*=0x208, lpOverlapped=0x0) returned 1 [0032.908] CloseHandle (hObject=0xdc) returned 1 [0032.909] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.909] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ea [0032.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f2) returned 0x25c6b0 [0032.909] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x1ea, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0x1ea, lpOverlapped=0x0) returned 1 [0032.910] CloseHandle (hObject=0xdc) returned 1 [0032.910] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt")) returned 1 [0032.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.911] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.911] GetTickCount () returned 0x18ee6 [0032.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c8b0 [0032.912] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102118\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102118\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.912] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102118\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102118\\....\\temporaryfile")) returned 0 [0032.912] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102118\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102118\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102118\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102118\\temporaryfile")) returned 1 [0032.913] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102118\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c918 [0032.913] FindNextFileA (in: hFindFile=0x25c918, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.913] FindNextFileA (in: hFindFile=0x25c918, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.913] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102118\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c934, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c8b0 [0032.913] FindNextFileA (in: hFindFile=0x25c8b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c934, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.913] FindNextFileA (in: hFindFile=0x25c8b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c934, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.914] FindClose (in: hFindFile=0x25c8b0 | out: hFindFile=0x25c8b0) returned 1 [0032.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102118\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102118\\temporaryfile")) returned 1 [0032.914] FindNextFileA (in: hFindFile=0x25c918, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18aee940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18aee940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18aee940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.914] FindClose (in: hFindFile=0x25c918 | out: hFindFile=0x25c918) returned 1 [0032.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102118" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102118")) returned 1 [0032.914] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt") returned 0 [0032.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.915] WriteFile (in: hFile=0xdc, lpBuffer=0x2625a0*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesWritten=0x18fdd8*=0x1f0, lpOverlapped=0x0) returned 1 [0032.916] CloseHandle (hObject=0xdc) returned 1 [0032.916] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.938] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c8 [0032.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d0) returned 0x25c6b0 [0032.938] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0x1c8, lpOverlapped=0x0) returned 1 [0032.939] CloseHandle (hObject=0xdc) returned 1 [0032.939] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt")) returned 1 [0032.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.940] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.940] GetTickCount () returned 0x18f05 [0032.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c888 [0032.941] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102149\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102149\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.941] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102149\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102149\\....\\temporaryfile")) returned 0 [0032.941] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102149\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102149\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102149\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102149\\temporaryfile")) returned 1 [0032.942] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102149\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b3ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b3ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b3ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c8f0 [0032.943] FindNextFileA (in: hFindFile=0x25c8f0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b3ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b3ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b3ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.943] FindNextFileA (in: hFindFile=0x25c8f0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b3ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b3ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b3ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102149\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b3ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b3ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b3ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c90c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c930 [0032.943] FindNextFileA (in: hFindFile=0x25c930, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b3ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b3ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b3ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c90c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.943] FindNextFileA (in: hFindFile=0x25c930, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b3ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b3ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b3ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c90c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.943] FindClose (in: hFindFile=0x25c930 | out: hFindFile=0x25c930) returned 1 [0032.943] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102149\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102149\\temporaryfile")) returned 1 [0032.943] FindNextFileA (in: hFindFile=0x25c8f0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b3ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b3ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b3ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.943] FindClose (in: hFindFile=0x25c8f0 | out: hFindFile=0x25c8f0) returned 1 [0032.943] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102149" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102149")) returned 1 [0032.944] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned 0 [0032.944] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.947] WriteFile (in: hFile=0xdc, lpBuffer=0x2625a0*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesWritten=0x18fdd8*=0x1d0, lpOverlapped=0x0) returned 1 [0032.947] CloseHandle (hObject=0xdc) returned 1 [0032.949] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.952] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x82 [0032.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8a) returned 0x262a08 [0032.952] ReadFile (in: hFile=0xdc, lpBuffer=0x262a10, nNumberOfBytesToRead=0x82, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x262a10*, lpNumberOfBytesRead=0x18fdf0*=0x82, lpOverlapped=0x0) returned 1 [0032.952] CloseHandle (hObject=0xdc) returned 1 [0032.953] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt")) returned 1 [0032.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.953] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.953] GetTickCount () returned 0x18f15 [0032.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x25c6b0 [0032.954] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.954] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165\\....\\temporaryfile")) returned 0 [0032.954] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165\\temporaryfile")) returned 1 [0032.955] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c718 [0032.956] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.956] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.956] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25c6b0 [0032.956] FindNextFileA (in: hFindFile=0x25c6b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.956] FindNextFileA (in: hFindFile=0x25c6b0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25c734, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.956] FindClose (in: hFindFile=0x25c6b0 | out: hFindFile=0x25c6b0) returned 1 [0032.956] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165\\temporaryfile")) returned 1 [0032.956] FindNextFileA (in: hFindFile=0x25c718, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.956] FindClose (in: hFindFile=0x25c718 | out: hFindFile=0x25c718) returned 1 [0032.956] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165")) returned 1 [0032.956] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned 0 [0032.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.957] WriteFile (in: hFile=0xdc, lpBuffer=0x262aa8*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x262aa8*, lpNumberOfBytesWritten=0x18fdd8*=0x88, lpOverlapped=0x0) returned 1 [0032.958] CloseHandle (hObject=0xdc) returned 1 [0032.959] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.960] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x110 [0032.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x118) returned 0x25c6b0 [0032.960] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0x110, lpOverlapped=0x0) returned 1 [0032.961] CloseHandle (hObject=0xdc) returned 1 [0032.961] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt")) returned 1 [0032.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.962] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.962] GetTickCount () returned 0x18f15 [0032.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0032.963] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.963] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165\\....\\temporaryfile")) returned 0 [0032.963] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165\\temporaryfile")) returned 1 [0032.964] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0032.965] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.965] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0032.965] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.965] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0032.965] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165\\temporaryfile")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b60d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b60d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b60d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.965] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0032.965] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102165" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102165")) returned 1 [0032.965] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned 0 [0032.966] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.966] WriteFile (in: hFile=0xdc, lpBuffer=0x2625a0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesWritten=0x18fdd8*=0x118, lpOverlapped=0x0) returned 1 [0032.967] CloseHandle (hObject=0xdc) returned 1 [0032.968] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.970] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x256 [0032.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25e) returned 0x25c6b0 [0032.970] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x256, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0x256, lpOverlapped=0x0) returned 1 [0032.971] CloseHandle (hObject=0xdc) returned 1 [0032.971] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt")) returned 1 [0032.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.972] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.972] GetTickCount () returned 0x18f24 [0032.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c918 [0032.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0032.973] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.973] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180\\....\\temporaryfile")) returned 0 [0032.973] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180\\temporaryfile")) returned 1 [0032.974] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b86ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b86ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b86ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0032.974] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b86ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b86ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b86ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.974] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b86ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b86ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b86ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.975] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b86ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b86ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b86ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0032.975] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b86ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b86ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b86ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.975] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b86ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b86ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b86ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.975] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0032.975] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180\\temporaryfile")) returned 1 [0032.975] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b86ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18b86ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18b86ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.975] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0032.975] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180")) returned 1 [0032.975] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt") returned 0 [0032.975] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.976] WriteFile (in: hFile=0xdc, lpBuffer=0x262628*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x262628*, lpNumberOfBytesWritten=0x18fdd8*=0x260, lpOverlapped=0x0) returned 1 [0032.977] CloseHandle (hObject=0xdc) returned 1 [0032.978] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.979] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc4 [0032.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcc) returned 0x25c6b0 [0032.979] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0xc4, lpOverlapped=0x0) returned 1 [0032.980] CloseHandle (hObject=0xdc) returned 1 [0032.980] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt")) returned 1 [0032.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.981] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0032.981] GetTickCount () returned 0x18f24 [0032.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.982] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0032.983] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.983] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180\\....\\temporaryfile")) returned 0 [0032.983] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180\\temporaryfile")) returned 1 [0032.984] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b86ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0032.984] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18b86ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.984] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.984] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0032.985] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.985] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.985] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0032.985] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180\\temporaryfile")) returned 1 [0032.985] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.985] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0032.985] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102180" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102180")) returned 1 [0032.985] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt") returned 0 [0032.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.986] WriteFile (in: hFile=0xdc, lpBuffer=0x25c818*, nNumberOfBytesToWrite=0xc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25c818*, lpNumberOfBytesWritten=0x18fdd8*=0xc8, lpOverlapped=0x0) returned 1 [0032.989] CloseHandle (hObject=0xdc) returned 1 [0032.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0032.990] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x21f [0032.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x227) returned 0x25c6b0 [0032.990] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x21f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0x21f, lpOverlapped=0x0) returned 1 [0032.992] CloseHandle (hObject=0xdc) returned 1 [0032.992] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt")) returned 1 [0032.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0032.993] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0032.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0032.993] GetTickCount () returned 0x18f34 [0032.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0032.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0032.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0032.994] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102196\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0032.994] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102196\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102196\\....\\temporaryfile")) returned 0 [0032.994] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102196\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102196\\temporaryfile")) returned 1 [0032.995] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102196\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0032.996] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.996] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0032.996] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102196\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0032.996] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.996] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.996] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0032.996] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102196\\temporaryfile")) returned 1 [0032.996] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bad020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bad020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bad020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0032.996] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0032.996] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102196" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102196")) returned 1 [0032.996] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt") returned 0 [0032.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.000] WriteFile (in: hFile=0xdc, lpBuffer=0x2625a0*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesWritten=0x18fdd8*=0x228, lpOverlapped=0x0) returned 1 [0033.001] CloseHandle (hObject=0xdc) returned 1 [0033.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.012] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x110 [0033.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x118) returned 0x25c6b0 [0033.012] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0x110, lpOverlapped=0x0) returned 1 [0033.013] CloseHandle (hObject=0xdc) returned 1 [0033.013] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt")) returned 1 [0033.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.014] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.014] GetTickCount () returned 0x18f53 [0033.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0033.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0033.014] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.015] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227\\....\\temporaryfile")) returned 0 [0033.015] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227\\temporaryfile")) returned 1 [0033.016] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.016] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.016] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.016] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.016] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.016] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.016] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.017] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227\\temporaryfile")) returned 1 [0033.017] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.017] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.017] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227")) returned 1 [0033.017] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned 0 [0033.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.018] WriteFile (in: hFile=0xdc, lpBuffer=0x2625a0*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesWritten=0x18fdd8*=0x118, lpOverlapped=0x0) returned 1 [0033.018] CloseHandle (hObject=0xdc) returned 1 [0033.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.021] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x76 [0033.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7e) returned 0x25c6b0 [0033.021] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0x76, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0x76, lpOverlapped=0x0) returned 1 [0033.021] CloseHandle (hObject=0xdc) returned 1 [0033.022] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt")) returned 1 [0033.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.022] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0033.022] GetTickCount () returned 0x18f53 [0033.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0033.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0033.023] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.024] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227\\....\\temporaryfile")) returned 0 [0033.024] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227\\temporaryfile")) returned 1 [0033.025] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.025] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.025] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.025] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.025] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.025] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.025] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.025] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227\\temporaryfile")) returned 1 [0033.025] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18bf92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18bf92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18bf92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.025] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.026] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102227" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102227")) returned 1 [0033.026] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned 0 [0033.026] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.026] WriteFile (in: hFile=0xdc, lpBuffer=0x25c7c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25c7c8*, lpNumberOfBytesWritten=0x18fdd8*=0x80, lpOverlapped=0x0) returned 1 [0033.027] CloseHandle (hObject=0xdc) returned 1 [0033.028] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.029] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x337 [0033.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x33f) returned 0x262598 [0033.029] ReadFile (in: hFile=0xdc, lpBuffer=0x2625a0, nNumberOfBytesToRead=0x337, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesRead=0x18fdf0*=0x337, lpOverlapped=0x0) returned 1 [0033.030] CloseHandle (hObject=0xdc) returned 1 [0033.030] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt")) returned 1 [0033.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.031] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.031] GetTickCount () returned 0x18f63 [0033.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0033.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0033.032] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243\\....\\temporaryfile")) returned 0 [0033.032] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243\\temporaryfile")) returned 1 [0033.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.033] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.033] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.033] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.033] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.033] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.034] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243\\temporaryfile")) returned 1 [0033.034] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.034] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.034] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243")) returned 1 [0033.034] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt") returned 0 [0033.034] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.035] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x340, lpOverlapped=0x0) returned 1 [0033.036] CloseHandle (hObject=0xdc) returned 1 [0033.036] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.037] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xce [0033.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd6) returned 0x25c738 [0033.037] ReadFile (in: hFile=0xdc, lpBuffer=0x25c740, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c740*, lpNumberOfBytesRead=0x18fdf0*=0xce, lpOverlapped=0x0) returned 1 [0033.038] CloseHandle (hObject=0xdc) returned 1 [0033.038] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt")) returned 1 [0033.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.039] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.039] GetTickCount () returned 0x18f63 [0033.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c818 [0033.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0033.040] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.040] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243\\....\\temporaryfile")) returned 0 [0033.040] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243\\temporaryfile")) returned 1 [0033.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.042] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.042] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.042] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.042] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.042] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.042] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243\\temporaryfile")) returned 1 [0033.042] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c1f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c1f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c1f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.042] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.042] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102243" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102243")) returned 1 [0033.042] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned 0 [0033.043] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.043] WriteFile (in: hFile=0xdc, lpBuffer=0x2625a0*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesWritten=0x18fdd8*=0xd8, lpOverlapped=0x0) returned 1 [0033.045] CloseHandle (hObject=0xdc) returned 1 [0033.046] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.047] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6c [0033.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x74) returned 0x24f858 [0033.047] ReadFile (in: hFile=0xdc, lpBuffer=0x24f860, nNumberOfBytesToRead=0x6c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x24f860*, lpNumberOfBytesRead=0x18fdf0*=0x6c, lpOverlapped=0x0) returned 1 [0033.048] CloseHandle (hObject=0xdc) returned 1 [0033.048] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt")) returned 1 [0033.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.049] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.049] GetTickCount () returned 0x18f72 [0033.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0033.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0033.049] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.049] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258\\....\\temporaryfile")) returned 0 [0033.050] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258\\temporaryfile")) returned 1 [0033.051] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.051] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.051] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.051] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.051] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.051] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.051] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.051] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258\\temporaryfile")) returned 1 [0033.051] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.051] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.051] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258")) returned 1 [0033.052] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned 0 [0033.052] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.052] WriteFile (in: hFile=0xdc, lpBuffer=0x24f8e0*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x24f8e0*, lpNumberOfBytesWritten=0x18fdd8*=0x70, lpOverlapped=0x0) returned 1 [0033.053] CloseHandle (hObject=0xdc) returned 1 [0033.054] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.054] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x68 [0033.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x70) returned 0x25e598 [0033.054] ReadFile (in: hFile=0xdc, lpBuffer=0x25e5a0, nNumberOfBytesToRead=0x68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25e5a0*, lpNumberOfBytesRead=0x18fdf0*=0x68, lpOverlapped=0x0) returned 1 [0033.055] CloseHandle (hObject=0xdc) returned 1 [0033.055] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt")) returned 1 [0033.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.056] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0033.056] GetTickCount () returned 0x18f72 [0033.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0033.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0033.057] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.057] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258\\....\\temporaryfile")) returned 0 [0033.057] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258\\temporaryfile")) returned 1 [0033.058] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.058] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.058] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.059] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.059] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.059] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.059] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.059] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258\\temporaryfile")) returned 1 [0033.059] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c455a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c455a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c455a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.059] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.059] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102258" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102258")) returned 1 [0033.060] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned 0 [0033.060] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.060] WriteFile (in: hFile=0xdc, lpBuffer=0x24f8e0*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x24f8e0*, lpNumberOfBytesWritten=0x18fdd8*=0x70, lpOverlapped=0x0) returned 1 [0033.061] CloseHandle (hObject=0xdc) returned 1 [0033.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.065] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb2 [0033.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xba) returned 0x25c6b0 [0033.065] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0xb2, lpOverlapped=0x0) returned 1 [0033.066] CloseHandle (hObject=0xdc) returned 1 [0033.066] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt")) returned 1 [0033.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.067] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.067] GetTickCount () returned 0x18f82 [0033.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c778 [0033.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0033.068] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102274\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102274\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.068] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102274\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102274\\....\\temporaryfile")) returned 0 [0033.068] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102274\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102274\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102274\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102274\\temporaryfile")) returned 1 [0033.069] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102274\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c6b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c6b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c6b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.069] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c6b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c6b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c6b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.070] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c6b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c6b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c6b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.070] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102274\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c6b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c6b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c6b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.070] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c6b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c6b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c6b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.070] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c6b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c6b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c6b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.070] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.070] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102274\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102274\\temporaryfile")) returned 1 [0033.070] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c6b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c6b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c6b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.070] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.070] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102274" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102274")) returned 1 [0033.070] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned 0 [0033.070] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.071] WriteFile (in: hFile=0xdc, lpBuffer=0x25c808*, nNumberOfBytesToWrite=0xb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25c808*, lpNumberOfBytesWritten=0x18fdd8*=0xb8, lpOverlapped=0x0) returned 1 [0033.072] CloseHandle (hObject=0xdc) returned 1 [0033.072] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.074] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd7 [0033.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdf) returned 0x25c6b0 [0033.074] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0xd7, lpOverlapped=0x0) returned 1 [0033.075] CloseHandle (hObject=0xdc) returned 1 [0033.075] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt")) returned 1 [0033.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.076] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0033.076] GetTickCount () returned 0x18f91 [0033.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5c8 [0033.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0033.077] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102289\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102289\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102289\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102289\\....\\temporaryfile")) returned 0 [0033.077] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102289\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102289\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102289\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102289\\temporaryfile")) returned 1 [0033.078] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102289\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c91860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c91860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c91860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.078] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c91860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c91860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c91860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.078] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c91860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c91860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c91860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.078] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102289\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c91860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c91860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c91860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.078] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c91860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c91860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c91860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.078] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c91860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c91860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c91860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.078] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.078] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102289\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102289\\temporaryfile")) returned 1 [0033.079] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18c91860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18c91860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18c91860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.079] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.079] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102289" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102289")) returned 1 [0033.079] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned 0 [0033.079] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.080] WriteFile (in: hFile=0xdc, lpBuffer=0x28aa18*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28aa18*, lpNumberOfBytesWritten=0x18fdd8*=0xe0, lpOverlapped=0x0) returned 1 [0033.080] CloseHandle (hObject=0xdc) returned 1 [0033.082] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.083] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa9 [0033.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb1) returned 0x25c6b0 [0033.083] ReadFile (in: hFile=0xdc, lpBuffer=0x25c6b8, nNumberOfBytesToRead=0xa9, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c6b8*, lpNumberOfBytesRead=0x18fdf0*=0xa9, lpOverlapped=0x0) returned 1 [0033.090] CloseHandle (hObject=0xdc) returned 1 [0033.090] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt")) returned 1 [0033.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.091] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.091] GetTickCount () returned 0x18fa1 [0033.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c770 [0033.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0033.092] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.092] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305\\....\\temporaryfile")) returned 0 [0033.092] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305\\temporaryfile")) returned 1 [0033.093] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.093] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.093] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.093] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.093] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.093] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.093] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.093] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305\\temporaryfile")) returned 1 [0033.094] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.094] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305")) returned 1 [0033.094] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned 0 [0033.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.095] WriteFile (in: hFile=0xdc, lpBuffer=0x25c800*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25c800*, lpNumberOfBytesWritten=0x18fdd8*=0xb0, lpOverlapped=0x0) returned 1 [0033.095] CloseHandle (hObject=0xdc) returned 1 [0033.097] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.098] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x402 [0033.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40a) returned 0x262598 [0033.098] ReadFile (in: hFile=0xdc, lpBuffer=0x2625a0, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2625a0*, lpNumberOfBytesRead=0x18fdf0*=0x402, lpOverlapped=0x0) returned 1 [0033.099] CloseHandle (hObject=0xdc) returned 1 [0033.099] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt")) returned 1 [0033.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.100] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0033.100] GetTickCount () returned 0x18fa1 [0033.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2629b0 [0033.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0033.101] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.104] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305\\....\\temporaryfile")) returned 0 [0033.104] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305\\temporaryfile")) returned 1 [0033.105] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.105] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.105] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.105] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.105] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.105] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.105] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.105] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305\\temporaryfile")) returned 1 [0033.106] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cb79c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cb79c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cb79c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.106] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.106] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102305" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102305")) returned 1 [0033.106] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned 0 [0033.107] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.108] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x408, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x408, lpOverlapped=0x0) returned 1 [0033.109] CloseHandle (hObject=0xdc) returned 1 [0033.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.110] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8000 [0033.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8008) returned 0x28c9f8 [0033.110] ReadFile (in: hFile=0xdc, lpBuffer=0x28ca00, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28ca00*, lpNumberOfBytesRead=0x18fdf0*=0x8000, lpOverlapped=0x0) returned 1 [0033.112] CloseHandle (hObject=0xdc) returned 1 [0033.112] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat")) returned 1 [0033.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.113] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.113] GetTickCount () returned 0x18fb1 [0033.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c6b0 [0033.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a10 [0033.113] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102321\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.114] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102321\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102321\\....\\temporaryfile")) returned 0 [0033.114] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102321\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102321\\temporaryfile")) returned 1 [0033.115] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102321\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cddb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cddb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cddb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.115] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cddb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cddb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cddb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.115] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cddb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cddb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cddb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.115] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102321\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cddb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cddb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cddb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.115] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cddb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cddb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cddb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.115] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cddb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cddb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cddb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.115] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102321\\temporaryfile")) returned 1 [0033.115] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18cddb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18cddb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cddb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.115] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102321" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102321")) returned 1 [0033.116] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\index.dat") returned 0 [0033.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\index.dat.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.117] WriteFile (in: hFile=0xdc, lpBuffer=0x294a10*, nNumberOfBytesToWrite=0x8008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x294a10*, lpNumberOfBytesWritten=0x18fdd8*=0x8008, lpOverlapped=0x0) returned 1 [0033.118] CloseHandle (hObject=0xdc) returned 1 [0033.119] FindClose (in: hFindFile=0x25c628 | out: hFindFile=0x25c628) returned 1 [0033.119] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Cookies\\Low\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x18cddb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18cddb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0033.120] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.120] FindClose (in: hFindFile=0x25c670 | out: hFindFile=0x25c670) returned 1 [0033.120] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.121] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0033.121] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Low", cAlternateFileName="")) returned 1 [0033.121] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Low", cAlternateFileName="")) returned 0 [0033.121] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0033.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.121] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0033.121] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 0 [0033.122] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0033.122] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.122] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.122] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0033.122] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x2561e0 [0033.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.123] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x40000 [0033.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40008) returned 0x28c9f8 [0033.123] ReadFile (in: hFile=0xd8, lpBuffer=0x28ca00, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ca00*, lpNumberOfBytesRead=0x18fe10*=0x40000, lpOverlapped=0x0) returned 1 [0033.130] CloseHandle (hObject=0xd8) returned 1 [0033.131] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat")) returned 0 [0033.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0033.131] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.131] GetTickCount () returned 0x18fc0 [0033.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0033.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5d0 [0033.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.131] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102336\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102336\\...."), lpSecurityAttributes=0x256198) returned 1 [0033.132] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102336\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102336\\....\\temporaryfile")) returned 0 [0033.132] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102336\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102336\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102336\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102336\\temporaryfile")) returned 1 [0033.133] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102336\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d03c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d03c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d03c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.133] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d03c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d03c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d03c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0033.133] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d03c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d03c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d03c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.133] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102336\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d03c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d03c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d03c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.133] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d03c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d03c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d03c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.133] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d03c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d03c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d03c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.133] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.133] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102336\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102336\\temporaryfile")) returned 1 [0033.133] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d03c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d03c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d03c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.133] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.134] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102336" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102336")) returned 1 [0033.134] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\index.dat") returned 1 [0033.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\index.dat.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.142] WriteFile (in: hFile=0xd8, lpBuffer=0x2cca10*, nNumberOfBytesToWrite=0x40008, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2cca10*, lpNumberOfBytesWritten=0x18fdf8*=0x40008, lpOverlapped=0x0) returned 1 [0033.147] CloseHandle (hObject=0xd8) returned 1 [0033.152] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x18d29de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d29de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0033.153] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.153] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0033.154] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x2561e0 [0033.154] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.154] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x40000 [0033.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40008) returned 0x28c9f8 [0033.155] ReadFile (in: hFile=0xdc, lpBuffer=0x28ca00, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28ca00*, lpNumberOfBytesRead=0x18fdf0*=0x40000, lpOverlapped=0x0) returned 1 [0033.181] CloseHandle (hObject=0xdc) returned 1 [0033.181] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat")) returned 1 [0033.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0033.183] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.183] GetTickCount () returned 0x18fef [0033.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0033.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c630 [0033.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0033.183] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102383\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102383\\...."), lpSecurityAttributes=0x256198) returned 1 [0033.184] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102383\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102383\\....\\temporaryfile")) returned 0 [0033.184] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102383\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102383\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102383\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102383\\temporaryfile")) returned 1 [0033.186] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102383\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d760a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d9c200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d9c200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.186] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d760a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d9c200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d9c200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="..", cAlternateFileName="")) returned 1 [0033.186] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d760a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d760a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d760a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.186] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102383\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d760a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d760a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d760a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0033.186] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d760a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d760a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d760a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.186] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d760a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d760a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d760a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.186] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0033.186] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102383\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102383\\temporaryfile")) returned 1 [0033.187] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18d760a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18d760a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d760a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.187] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.187] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102383" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102383")) returned 1 [0033.187] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\Low\\index.dat") returned 0 [0033.193] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\Low\\index.dat.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.195] WriteFile (in: hFile=0xdc, lpBuffer=0x2cca10*, nNumberOfBytesToWrite=0x40008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cca10*, lpNumberOfBytesWritten=0x18fdd8*=0x40008, lpOverlapped=0x0) returned 1 [0033.201] CloseHandle (hObject=0xdc) returned 1 [0033.206] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.206] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x18d9c200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18d9c200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0033.206] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.206] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.206] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.206] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0033.206] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561c8 [0033.206] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.206] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x112 [0033.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11a) returned 0x25c5d0 [0033.206] ReadFile (in: hFile=0xd8, lpBuffer=0x25c5d8, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c5d8*, lpNumberOfBytesRead=0x18fe10*=0x112, lpOverlapped=0x0) returned 1 [0033.207] CloseHandle (hObject=0xd8) returned 1 [0033.207] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 1 [0033.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0033.209] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.209] GetTickCount () returned 0x1900e [0033.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0033.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c6f8 [0033.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.209] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102414\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102414\\...."), lpSecurityAttributes=0x256198) returned 1 [0033.209] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102414\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102414\\....\\temporaryfile")) returned 0 [0033.210] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102414\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102414\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102414\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102414\\temporaryfile")) returned 1 [0033.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102414\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18dc2360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18dc2360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18dc2360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.211] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18dc2360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18dc2360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18dc2360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0033.211] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18dc2360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18dc2360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18dc2360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102414\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18dc2360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18dc2360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18dc2360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.211] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18dc2360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18dc2360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18dc2360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.211] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18dc2360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18dc2360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18dc2360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.211] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102414\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102414\\temporaryfile")) returned 1 [0033.211] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18dc2360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18dc2360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18dc2360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.211] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102414" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102414")) returned 1 [0033.212] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\desktop.ini") returned 0 [0033.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.213] WriteFile (in: hFile=0xd8, lpBuffer=0x25c768*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c768*, lpNumberOfBytesWritten=0x18fdf8*=0x118, lpOverlapped=0x0) returned 1 [0033.213] CloseHandle (hObject=0xd8) returned 1 [0033.214] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.214] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xe2b [0033.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe33) returned 0x2649f0 [0033.215] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xe2b, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xe2b, lpOverlapped=0x0) returned 1 [0033.216] CloseHandle (hObject=0xd8) returned 1 [0033.216] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms")) returned 1 [0033.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.217] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.217] GetTickCount () returned 0x1901e [0033.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265830 [0033.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.218] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430\\....\\temporaryfile")) returned 0 [0033.218] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430\\temporaryfile")) returned 1 [0033.219] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.219] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.219] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.219] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.219] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.219] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.219] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430\\temporaryfile")) returned 1 [0033.219] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.219] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430")) returned 1 [0033.220] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned 0 [0033.220] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Documents.library-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.221] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xe30, lpOverlapped=0x0) returned 1 [0033.222] CloseHandle (hObject=0xd8) returned 1 [0033.223] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.223] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xe00 [0033.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2649f0 [0033.223] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xe00, lpOverlapped=0x0) returned 1 [0033.224] CloseHandle (hObject=0xd8) returned 1 [0033.224] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms")) returned 1 [0033.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.225] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.225] GetTickCount () returned 0x1901e [0033.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265800 [0033.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.225] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430\\....\\temporaryfile")) returned 0 [0033.226] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430\\temporaryfile")) returned 1 [0033.227] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.227] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.227] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.227] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.227] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.227] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.227] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.228] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430\\temporaryfile")) returned 1 [0033.228] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18de84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18de84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18de84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.228] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.228] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102430" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102430")) returned 1 [0033.228] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned 0 [0033.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Music.library-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.229] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xe08, lpOverlapped=0x0) returned 1 [0033.230] CloseHandle (hObject=0xd8) returned 1 [0033.231] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.231] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xe23 [0033.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe2b) returned 0x2649f0 [0033.231] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xe23, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xe23, lpOverlapped=0x0) returned 1 [0033.232] CloseHandle (hObject=0xd8) returned 1 [0033.232] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms")) returned 1 [0033.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.233] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.233] GetTickCount () returned 0x1902d [0033.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265828 [0033.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.233] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.234] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445\\....\\temporaryfile")) returned 0 [0033.234] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445\\temporaryfile")) returned 1 [0033.235] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.235] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.235] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.235] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.235] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.235] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.235] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.235] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445\\temporaryfile")) returned 1 [0033.236] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.236] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.236] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445")) returned 1 [0033.236] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned 0 [0033.236] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.237] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xe28, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xe28, lpOverlapped=0x0) returned 1 [0033.238] CloseHandle (hObject=0xd8) returned 1 [0033.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.239] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xe0e [0033.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe16) returned 0x2649f0 [0033.239] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xe0e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xe0e, lpOverlapped=0x0) returned 1 [0033.240] CloseHandle (hObject=0xd8) returned 1 [0033.240] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms")) returned 1 [0033.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.241] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.241] GetTickCount () returned 0x1902d [0033.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265810 [0033.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.241] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.242] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445\\....\\temporaryfile")) returned 0 [0033.242] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445\\temporaryfile")) returned 1 [0033.243] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.243] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.243] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.243] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.243] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.243] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.243] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445\\temporaryfile")) returned 1 [0033.244] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e0e620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.244] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.244] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102445" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102445")) returned 1 [0033.244] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned 0 [0033.244] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\Videos.library-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.245] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xe18, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xe18, lpOverlapped=0x0) returned 1 [0033.246] CloseHandle (hObject=0xd8) returned 1 [0033.247] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.247] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x18e0e620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e0e620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0033.247] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.247] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.248] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0033.248] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 0 [0033.248] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0033.248] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.248] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0033.249] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 0 [0033.249] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0033.249] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.249] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.249] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0033.249] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x2561c8 [0033.249] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.251] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x8000 [0033.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8008) returned 0x28e9f8 [0033.251] ReadFile (in: hFile=0xd8, lpBuffer=0x28ea00, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fe10*=0x8000, lpOverlapped=0x0) returned 1 [0033.271] CloseHandle (hObject=0xd8) returned 1 [0033.271] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")) returned 1 [0033.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0033.272] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.272] GetTickCount () returned 0x1904d [0033.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0033.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c5d0 [0033.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.273] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102477\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102477\\...."), lpSecurityAttributes=0x256198) returned 1 [0033.273] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102477\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102477\\....\\temporaryfile")) returned 0 [0033.273] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102477\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102477\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102477\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102477\\temporaryfile")) returned 1 [0033.274] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102477\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e5a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e5a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e5a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.274] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e5a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e5a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e5a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0033.274] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e5a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e5a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e5a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.274] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102477\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e5a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e5a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e5a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.275] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e5a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e5a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e5a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.275] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e5a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e5a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e5a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.275] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.275] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102477\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102477\\temporaryfile")) returned 1 [0033.275] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e5a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e5a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e5a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.275] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.275] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102477" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102477")) returned 1 [0033.275] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\index.dat") returned 0 [0033.276] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\index.dat.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.277] WriteFile (in: hFile=0xd8, lpBuffer=0x296a10*, nNumberOfBytesToWrite=0x8008, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x296a10*, lpNumberOfBytesWritten=0x18fdf8*=0x8008, lpOverlapped=0x0) returned 1 [0033.278] CloseHandle (hObject=0xd8) returned 1 [0033.279] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x18e5a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e5a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0033.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.280] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0033.280] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x2561c8 [0033.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.280] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c000 [0033.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c008) returned 0x28e9f8 [0033.281] ReadFile (in: hFile=0xdc, lpBuffer=0x28ea00, nNumberOfBytesToRead=0x1c000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fdf0*=0x1c000, lpOverlapped=0x0) returned 1 [0033.285] CloseHandle (hObject=0xdc) returned 1 [0033.285] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat")) returned 1 [0033.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0033.287] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.287] GetTickCount () returned 0x1905c [0033.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0033.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c628 [0033.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0033.287] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102492\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102492\\...."), lpSecurityAttributes=0x256198) returned 1 [0033.287] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102492\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102492\\....\\temporaryfile")) returned 0 [0033.287] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102492\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102492\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102492\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102492\\temporaryfile")) returned 1 [0033.289] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102492\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e80a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e80a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e80a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.289] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e80a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e80a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e80a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="..", cAlternateFileName="")) returned 1 [0033.289] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e80a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e80a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e80a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.289] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102492\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e80a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e80a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e80a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0033.289] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e80a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e80a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e80a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.289] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e80a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e80a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e80a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.289] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0033.289] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102492\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102492\\temporaryfile")) returned 1 [0033.289] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18e80a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18e80a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e80a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.289] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.289] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102492" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102492")) returned 1 [0033.289] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat") returned 0 [0033.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0033.293] WriteFile (in: hFile=0xdc, lpBuffer=0x2aaa10*, nNumberOfBytesToWrite=0x1c008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2aaa10*, lpNumberOfBytesWritten=0x18fdd8*=0x1c008, lpOverlapped=0x0) returned 1 [0033.295] CloseHandle (hObject=0xdc) returned 1 [0033.297] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.297] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x18e80a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18e80a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0033.297] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.297] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0033.297] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xec6a030, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xec6a030, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0033.297] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xec6a030, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xec6a030, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0033.297] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b8250, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xe5b8250, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xe5b8250, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="-MKqyxYjc5JRno0_.lnk", cAlternateFileName="-MKQYX~1.LNK")) returned 1 [0033.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15) returned 0x25cd90 [0033.297] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\-MKqyxYjc5JRno0_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-mkqyxyjc5jrno0_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.298] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa79 [0033.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa81) returned 0x2649f0 [0033.298] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa79, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa79, lpOverlapped=0x0) returned 1 [0033.298] CloseHandle (hObject=0xd8) returned 1 [0033.298] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\-MKqyxYjc5JRno0_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-mkqyxyjc5jrno0_.lnk")) returned 1 [0033.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.299] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.299] GetTickCount () returned 0x1906c [0033.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.300] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.300] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\-MKqyxYjc5JRno0_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-mkqyxyjc5jrno0_.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508\\....\\temporaryfile")) returned 0 [0033.300] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508\\temporaryfile")) returned 1 [0033.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.302] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0033.302] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.302] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.302] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.302] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.302] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.302] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508\\temporaryfile")) returned 1 [0033.302] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.302] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.302] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508")) returned 1 [0033.302] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\-MKqyxYjc5JRno0_.lnk") returned 0 [0033.303] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\-MKqyxYjc5JRno0_.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-mkqyxyjc5jrno0_.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.303] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xa80, lpOverlapped=0x0) returned 1 [0033.304] CloseHandle (hObject=0xd8) returned 1 [0033.305] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\-XGB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-xgb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.305] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf2c [0033.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf34) returned 0x2649f0 [0033.305] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf2c, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf2c, lpOverlapped=0x0) returned 1 [0033.305] CloseHandle (hObject=0xd8) returned 1 [0033.305] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\-XGB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-xgb.lnk")) returned 1 [0033.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.306] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.306] GetTickCount () returned 0x1906c [0033.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265930 [0033.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.308] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.309] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\-XGB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-xgb.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508\\....\\temporaryfile")) returned 0 [0033.309] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508\\temporaryfile")) returned 1 [0033.311] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18eccd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18eccd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.311] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18eccd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18eccd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.312] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.312] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.312] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.312] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.312] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.312] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508\\temporaryfile")) returned 1 [0033.312] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ea6ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ea6ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ea6ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.312] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.312] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102508" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102508")) returned 1 [0033.312] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\-XGB.lnk") returned 0 [0033.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\-XGB.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-xgb.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.313] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xf30, lpOverlapped=0x0) returned 1 [0033.314] CloseHandle (hObject=0xd8) returned 1 [0033.315] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\0PhF0I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0phf0i.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.315] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9eb [0033.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9f3) returned 0x2649f0 [0033.315] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9eb, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x9eb, lpOverlapped=0x0) returned 1 [0033.315] CloseHandle (hObject=0xd8) returned 1 [0033.316] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\0PhF0I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0phf0i.lnk")) returned 1 [0033.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.316] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.316] GetTickCount () returned 0x1907b [0033.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.317] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\0PhF0I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0phf0i.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523\\....\\temporaryfile")) returned 0 [0033.318] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523\\temporaryfile")) returned 1 [0033.319] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18eccd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18eccd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18eccd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.319] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18eccd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18eccd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18eccd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.319] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18eccd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18eccd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18eccd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.319] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18eccd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18eccd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18eccd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.319] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18eccd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18eccd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18eccd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.319] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18eccd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18eccd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18eccd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.319] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.319] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523\\temporaryfile")) returned 1 [0033.319] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18eccd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18eccd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18eccd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.319] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.319] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523")) returned 1 [0033.320] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\0PhF0I.lnk") returned 0 [0033.320] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\0PhF0I.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0phf0i.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.320] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0x9f0, lpOverlapped=0x0) returned 1 [0033.321] CloseHandle (hObject=0xd8) returned 1 [0033.322] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\0R8VZmxctZ1GX1QI5rL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0r8vzmxctz1gx1qi5rl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.322] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x324 [0033.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32c) returned 0x25c570 [0033.322] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x324, lpOverlapped=0x0) returned 1 [0033.323] CloseHandle (hObject=0xd8) returned 1 [0033.323] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\0R8VZmxctZ1GX1QI5rL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0r8vzmxctz1gx1qi5rl.lnk")) returned 1 [0033.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.324] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.324] GetTickCount () returned 0x1907b [0033.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c8a8 [0033.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.326] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.326] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\0R8VZmxctZ1GX1QI5rL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0r8vzmxctz1gx1qi5rl.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523\\....\\temporaryfile")) returned 0 [0033.326] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523\\temporaryfile")) returned 1 [0033.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18eccd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.327] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18eccd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.328] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.328] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.328] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.328] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.328] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.328] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523\\temporaryfile")) returned 1 [0033.328] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.328] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.328] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102523" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102523")) returned 1 [0033.328] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\0R8VZmxctZ1GX1QI5rL.lnk") returned 0 [0033.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\0R8VZmxctZ1GX1QI5rL.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0r8vzmxctz1gx1qi5rl.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.331] WriteFile (in: hFile=0xd8, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x328, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdf8*=0x328, lpOverlapped=0x0) returned 1 [0033.332] CloseHandle (hObject=0xd8) returned 1 [0033.333] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\1SVv3QXnp1AD4QB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1svv3qxnp1ad4qb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.333] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf65 [0033.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf6d) returned 0x2649f0 [0033.333] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf65, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf65, lpOverlapped=0x0) returned 1 [0033.333] CloseHandle (hObject=0xd8) returned 1 [0033.334] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\1SVv3QXnp1AD4QB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1svv3qxnp1ad4qb.lnk")) returned 1 [0033.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.334] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.334] GetTickCount () returned 0x1908b [0033.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265968 [0033.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.335] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102539\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102539\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.336] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\1SVv3QXnp1AD4QB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1svv3qxnp1ad4qb.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102539\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102539\\....\\temporaryfile")) returned 0 [0033.336] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102539\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102539\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102539\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102539\\temporaryfile")) returned 1 [0033.337] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102539\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.337] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.337] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.337] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102539\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.337] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.337] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.337] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.337] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102539\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102539\\temporaryfile")) returned 1 [0033.337] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ef2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ef2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ef2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.338] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.338] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102539" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102539")) returned 1 [0033.338] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\1SVv3QXnp1AD4QB.lnk") returned 0 [0033.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\1SVv3QXnp1AD4QB.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1svv3qxnp1ad4qb.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.338] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xf70, lpOverlapped=0x0) returned 1 [0033.339] CloseHandle (hObject=0xd8) returned 1 [0033.340] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\2LoErBDNL.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2loerbdnl.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.340] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x23e [0033.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x246) returned 0x25c570 [0033.341] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x23e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x23e, lpOverlapped=0x0) returned 1 [0033.341] CloseHandle (hObject=0xd8) returned 1 [0033.341] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\2LoErBDNL.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2loerbdnl.flv.lnk")) returned 1 [0033.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.342] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.342] GetTickCount () returned 0x1909b [0033.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c7c0 [0033.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.343] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.343] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\2LoErBDNL.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2loerbdnl.flv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555\\....\\temporaryfile")) returned 0 [0033.343] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555\\temporaryfile")) returned 1 [0033.344] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.344] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.344] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.344] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.344] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.344] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.344] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555\\temporaryfile")) returned 1 [0033.345] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.345] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.345] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555")) returned 1 [0033.345] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\2LoErBDNL.flv.lnk") returned 0 [0033.345] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\2LoErBDNL.flv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2loerbdnl.flv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.346] WriteFile (in: hFile=0xd8, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdf8*=0x248, lpOverlapped=0x0) returned 1 [0033.346] CloseHandle (hObject=0xd8) returned 1 [0033.347] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\3qeSyu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3qesyu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.347] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x94a [0033.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x952) returned 0x2649f0 [0033.347] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x94a, lpOverlapped=0x0) returned 1 [0033.348] CloseHandle (hObject=0xd8) returned 1 [0033.348] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\3qeSyu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3qesyu.lnk")) returned 1 [0033.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.349] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.349] GetTickCount () returned 0x1909b [0033.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.349] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.350] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\3qeSyu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3qesyu.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555\\....\\temporaryfile")) returned 0 [0033.350] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555\\temporaryfile")) returned 1 [0033.351] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.351] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.351] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.351] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.351] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.351] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.351] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.351] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555\\temporaryfile")) returned 1 [0033.352] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f18fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f18fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f18fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.352] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.352] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102555" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102555")) returned 1 [0033.352] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\3qeSyu.lnk") returned 0 [0033.352] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\3qeSyu.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3qesyu.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.353] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0x950, lpOverlapped=0x0) returned 1 [0033.353] CloseHandle (hObject=0xd8) returned 1 [0033.354] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4eaJAvH8dt snU9W.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4eajavh8dt snu9w.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.354] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x261 [0033.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x269) returned 0x25c570 [0033.354] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x261, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x261, lpOverlapped=0x0) returned 1 [0033.355] CloseHandle (hObject=0xd8) returned 1 [0033.355] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4eaJAvH8dt snU9W.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4eajavh8dt snu9w.flv.lnk")) returned 1 [0033.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.357] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.357] GetTickCount () returned 0x190aa [0033.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.358] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.358] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4eaJAvH8dt snU9W.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4eajavh8dt snu9w.flv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570\\....\\temporaryfile")) returned 0 [0033.358] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570\\temporaryfile")) returned 1 [0033.359] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.359] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.359] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.359] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.360] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.360] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.360] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.360] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570\\temporaryfile")) returned 1 [0033.360] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.360] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.360] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570")) returned 1 [0033.360] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4eaJAvH8dt snU9W.flv.lnk") returned 0 [0033.360] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4eaJAvH8dt snU9W.flv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4eajavh8dt snu9w.flv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.361] WriteFile (in: hFile=0xd8, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x268, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdf8*=0x268, lpOverlapped=0x0) returned 1 [0033.362] CloseHandle (hObject=0xd8) returned 1 [0033.363] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4RX058L3qJC413r4.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4rx058l3qjc413r4.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.363] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x146d [0033.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1475) returned 0x28e9f8 [0033.363] ReadFile (in: hFile=0xd8, lpBuffer=0x28ea00, nNumberOfBytesToRead=0x146d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fe10*=0x146d, lpOverlapped=0x0) returned 1 [0033.363] CloseHandle (hObject=0xd8) returned 1 [0033.364] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4RX058L3qJC413r4.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4rx058l3qjc413r4.flv.lnk")) returned 1 [0033.364] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.364] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.365] GetTickCount () returned 0x190aa [0033.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.365] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.365] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4RX058L3qJC413r4.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4rx058l3qjc413r4.flv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570\\....\\temporaryfile")) returned 0 [0033.366] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570\\temporaryfile")) returned 1 [0033.367] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.367] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.367] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.367] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.367] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.367] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.367] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.367] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570\\temporaryfile")) returned 1 [0033.367] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f3f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f3f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f3f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.367] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.367] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102570" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102570")) returned 1 [0033.368] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4RX058L3qJC413r4.flv.lnk") returned 0 [0033.368] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4RX058L3qJC413r4.flv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4rx058l3qjc413r4.flv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.368] WriteFile (in: hFile=0xd8, lpBuffer=0x28fe80*, nNumberOfBytesToWrite=0x1478, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28fe80*, lpNumberOfBytesWritten=0x18fdf8*=0x1478, lpOverlapped=0x0) returned 1 [0033.371] CloseHandle (hObject=0xd8) returned 1 [0033.396] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4S7aUwFCgm0F2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4s7auwfcgm0f2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.396] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf6f [0033.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf77) returned 0x2649f0 [0033.396] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf6f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf6f, lpOverlapped=0x0) returned 1 [0033.397] CloseHandle (hObject=0xd8) returned 1 [0033.397] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4S7aUwFCgm0F2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4s7auwfcgm0f2.lnk")) returned 1 [0033.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.397] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.397] GetTickCount () returned 0x190c9 [0033.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265970 [0033.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.398] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102601\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102601\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.398] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4S7aUwFCgm0F2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4s7auwfcgm0f2.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102601\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102601\\....\\temporaryfile")) returned 0 [0033.398] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102601\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102601\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102601\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102601\\temporaryfile")) returned 1 [0033.399] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102601\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f8b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f8b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f8b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.399] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f8b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f8b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f8b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.400] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f8b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f8b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f8b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.400] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102601\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f8b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f8b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f8b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.400] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f8b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f8b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f8b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.400] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f8b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f8b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f8b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.400] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.400] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102601\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102601\\temporaryfile")) returned 1 [0033.400] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18f8b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18f8b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18f8b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.400] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.400] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102601" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102601")) returned 1 [0033.400] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4S7aUwFCgm0F2.lnk") returned 0 [0033.401] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4S7aUwFCgm0F2.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4s7auwfcgm0f2.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.401] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xf78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xf78, lpOverlapped=0x0) returned 1 [0033.402] CloseHandle (hObject=0xd8) returned 1 [0033.403] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4su2oko3I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4su2oko3i.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.403] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa21 [0033.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa29) returned 0x2649f0 [0033.403] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa21, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa21, lpOverlapped=0x0) returned 1 [0033.404] CloseHandle (hObject=0xd8) returned 1 [0033.404] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4su2oko3I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4su2oko3i.lnk")) returned 1 [0033.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.405] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.405] GetTickCount () returned 0x190d9 [0033.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.406] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4su2oko3I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4su2oko3i.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617\\....\\temporaryfile")) returned 0 [0033.406] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617\\temporaryfile")) returned 1 [0033.407] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.407] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.407] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.407] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.407] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.407] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.407] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.407] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617\\temporaryfile")) returned 1 [0033.408] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.408] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.408] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617")) returned 1 [0033.408] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4su2oko3I.lnk") returned 0 [0033.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\4su2oko3I.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4su2oko3i.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.409] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xa28, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xa28, lpOverlapped=0x0) returned 1 [0033.409] CloseHandle (hObject=0xd8) returned 1 [0033.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5-OIo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5-oio.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.411] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3d5 [0033.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3dd) returned 0x25c570 [0033.411] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x3d5, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x3d5, lpOverlapped=0x0) returned 1 [0033.412] CloseHandle (hObject=0xd8) returned 1 [0033.412] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5-OIo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5-oio.lnk")) returned 1 [0033.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.413] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.413] GetTickCount () returned 0x190d9 [0033.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259e70 [0033.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.414] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.414] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5-OIo.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5-oio.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617\\....\\temporaryfile")) returned 0 [0033.414] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617\\temporaryfile")) returned 1 [0033.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.415] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.415] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.415] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.415] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.416] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.416] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617\\temporaryfile")) returned 1 [0033.416] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fb1540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fb1540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fb1540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.416] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.416] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102617" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102617")) returned 1 [0033.416] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5-OIo.lnk") returned 0 [0033.416] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5-OIo.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5-oio.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.417] WriteFile (in: hFile=0xd8, lpBuffer=0x259ee0*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259ee0*, lpNumberOfBytesWritten=0x18fdf8*=0x3e0, lpOverlapped=0x0) returned 1 [0033.418] CloseHandle (hObject=0xd8) returned 1 [0033.419] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5IpCSj0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ipcsj0.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.419] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9f6 [0033.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9fe) returned 0x2649f0 [0033.419] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9f6, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x9f6, lpOverlapped=0x0) returned 1 [0033.420] CloseHandle (hObject=0xd8) returned 1 [0033.420] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5IpCSj0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ipcsj0.lnk")) returned 1 [0033.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.421] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.421] GetTickCount () returned 0x190e9 [0033.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.421] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.422] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5IpCSj0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ipcsj0.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633\\....\\temporaryfile")) returned 0 [0033.422] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633\\temporaryfile")) returned 1 [0033.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.423] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.423] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.423] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.423] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.423] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633\\temporaryfile")) returned 1 [0033.423] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.423] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633")) returned 1 [0033.424] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5IpCSj0.lnk") returned 0 [0033.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5IpCSj0.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ipcsj0.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.424] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xa00, lpOverlapped=0x0) returned 1 [0033.425] CloseHandle (hObject=0xd8) returned 1 [0033.426] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5uCl6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ucl6.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.426] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa00 [0033.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa08) returned 0x2649f0 [0033.426] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa00, lpOverlapped=0x0) returned 1 [0033.427] CloseHandle (hObject=0xd8) returned 1 [0033.427] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5uCl6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ucl6.lnk")) returned 1 [0033.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.428] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.428] GetTickCount () returned 0x190e9 [0033.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.428] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.429] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5uCl6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ucl6.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633\\....\\temporaryfile")) returned 0 [0033.429] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633\\temporaryfile")) returned 1 [0033.430] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.430] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.430] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.430] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.430] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.430] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.430] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.430] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633\\temporaryfile")) returned 1 [0033.431] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18fd76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18fd76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18fd76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.431] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.431] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102633" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102633")) returned 1 [0033.431] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5uCl6.lnk") returned 0 [0033.431] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\5uCl6.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ucl6.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.432] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xa08, lpOverlapped=0x0) returned 1 [0033.432] CloseHandle (hObject=0xd8) returned 1 [0033.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6b 5xTdqcrCQ2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b 5xtdqcrcq2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.433] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9c4 [0033.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9cc) returned 0x2649f0 [0033.433] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9c4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x9c4, lpOverlapped=0x0) returned 1 [0033.434] CloseHandle (hObject=0xd8) returned 1 [0033.435] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6b 5xTdqcrCQ2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b 5xtdqcrcq2.lnk")) returned 1 [0033.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.435] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.435] GetTickCount () returned 0x190f8 [0033.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.436] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.436] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6b 5xTdqcrCQ2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b 5xtdqcrcq2.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648\\....\\temporaryfile")) returned 0 [0033.436] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648\\temporaryfile")) returned 1 [0033.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.438] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.438] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.438] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.438] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.438] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.438] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648\\temporaryfile")) returned 1 [0033.438] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.438] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648")) returned 1 [0033.438] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6b 5xTdqcrCQ2.lnk") returned 0 [0033.439] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6b 5xTdqcrCQ2.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6b 5xtdqcrcq2.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.439] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0x9c8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0x9c8, lpOverlapped=0x0) returned 1 [0033.440] CloseHandle (hObject=0xd8) returned 1 [0033.440] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6CaRSI1gd4xA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6carsi1gd4xa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.441] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9bd [0033.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9c5) returned 0x2649f0 [0033.441] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9bd, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x9bd, lpOverlapped=0x0) returned 1 [0033.441] CloseHandle (hObject=0xd8) returned 1 [0033.441] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6CaRSI1gd4xA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6carsi1gd4xa.lnk")) returned 1 [0033.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.442] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.442] GetTickCount () returned 0x190f8 [0033.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.443] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.443] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6CaRSI1gd4xA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6carsi1gd4xa.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648\\....\\temporaryfile")) returned 0 [0033.443] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648\\temporaryfile")) returned 1 [0033.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.444] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.444] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.445] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.445] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.445] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.445] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.445] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648\\temporaryfile")) returned 1 [0033.445] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x18ffd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x18ffd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x18ffd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.445] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.445] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102648" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102648")) returned 1 [0033.445] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6CaRSI1gd4xA.lnk") returned 0 [0033.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6CaRSI1gd4xA.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6carsi1gd4xa.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.446] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0x9c8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0x9c8, lpOverlapped=0x0) returned 1 [0033.447] CloseHandle (hObject=0xd8) returned 1 [0033.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6fah5Apwpl8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6fah5apwpl8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.448] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf2c [0033.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf34) returned 0x2649f0 [0033.448] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf2c, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf2c, lpOverlapped=0x0) returned 1 [0033.449] CloseHandle (hObject=0xd8) returned 1 [0033.449] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6fah5Apwpl8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6fah5apwpl8.lnk")) returned 1 [0033.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.450] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.450] GetTickCount () returned 0x19108 [0033.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265930 [0033.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.450] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.451] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6fah5Apwpl8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6fah5apwpl8.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664\\....\\temporaryfile")) returned 0 [0033.451] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664\\temporaryfile")) returned 1 [0033.452] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.452] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.452] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.452] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.452] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.452] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.452] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.452] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664\\temporaryfile")) returned 1 [0033.452] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.452] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.452] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664")) returned 1 [0033.453] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6fah5Apwpl8.lnk") returned 0 [0033.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6fah5Apwpl8.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6fah5apwpl8.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.455] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xf30, lpOverlapped=0x0) returned 1 [0033.457] CloseHandle (hObject=0xd8) returned 1 [0033.457] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6GPQLrb9z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6gpqlrb9z.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.457] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x23e [0033.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x246) returned 0x25c570 [0033.457] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x23e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x23e, lpOverlapped=0x0) returned 1 [0033.458] CloseHandle (hObject=0xd8) returned 1 [0033.458] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6GPQLrb9z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6gpqlrb9z.lnk")) returned 1 [0033.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.459] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.459] GetTickCount () returned 0x19108 [0033.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c7c0 [0033.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.460] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.460] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6GPQLrb9z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6gpqlrb9z.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664\\....\\temporaryfile")) returned 0 [0033.460] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664\\temporaryfile")) returned 1 [0033.461] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.461] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.461] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.461] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.462] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.462] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.462] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.462] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664\\temporaryfile")) returned 1 [0033.462] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19023960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19023960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19023960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.462] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.462] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102664" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102664")) returned 1 [0033.462] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6GPQLrb9z.lnk") returned 0 [0033.462] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6GPQLrb9z.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6gpqlrb9z.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.463] WriteFile (in: hFile=0xd8, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdf8*=0x248, lpOverlapped=0x0) returned 1 [0033.464] CloseHandle (hObject=0xd8) returned 1 [0033.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6zAa2BvVTWYN4.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6zaa2bvvtwyn4.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.464] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xeda [0033.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xee2) returned 0x2649f0 [0033.464] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xeda, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xeda, lpOverlapped=0x0) returned 1 [0033.466] CloseHandle (hObject=0xd8) returned 1 [0033.466] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6zAa2BvVTWYN4.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6zaa2bvvtwyn4.flv.lnk")) returned 1 [0033.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.469] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.469] GetTickCount () returned 0x19117 [0033.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2658e0 [0033.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.470] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.470] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6zAa2BvVTWYN4.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6zaa2bvvtwyn4.flv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679\\....\\temporaryfile")) returned 0 [0033.470] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679\\temporaryfile")) returned 1 [0033.471] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.471] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.471] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.471] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.471] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.471] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.472] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.472] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679\\temporaryfile")) returned 1 [0033.472] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.472] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.472] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679")) returned 1 [0033.472] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6zAa2BvVTWYN4.flv.lnk") returned 0 [0033.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\6zAa2BvVTWYN4.flv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6zaa2bvvtwyn4.flv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.473] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xee0, lpOverlapped=0x0) returned 1 [0033.474] CloseHandle (hObject=0xd8) returned 1 [0033.474] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\76hRSKD790-L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\76hrskd790-l.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.474] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa4d [0033.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa55) returned 0x2649f0 [0033.474] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa4d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa4d, lpOverlapped=0x0) returned 1 [0033.475] CloseHandle (hObject=0xd8) returned 1 [0033.475] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\76hRSKD790-L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\76hrskd790-l.lnk")) returned 1 [0033.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.476] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.476] GetTickCount () returned 0x19117 [0033.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.477] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\76hRSKD790-L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\76hrskd790-l.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679\\....\\temporaryfile")) returned 0 [0033.477] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679\\temporaryfile")) returned 1 [0033.478] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.478] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.478] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.478] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.479] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.479] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.479] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.479] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679\\temporaryfile")) returned 1 [0033.479] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19049ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19049ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19049ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.479] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.479] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102679" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102679")) returned 1 [0033.479] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\76hRSKD790-L.lnk") returned 0 [0033.479] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\76hRSKD790-L.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\76hrskd790-l.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.480] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xa58, lpOverlapped=0x0) returned 1 [0033.481] CloseHandle (hObject=0xd8) returned 1 [0033.482] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7fgzkGfed5cplNOCn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7fgzkgfed5cplnocn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.482] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x415 [0033.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x41d) returned 0x259e70 [0033.482] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x415, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x415, lpOverlapped=0x0) returned 1 [0033.482] CloseHandle (hObject=0xd8) returned 1 [0033.482] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7fgzkGfed5cplNOCn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7fgzkgfed5cplnocn.lnk")) returned 1 [0033.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.483] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.483] GetTickCount () returned 0x19127 [0033.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a298 [0033.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.484] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.484] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7fgzkGfed5cplNOCn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7fgzkgfed5cplnocn.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695\\....\\temporaryfile")) returned 0 [0033.484] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695\\temporaryfile")) returned 1 [0033.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.485] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.485] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.486] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.486] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.486] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695\\temporaryfile")) returned 1 [0033.486] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.486] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695")) returned 1 [0033.486] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7fgzkGfed5cplNOCn.lnk") returned 0 [0033.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7fgzkGfed5cplNOCn.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7fgzkgfed5cplnocn.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.487] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0x420, lpOverlapped=0x0) returned 1 [0033.488] CloseHandle (hObject=0xd8) returned 1 [0033.488] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7GRcqO09RMPUte99-j.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7grcqo09rmpute99-j.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.488] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf91 [0033.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf99) returned 0x2649f0 [0033.488] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf91, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf91, lpOverlapped=0x0) returned 1 [0033.489] CloseHandle (hObject=0xd8) returned 1 [0033.489] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7GRcqO09RMPUte99-j.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7grcqo09rmpute99-j.lnk")) returned 1 [0033.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.490] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.490] GetTickCount () returned 0x19127 [0033.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265998 [0033.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.490] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.491] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7GRcqO09RMPUte99-j.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7grcqo09rmpute99-j.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695\\....\\temporaryfile")) returned 0 [0033.491] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695\\temporaryfile")) returned 1 [0033.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.492] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.492] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.492] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.492] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.493] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.493] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695\\temporaryfile")) returned 1 [0033.493] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1906fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1906fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1906fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.493] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.493] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102695" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102695")) returned 1 [0033.493] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7GRcqO09RMPUte99-j.lnk") returned 0 [0033.493] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7GRcqO09RMPUte99-j.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7grcqo09rmpute99-j.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.494] WriteFile (in: hFile=0xd8, lpBuffer=0x261598*, nNumberOfBytesToWrite=0xf98, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x261598*, lpNumberOfBytesWritten=0x18fdf8*=0xf98, lpOverlapped=0x0) returned 1 [0033.495] CloseHandle (hObject=0xd8) returned 1 [0033.495] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7_2Pm_o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7_2pm_o.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.495] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3e1 [0033.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3e9) returned 0x25c570 [0033.496] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x3e1, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x3e1, lpOverlapped=0x0) returned 1 [0033.497] CloseHandle (hObject=0xd8) returned 1 [0033.497] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7_2Pm_o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7_2pm_o.lnk")) returned 1 [0033.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.498] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.498] GetTickCount () returned 0x19137 [0033.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259e70 [0033.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.498] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.498] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7_2Pm_o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7_2pm_o.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711\\....\\temporaryfile")) returned 0 [0033.498] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711\\temporaryfile")) returned 1 [0033.499] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.500] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.500] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.500] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.500] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.500] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.500] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.500] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711\\temporaryfile")) returned 1 [0033.500] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.500] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.500] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711")) returned 1 [0033.500] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7_2Pm_o.lnk") returned 0 [0033.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\7_2Pm_o.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7_2pm_o.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.501] WriteFile (in: hFile=0xd8, lpBuffer=0x259ee0*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259ee0*, lpNumberOfBytesWritten=0x18fdf8*=0x3e8, lpOverlapped=0x0) returned 1 [0033.502] CloseHandle (hObject=0xd8) returned 1 [0033.503] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8kcn2BrTvdA4FudkvK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8kcn2brtvda4fudkvk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.503] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xe9d [0033.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xea5) returned 0x2649f0 [0033.503] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xe9d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xe9d, lpOverlapped=0x0) returned 1 [0033.504] CloseHandle (hObject=0xd8) returned 1 [0033.504] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8kcn2BrTvdA4FudkvK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8kcn2brtvda4fudkvk.lnk")) returned 1 [0033.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.505] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.505] GetTickCount () returned 0x19137 [0033.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2658a0 [0033.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.505] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.506] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8kcn2BrTvdA4FudkvK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8kcn2brtvda4fudkvk.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711\\....\\temporaryfile")) returned 0 [0033.506] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711\\temporaryfile")) returned 1 [0033.507] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.507] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.507] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.507] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.507] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.507] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.507] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711\\temporaryfile")) returned 1 [0033.507] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19095d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19095d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19095d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.508] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.508] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102711" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102711")) returned 1 [0033.508] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8kcn2BrTvdA4FudkvK.lnk") returned 0 [0033.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8kcn2BrTvdA4FudkvK.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8kcn2brtvda4fudkvk.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.509] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xea8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xea8, lpOverlapped=0x0) returned 1 [0033.510] CloseHandle (hObject=0xd8) returned 1 [0033.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8qE80HJgAQ4T-05.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8qe80hjgaq4t-05.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.511] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf44 [0033.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf4c) returned 0x2649f0 [0033.511] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf44, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf44, lpOverlapped=0x0) returned 1 [0033.513] CloseHandle (hObject=0xd8) returned 1 [0033.513] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8qE80HJgAQ4T-05.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8qe80hjgaq4t-05.ots.lnk")) returned 1 [0033.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.513] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.513] GetTickCount () returned 0x19146 [0033.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.514] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.514] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8qE80HJgAQ4T-05.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8qe80hjgaq4t-05.ots.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726\\....\\temporaryfile")) returned 0 [0033.515] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726\\temporaryfile")) returned 1 [0033.516] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.516] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.516] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.516] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.516] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.516] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.516] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.516] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726\\temporaryfile")) returned 1 [0033.516] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.516] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.516] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726")) returned 1 [0033.517] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8qE80HJgAQ4T-05.ots.lnk") returned 0 [0033.517] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8qE80HJgAQ4T-05.ots.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8qe80hjgaq4t-05.ots.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.517] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xf48, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xf48, lpOverlapped=0x0) returned 1 [0033.518] CloseHandle (hObject=0xd8) returned 1 [0033.519] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8RPUZRrEb-g13uY1.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8rpuzrreb-g13uy1.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.519] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x410 [0033.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x418) returned 0x262590 [0033.519] ReadFile (in: hFile=0xd8, lpBuffer=0x262598, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesRead=0x18fe10*=0x410, lpOverlapped=0x0) returned 1 [0033.520] CloseHandle (hObject=0xd8) returned 1 [0033.520] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8RPUZRrEb-g13uY1.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8rpuzrreb-g13uy1.flv.lnk")) returned 1 [0033.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.521] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.521] GetTickCount () returned 0x19146 [0033.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2629b0 [0033.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.521] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.523] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8RPUZRrEb-g13uY1.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8rpuzrreb-g13uy1.flv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726\\....\\temporaryfile")) returned 0 [0033.523] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726\\temporaryfile")) returned 1 [0033.524] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.524] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.524] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.524] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.524] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.524] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.525] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.525] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726\\temporaryfile")) returned 1 [0033.525] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190bbee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190bbee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190bbee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.525] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.525] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102726" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102726")) returned 1 [0033.525] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8RPUZRrEb-g13uY1.flv.lnk") returned 0 [0033.525] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\8RPUZRrEb-g13uY1.flv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8rpuzrreb-g13uy1.flv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.526] WriteFile (in: hFile=0xd8, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdf8*=0x418, lpOverlapped=0x0) returned 1 [0033.527] CloseHandle (hObject=0xd8) returned 1 [0033.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9H9uiT4RQS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9h9uit4rqs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.528] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x243 [0033.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24b) returned 0x25c570 [0033.528] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x243, lpOverlapped=0x0) returned 1 [0033.528] CloseHandle (hObject=0xd8) returned 1 [0033.528] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9H9uiT4RQS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9h9uit4rqs.lnk")) returned 1 [0033.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.529] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.529] GetTickCount () returned 0x19156 [0033.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c7c8 [0033.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.530] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.530] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9H9uiT4RQS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9h9uit4rqs.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742\\....\\temporaryfile")) returned 0 [0033.530] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742\\temporaryfile")) returned 1 [0033.531] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.531] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.531] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.531] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.532] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.532] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.532] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.532] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742\\temporaryfile")) returned 1 [0033.532] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.532] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.532] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742")) returned 1 [0033.532] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9H9uiT4RQS.lnk") returned 0 [0033.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9H9uiT4RQS.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9h9uit4rqs.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.533] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x248, lpOverlapped=0x0) returned 1 [0033.534] CloseHandle (hObject=0xd8) returned 1 [0033.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9rfr3g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9rfr3g.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.535] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3dc [0033.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3e4) returned 0x25c570 [0033.535] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x3dc, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x3dc, lpOverlapped=0x0) returned 1 [0033.535] CloseHandle (hObject=0xd8) returned 1 [0033.535] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9rfr3g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9rfr3g.lnk")) returned 1 [0033.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.536] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.536] GetTickCount () returned 0x19156 [0033.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262590 [0033.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.537] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.537] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9rfr3g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9rfr3g.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742\\....\\temporaryfile")) returned 0 [0033.537] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742\\temporaryfile")) returned 1 [0033.538] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.539] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.539] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.539] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.539] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.539] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.539] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.539] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742\\temporaryfile")) returned 1 [0033.539] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x190e2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x190e2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x190e2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.539] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.539] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102742" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102742")) returned 1 [0033.539] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9rfr3g.lnk") returned 0 [0033.540] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9rfr3g.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9rfr3g.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.540] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x3e0, lpOverlapped=0x0) returned 1 [0033.541] CloseHandle (hObject=0xd8) returned 1 [0033.543] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9Vfajx59Z9Z5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9vfajx59z9z5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.543] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa4d [0033.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa55) returned 0x2649f0 [0033.543] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa4d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa4d, lpOverlapped=0x0) returned 1 [0033.544] CloseHandle (hObject=0xd8) returned 1 [0033.544] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9Vfajx59Z9Z5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9vfajx59z9z5.lnk")) returned 1 [0033.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.545] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.545] GetTickCount () returned 0x19165 [0033.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.545] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.546] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9Vfajx59Z9Z5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9vfajx59z9z5.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757\\....\\temporaryfile")) returned 0 [0033.546] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757\\temporaryfile")) returned 1 [0033.547] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.547] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.547] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.547] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.547] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.547] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.547] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.548] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757\\temporaryfile")) returned 1 [0033.548] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.548] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.548] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757")) returned 1 [0033.548] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9Vfajx59Z9Z5.lnk") returned 0 [0033.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\9Vfajx59Z9Z5.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9vfajx59z9z5.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.549] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa58, lpOverlapped=0x0) returned 1 [0033.550] CloseHandle (hObject=0xd8) returned 1 [0033.551] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\aajrkz KC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aajrkz kc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.551] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa21 [0033.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa29) returned 0x2649f0 [0033.551] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa21, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa21, lpOverlapped=0x0) returned 1 [0033.552] CloseHandle (hObject=0xd8) returned 1 [0033.552] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\aajrkz KC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aajrkz kc.lnk")) returned 1 [0033.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.553] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.553] GetTickCount () returned 0x19165 [0033.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.554] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.554] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\aajrkz KC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aajrkz kc.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757\\....\\temporaryfile")) returned 0 [0033.554] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757\\temporaryfile")) returned 1 [0033.555] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.556] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.556] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.556] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.556] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.556] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.556] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.556] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757\\temporaryfile")) returned 1 [0033.556] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191081a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191081a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191081a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.556] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.556] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102757" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102757")) returned 1 [0033.556] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\aajrkz KC.lnk") returned 0 [0033.557] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\aajrkz KC.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aajrkz kc.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.557] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa28, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa28, lpOverlapped=0x0) returned 1 [0033.558] CloseHandle (hObject=0xd8) returned 1 [0033.560] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ah1cMF2z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ah1cmf2z.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.560] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf0f [0033.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf17) returned 0x2649f0 [0033.560] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf0f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf0f, lpOverlapped=0x0) returned 1 [0033.561] CloseHandle (hObject=0xd8) returned 1 [0033.561] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ah1cMF2z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ah1cmf2z.lnk")) returned 1 [0033.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.561] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.561] GetTickCount () returned 0x19175 [0033.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265910 [0033.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.562] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.562] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ah1cMF2z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ah1cmf2z.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773\\....\\temporaryfile")) returned 0 [0033.562] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773\\temporaryfile")) returned 1 [0033.564] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.564] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.564] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.564] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.564] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.564] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.564] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.564] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773\\temporaryfile")) returned 1 [0033.564] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.564] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.564] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773")) returned 1 [0033.565] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ah1cMF2z.lnk") returned 0 [0033.565] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ah1cMF2z.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ah1cmf2z.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.565] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xf18, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xf18, lpOverlapped=0x0) returned 1 [0033.566] CloseHandle (hObject=0xd8) returned 1 [0033.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\akWullZV3EwuyRnw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\akwullzv3ewuyrnw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.567] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa79 [0033.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa81) returned 0x2649f0 [0033.567] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa79, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa79, lpOverlapped=0x0) returned 1 [0033.568] CloseHandle (hObject=0xd8) returned 1 [0033.568] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\akWullZV3EwuyRnw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\akwullzv3ewuyrnw.lnk")) returned 1 [0033.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.569] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.569] GetTickCount () returned 0x19175 [0033.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.570] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.570] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\akWullZV3EwuyRnw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\akwullzv3ewuyrnw.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773\\....\\temporaryfile")) returned 0 [0033.570] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773\\temporaryfile")) returned 1 [0033.571] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.571] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.571] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.571] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.572] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.572] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.572] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.572] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773\\temporaryfile")) returned 1 [0033.572] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1912e300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1912e300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1912e300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.572] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.572] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102773" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102773")) returned 1 [0033.572] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\akWullZV3EwuyRnw.lnk") returned 0 [0033.572] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\akWullZV3EwuyRnw.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\akwullzv3ewuyrnw.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.573] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa80, lpOverlapped=0x0) returned 1 [0033.574] CloseHandle (hObject=0xd8) returned 1 [0033.575] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Auw4sdsTepKYeu356.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\auw4sdstepkyeu356.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.575] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x266 [0033.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26e) returned 0x25c570 [0033.575] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x266, lpOverlapped=0x0) returned 1 [0033.576] CloseHandle (hObject=0xd8) returned 1 [0033.576] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Auw4sdsTepKYeu356.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\auw4sdstepkyeu356.lnk")) returned 1 [0033.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.577] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.577] GetTickCount () returned 0x19185 [0033.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.578] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.578] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Auw4sdsTepKYeu356.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\auw4sdstepkyeu356.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789\\....\\temporaryfile")) returned 0 [0033.578] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789\\temporaryfile")) returned 1 [0033.581] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.581] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.581] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.581] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.582] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.582] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.582] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.582] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789\\temporaryfile")) returned 1 [0033.582] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.582] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.582] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789")) returned 1 [0033.582] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Auw4sdsTepKYeu356.lnk") returned 0 [0033.582] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Auw4sdsTepKYeu356.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\auw4sdstepkyeu356.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.583] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x270, lpOverlapped=0x0) returned 1 [0033.584] CloseHandle (hObject=0xd8) returned 1 [0033.585] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\axiblyMnDJq6wybsV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\axiblymndjq6wybsv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.585] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa84 [0033.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa8c) returned 0x2649f0 [0033.585] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa84, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa84, lpOverlapped=0x0) returned 1 [0033.585] CloseHandle (hObject=0xd8) returned 1 [0033.585] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\axiblyMnDJq6wybsV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\axiblymndjq6wybsv.lnk")) returned 1 [0033.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.586] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.586] GetTickCount () returned 0x19185 [0033.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.587] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.587] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\axiblyMnDJq6wybsV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\axiblymndjq6wybsv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789\\....\\temporaryfile")) returned 0 [0033.588] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789\\temporaryfile")) returned 1 [0033.589] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.589] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.589] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.589] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.589] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.589] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.589] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.589] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789\\temporaryfile")) returned 1 [0033.589] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19154460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19154460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19154460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.589] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.589] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102789" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102789")) returned 1 [0033.590] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\axiblyMnDJq6wybsV.lnk") returned 0 [0033.590] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\axiblyMnDJq6wybsV.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\axiblymndjq6wybsv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.591] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa88, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa88, lpOverlapped=0x0) returned 1 [0033.591] CloseHandle (hObject=0xd8) returned 1 [0033.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Azl-UDflFCdqTtxVRZ5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\azl-udflfcdqttxvrz5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.592] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xfd1 [0033.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfd9) returned 0x2649f0 [0033.592] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xfd1, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xfd1, lpOverlapped=0x0) returned 1 [0033.593] CloseHandle (hObject=0xd8) returned 1 [0033.593] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Azl-UDflFCdqTtxVRZ5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\azl-udflfcdqttxvrz5.lnk")) returned 1 [0033.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.594] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.594] GetTickCount () returned 0x19194 [0033.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.594] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.595] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Azl-UDflFCdqTtxVRZ5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\azl-udflfcdqttxvrz5.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804\\....\\temporaryfile")) returned 0 [0033.595] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804\\temporaryfile")) returned 1 [0033.596] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.596] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.596] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.596] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.596] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.596] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.596] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.596] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804\\temporaryfile")) returned 1 [0033.597] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.597] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.597] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804")) returned 1 [0033.597] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Azl-UDflFCdqTtxVRZ5.lnk") returned 0 [0033.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Azl-UDflFCdqTtxVRZ5.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\azl-udflfcdqttxvrz5.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.598] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xfd8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xfd8, lpOverlapped=0x0) returned 1 [0033.598] CloseHandle (hObject=0xd8) returned 1 [0033.599] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\b1Al6ru.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b1al6ru.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.599] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3e1 [0033.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3e9) returned 0x25c570 [0033.599] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x3e1, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x3e1, lpOverlapped=0x0) returned 1 [0033.600] CloseHandle (hObject=0xd8) returned 1 [0033.600] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\b1Al6ru.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b1al6ru.mkv.lnk")) returned 1 [0033.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.601] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.601] GetTickCount () returned 0x19194 [0033.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262590 [0033.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.602] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.602] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\b1Al6ru.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b1al6ru.mkv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804\\....\\temporaryfile")) returned 0 [0033.602] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804\\temporaryfile")) returned 1 [0033.603] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.604] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.604] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.604] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.604] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.604] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.604] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.604] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804\\temporaryfile")) returned 1 [0033.604] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1917a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1917a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1917a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.604] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.604] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102804" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102804")) returned 1 [0033.604] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\b1Al6ru.mkv.lnk") returned 0 [0033.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\b1Al6ru.mkv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b1al6ru.mkv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.605] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x3e8, lpOverlapped=0x0) returned 1 [0033.609] CloseHandle (hObject=0xd8) returned 1 [0033.610] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\BEthdv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bethdv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.610] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa0b [0033.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa13) returned 0x2649f0 [0033.610] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa0b, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa0b, lpOverlapped=0x0) returned 1 [0033.611] CloseHandle (hObject=0xd8) returned 1 [0033.611] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\BEthdv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bethdv.lnk")) returned 1 [0033.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.612] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.612] GetTickCount () returned 0x191a4 [0033.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.612] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.612] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\BEthdv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bethdv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820\\....\\temporaryfile")) returned 0 [0033.613] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820\\temporaryfile")) returned 1 [0033.614] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.614] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.614] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.614] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.614] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.614] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.614] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.614] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820\\temporaryfile")) returned 1 [0033.614] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.614] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.614] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820")) returned 1 [0033.615] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\BEthdv.lnk") returned 0 [0033.615] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\BEthdv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bethdv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.615] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa10, lpOverlapped=0x0) returned 1 [0033.616] CloseHandle (hObject=0xd8) returned 1 [0033.617] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\C 8INbgLqg8.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c 8inbglqg8.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.617] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x38d [0033.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x395) returned 0x25c570 [0033.617] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x38d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x38d, lpOverlapped=0x0) returned 1 [0033.618] CloseHandle (hObject=0xd8) returned 1 [0033.618] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\C 8INbgLqg8.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c 8inbglqg8.mkv.lnk")) returned 1 [0033.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.618] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.619] GetTickCount () returned 0x191a4 [0033.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c910 [0033.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.619] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.620] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\C 8INbgLqg8.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c 8inbglqg8.mkv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820\\....\\temporaryfile")) returned 0 [0033.620] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820\\temporaryfile")) returned 1 [0033.621] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.621] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.621] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.622] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.622] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.622] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.622] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820\\temporaryfile")) returned 1 [0033.622] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191a0720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191a0720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191a0720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.622] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102820" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102820")) returned 1 [0033.622] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\C 8INbgLqg8.mkv.lnk") returned 0 [0033.622] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\C 8INbgLqg8.mkv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c 8inbglqg8.mkv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.623] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x398, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x398, lpOverlapped=0x0) returned 1 [0033.624] CloseHandle (hObject=0xd8) returned 1 [0033.625] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Ck73aG03huDrzd07UJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck73ag03hudrzd07uj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.625] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf7d [0033.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf85) returned 0x2649f0 [0033.625] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf7d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf7d, lpOverlapped=0x0) returned 1 [0033.626] CloseHandle (hObject=0xd8) returned 1 [0033.626] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Ck73aG03huDrzd07UJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck73ag03hudrzd07uj.lnk")) returned 1 [0033.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.627] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.627] GetTickCount () returned 0x191b3 [0033.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.627] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.627] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Ck73aG03huDrzd07UJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck73ag03hudrzd07uj.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835\\....\\temporaryfile")) returned 0 [0033.628] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835\\temporaryfile")) returned 1 [0033.629] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.629] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.629] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.629] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.629] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.629] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.629] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.629] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835\\temporaryfile")) returned 1 [0033.629] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.629] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.629] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835")) returned 1 [0033.629] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Ck73aG03huDrzd07UJ.lnk") returned 0 [0033.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Ck73aG03huDrzd07UJ.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck73ag03hudrzd07uj.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.630] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xf88, lpOverlapped=0x0) returned 1 [0033.631] CloseHandle (hObject=0xd8) returned 1 [0033.632] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CPySWMll AnWU6bLZ9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cpyswmll anwu6blz9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.632] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa8f [0033.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa97) returned 0x2649f0 [0033.632] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa8f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa8f, lpOverlapped=0x0) returned 1 [0033.633] CloseHandle (hObject=0xd8) returned 1 [0033.633] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CPySWMll AnWU6bLZ9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cpyswmll anwu6blz9.lnk")) returned 1 [0033.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.634] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.634] GetTickCount () returned 0x191b3 [0033.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.634] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.635] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CPySWMll AnWU6bLZ9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cpyswmll anwu6blz9.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835\\....\\temporaryfile")) returned 0 [0033.635] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835\\temporaryfile")) returned 1 [0033.636] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.636] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.636] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.636] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.636] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.637] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.637] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.638] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835\\temporaryfile")) returned 1 [0033.638] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191c6880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191c6880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191c6880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.638] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.638] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102835" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102835")) returned 1 [0033.638] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CPySWMll AnWU6bLZ9.lnk") returned 0 [0033.638] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CPySWMll AnWU6bLZ9.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cpyswmll anwu6blz9.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.639] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa98, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa98, lpOverlapped=0x0) returned 1 [0033.640] CloseHandle (hObject=0xd8) returned 1 [0033.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\cV435fL13v.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cv435fl13v.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.640] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x243 [0033.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24b) returned 0x25c570 [0033.640] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x243, lpOverlapped=0x0) returned 1 [0033.641] CloseHandle (hObject=0xd8) returned 1 [0033.641] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\cV435fL13v.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cv435fl13v.lnk")) returned 1 [0033.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.642] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.642] GetTickCount () returned 0x191c3 [0033.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c7c8 [0033.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.643] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\cV435fL13v.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cv435fl13v.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851\\....\\temporaryfile")) returned 0 [0033.643] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851\\temporaryfile")) returned 1 [0033.644] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.644] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.644] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.644] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.644] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.644] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.644] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.645] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851\\temporaryfile")) returned 1 [0033.645] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.645] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.645] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851")) returned 1 [0033.645] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\cV435fL13v.lnk") returned 0 [0033.645] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\cV435fL13v.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cv435fl13v.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.646] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x248, lpOverlapped=0x0) returned 1 [0033.646] CloseHandle (hObject=0xd8) returned 1 [0033.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\DB4Pt MG-kRMN5PaImf6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\db4pt mg-krmn5paimf6.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.647] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2d8 [0033.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e0) returned 0x25c570 [0033.647] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x2d8, lpOverlapped=0x0) returned 1 [0033.648] CloseHandle (hObject=0xd8) returned 1 [0033.648] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\DB4Pt MG-kRMN5PaImf6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\db4pt mg-krmn5paimf6.lnk")) returned 1 [0033.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.649] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.649] GetTickCount () returned 0x191c3 [0033.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.651] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.651] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\DB4Pt MG-kRMN5PaImf6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\db4pt mg-krmn5paimf6.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851\\....\\temporaryfile")) returned 0 [0033.651] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851\\temporaryfile")) returned 1 [0033.653] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.653] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.653] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.653] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.653] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.654] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.654] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.654] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851\\temporaryfile")) returned 1 [0033.654] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x191ec9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x191ec9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x191ec9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.654] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.654] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102851" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102851")) returned 1 [0033.654] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\DB4Pt MG-kRMN5PaImf6.lnk") returned 0 [0033.654] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\DB4Pt MG-kRMN5PaImf6.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\db4pt mg-krmn5paimf6.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.655] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x2e0, lpOverlapped=0x0) returned 1 [0033.656] CloseHandle (hObject=0xd8) returned 1 [0033.656] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.656] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1b0 [0033.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b8) returned 0x25c570 [0033.656] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x1b0, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x1b0, lpOverlapped=0x0) returned 1 [0033.657] CloseHandle (hObject=0xd8) returned 1 [0033.657] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 1 [0033.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.658] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.658] GetTickCount () returned 0x191d3 [0033.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c730 [0033.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.659] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.659] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867\\....\\temporaryfile")) returned 0 [0033.659] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867\\temporaryfile")) returned 1 [0033.660] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.660] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.661] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.661] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.661] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.661] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.661] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.661] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867\\temporaryfile")) returned 1 [0033.661] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.661] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.661] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867")) returned 1 [0033.661] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\desktop.ini") returned 0 [0033.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.662] WriteFile (in: hFile=0xd8, lpBuffer=0x25c738*, nNumberOfBytesToWrite=0x1b8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c738*, lpNumberOfBytesWritten=0x18fdf8*=0x1b8, lpOverlapped=0x0) returned 1 [0033.663] CloseHandle (hObject=0xd8) returned 1 [0033.664] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\dFSJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dfsj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.664] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9d5 [0033.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9dd) returned 0x2649f0 [0033.664] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9d5, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x9d5, lpOverlapped=0x0) returned 1 [0033.665] CloseHandle (hObject=0xd8) returned 1 [0033.665] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\dFSJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dfsj.lnk")) returned 1 [0033.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.665] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.666] GetTickCount () returned 0x191d3 [0033.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.666] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.667] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\dFSJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dfsj.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867\\....\\temporaryfile")) returned 0 [0033.667] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867\\temporaryfile")) returned 1 [0033.668] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.668] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.668] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.668] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.668] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.668] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.668] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.668] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867\\temporaryfile")) returned 1 [0033.669] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19212b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19212b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19212b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.669] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.669] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102867" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102867")) returned 1 [0033.669] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\dFSJ.lnk") returned 0 [0033.669] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\dFSJ.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dfsj.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.670] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0x9e0, lpOverlapped=0x0) returned 1 [0033.670] CloseHandle (hObject=0xd8) returned 1 [0033.671] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\E5dSTIR0F62ceIRi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e5dstir0f62ceiri.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.671] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa79 [0033.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa81) returned 0x2649f0 [0033.671] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa79, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa79, lpOverlapped=0x0) returned 1 [0033.672] CloseHandle (hObject=0xd8) returned 1 [0033.672] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\E5dSTIR0F62ceIRi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e5dstir0f62ceiri.lnk")) returned 1 [0033.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.673] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.673] GetTickCount () returned 0x191e2 [0033.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.674] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.674] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\E5dSTIR0F62ceIRi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e5dstir0f62ceiri.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882\\....\\temporaryfile")) returned 0 [0033.674] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882\\temporaryfile")) returned 1 [0033.675] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19238ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19238ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19238ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.675] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19238ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19238ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19238ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.675] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19238ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19238ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19238ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.675] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19238ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19238ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19238ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.675] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19238ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19238ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19238ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.675] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19238ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19238ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19238ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.675] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.675] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882\\temporaryfile")) returned 1 [0033.676] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19238ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19238ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19238ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.676] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.676] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882")) returned 1 [0033.676] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\E5dSTIR0F62ceIRi.lnk") returned 0 [0033.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\E5dSTIR0F62ceIRi.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e5dstir0f62ceiri.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.677] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa80, lpOverlapped=0x0) returned 1 [0033.678] CloseHandle (hObject=0xd8) returned 1 [0033.678] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eDeJvIUF8LXYojXe.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edejviuf8lxyojxe.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.678] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa72 [0033.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa7a) returned 0x2649f0 [0033.678] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa72, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa72, lpOverlapped=0x0) returned 1 [0033.679] CloseHandle (hObject=0xd8) returned 1 [0033.679] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eDeJvIUF8LXYojXe.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edejviuf8lxyojxe.lnk")) returned 1 [0033.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.680] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.680] GetTickCount () returned 0x191e2 [0033.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.687] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.687] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eDeJvIUF8LXYojXe.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edejviuf8lxyojxe.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882\\....\\temporaryfile")) returned 0 [0033.687] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882\\temporaryfile")) returned 1 [0033.688] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19238ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.688] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19238ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.689] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.689] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.689] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.689] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.689] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.689] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882\\temporaryfile")) returned 1 [0033.689] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.689] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.689] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102882" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102882")) returned 1 [0033.689] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eDeJvIUF8LXYojXe.lnk") returned 0 [0033.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eDeJvIUF8LXYojXe.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edejviuf8lxyojxe.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.690] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa78, lpOverlapped=0x0) returned 1 [0033.691] CloseHandle (hObject=0xd8) returned 1 [0033.692] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\EDgV-s2v0.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edgv-s2v0.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.692] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9cd [0033.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9d5) returned 0x2649f0 [0033.692] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9cd, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x9cd, lpOverlapped=0x0) returned 1 [0033.693] CloseHandle (hObject=0xd8) returned 1 [0033.693] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\EDgV-s2v0.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edgv-s2v0.mkv.lnk")) returned 1 [0033.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.694] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.694] GetTickCount () returned 0x191f2 [0033.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.694] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102898\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102898\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.695] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\EDgV-s2v0.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edgv-s2v0.mkv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102898\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102898\\....\\temporaryfile")) returned 0 [0033.695] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102898\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102898\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102898\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102898\\temporaryfile")) returned 1 [0033.696] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102898\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.696] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.696] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.696] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102898\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.696] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.696] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.696] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.696] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102898\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102898\\temporaryfile")) returned 1 [0033.697] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1925ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1925ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1925ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.697] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102898" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102898")) returned 1 [0033.697] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\EDgV-s2v0.mkv.lnk") returned 0 [0033.697] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\EDgV-s2v0.mkv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edgv-s2v0.mkv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.698] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x9d8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0x9d8, lpOverlapped=0x0) returned 1 [0033.701] CloseHandle (hObject=0xd8) returned 1 [0033.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\EDxoaq8Iw18ul.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edxoaq8iw18ul.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.702] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x252 [0033.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25a) returned 0x25c570 [0033.702] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x252, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x252, lpOverlapped=0x0) returned 1 [0033.703] CloseHandle (hObject=0xd8) returned 1 [0033.703] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\EDxoaq8Iw18ul.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edxoaq8iw18ul.lnk")) returned 1 [0033.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.704] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.704] GetTickCount () returned 0x19201 [0033.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.704] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.705] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\EDxoaq8Iw18ul.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edxoaq8iw18ul.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913\\....\\temporaryfile")) returned 0 [0033.705] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913\\temporaryfile")) returned 1 [0033.706] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.706] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.706] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.706] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.706] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.706] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.706] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.706] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913\\temporaryfile")) returned 1 [0033.706] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.706] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.707] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913")) returned 1 [0033.707] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\EDxoaq8Iw18ul.lnk") returned 0 [0033.707] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\EDxoaq8Iw18ul.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\edxoaq8iw18ul.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.707] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x258, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x258, lpOverlapped=0x0) returned 1 [0033.708] CloseHandle (hObject=0xd8) returned 1 [0033.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eiXRArevP-KNSUGJ1km.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eixrarevp-knsugj1km.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.709] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xfd1 [0033.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfd9) returned 0x2649f0 [0033.709] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xfd1, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xfd1, lpOverlapped=0x0) returned 1 [0033.710] CloseHandle (hObject=0xd8) returned 1 [0033.710] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eiXRArevP-KNSUGJ1km.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eixrarevp-knsugj1km.lnk")) returned 1 [0033.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.711] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.711] GetTickCount () returned 0x19201 [0033.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.711] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.712] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eiXRArevP-KNSUGJ1km.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eixrarevp-knsugj1km.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913\\....\\temporaryfile")) returned 0 [0033.712] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913\\temporaryfile")) returned 1 [0033.713] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.713] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.713] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.713] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.713] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.713] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.713] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.713] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913\\temporaryfile")) returned 1 [0033.714] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19284f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19284f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19284f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.714] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.714] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102913" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102913")) returned 1 [0033.714] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eiXRArevP-KNSUGJ1km.lnk") returned 0 [0033.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eiXRArevP-KNSUGJ1km.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eixrarevp-knsugj1km.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.716] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xfd8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xfd8, lpOverlapped=0x0) returned 1 [0033.717] CloseHandle (hObject=0xd8) returned 1 [0033.718] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ESHHI8tKuSTh9Xs1d.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eshhi8tkusth9xs1d.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.718] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x296 [0033.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x29e) returned 0x25c570 [0033.718] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x296, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x296, lpOverlapped=0x0) returned 1 [0033.718] CloseHandle (hObject=0xd8) returned 1 [0033.719] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ESHHI8tKuSTh9Xs1d.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eshhi8tkusth9xs1d.lnk")) returned 1 [0033.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.719] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.719] GetTickCount () returned 0x19211 [0033.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.720] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.720] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ESHHI8tKuSTh9Xs1d.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eshhi8tkusth9xs1d.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929\\....\\temporaryfile")) returned 0 [0033.720] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929\\temporaryfile")) returned 1 [0033.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.722] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.722] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.722] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.722] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.722] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.722] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.722] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929\\temporaryfile")) returned 1 [0033.722] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.722] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.722] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929")) returned 1 [0033.722] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ESHHI8tKuSTh9Xs1d.lnk") returned 0 [0033.723] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ESHHI8tKuSTh9Xs1d.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eshhi8tkusth9xs1d.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.723] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x2a0, lpOverlapped=0x0) returned 1 [0033.724] CloseHandle (hObject=0xd8) returned 1 [0033.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eYe5rxlt-hbeM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eye5rxlt-hbem.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.725] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xe5e [0033.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe66) returned 0x2649f0 [0033.725] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xe5e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xe5e, lpOverlapped=0x0) returned 1 [0033.725] CloseHandle (hObject=0xd8) returned 1 [0033.725] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eYe5rxlt-hbeM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eye5rxlt-hbem.lnk")) returned 1 [0033.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.726] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.726] GetTickCount () returned 0x19211 [0033.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.727] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.727] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eYe5rxlt-hbeM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eye5rxlt-hbem.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929\\....\\temporaryfile")) returned 0 [0033.728] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929\\temporaryfile")) returned 1 [0033.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.729] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.729] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.729] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.729] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.729] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929\\temporaryfile")) returned 1 [0033.729] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192ab0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192ab0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192ab0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.729] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102929" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102929")) returned 1 [0033.730] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eYe5rxlt-hbeM.lnk") returned 0 [0033.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\eYe5rxlt-hbeM.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eye5rxlt-hbem.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.731] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xe68, lpOverlapped=0x0) returned 1 [0033.732] CloseHandle (hObject=0xd8) returned 1 [0033.732] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\fDaXSi7d38rWdnWNf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdaxsi7d38rwdnwnf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.732] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xfbb [0033.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfc3) returned 0x2649f0 [0033.732] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xfbb, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xfbb, lpOverlapped=0x0) returned 1 [0033.733] CloseHandle (hObject=0xd8) returned 1 [0033.733] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\fDaXSi7d38rWdnWNf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdaxsi7d38rwdnwnf.lnk")) returned 1 [0033.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.734] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.734] GetTickCount () returned 0x19221 [0033.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2659c0 [0033.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.735] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.735] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\fDaXSi7d38rWdnWNf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdaxsi7d38rwdnwnf.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945\\....\\temporaryfile")) returned 0 [0033.735] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945\\temporaryfile")) returned 1 [0033.736] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.736] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.736] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.736] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.736] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.736] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.736] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945\\temporaryfile")) returned 1 [0033.737] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.737] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945")) returned 1 [0033.737] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\fDaXSi7d38rWdnWNf.lnk") returned 0 [0033.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\fDaXSi7d38rWdnWNf.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdaxsi7d38rwdnwnf.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.738] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xfc0, lpOverlapped=0x0) returned 1 [0033.739] CloseHandle (hObject=0xd8) returned 1 [0033.739] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\fpkLEmTA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fpklemta.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.739] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3e8 [0033.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3f0) returned 0x25c570 [0033.740] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x3e8, lpOverlapped=0x0) returned 1 [0033.740] CloseHandle (hObject=0xd8) returned 1 [0033.740] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\fpkLEmTA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fpklemta.lnk")) returned 1 [0033.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.741] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.741] GetTickCount () returned 0x19221 [0033.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262590 [0033.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.743] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.743] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\fpkLEmTA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fpklemta.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945\\....\\temporaryfile")) returned 0 [0033.743] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945\\temporaryfile")) returned 1 [0033.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.744] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.745] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.745] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.745] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.745] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.745] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945\\temporaryfile")) returned 1 [0033.745] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192d1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192d1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192d1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.745] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102945" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102945")) returned 1 [0033.745] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\fpkLEmTA.lnk") returned 0 [0033.745] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\fpkLEmTA.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fpklemta.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.746] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x3f0, lpOverlapped=0x0) returned 1 [0033.747] CloseHandle (hObject=0xd8) returned 1 [0033.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\GwN9jYVw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwn9jyvw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.748] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x239 [0033.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x241) returned 0x25c570 [0033.748] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x239, lpOverlapped=0x0) returned 1 [0033.749] CloseHandle (hObject=0xd8) returned 1 [0033.749] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\GwN9jYVw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwn9jyvw.lnk")) returned 1 [0033.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.750] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.750] GetTickCount () returned 0x19230 [0033.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c7c0 [0033.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.750] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.751] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\GwN9jYVw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwn9jyvw.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960\\....\\temporaryfile")) returned 0 [0033.751] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960\\temporaryfile")) returned 1 [0033.752] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.752] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.752] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.752] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.752] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.752] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.752] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.752] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960\\temporaryfile")) returned 1 [0033.753] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.753] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.753] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960")) returned 1 [0033.753] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\GwN9jYVw.lnk") returned 0 [0033.753] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\GwN9jYVw.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwn9jyvw.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.754] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x240, lpOverlapped=0x0) returned 1 [0033.755] CloseHandle (hObject=0xd8) returned 1 [0033.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\H938whtrhk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h938whtrhk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.755] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x273 [0033.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x27b) returned 0x25c570 [0033.755] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x273, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x273, lpOverlapped=0x0) returned 1 [0033.756] CloseHandle (hObject=0xd8) returned 1 [0033.756] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\H938whtrhk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h938whtrhk.lnk")) returned 1 [0033.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.757] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.757] GetTickCount () returned 0x19230 [0033.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c7f8 [0033.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.758] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.758] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\H938whtrhk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h938whtrhk.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960\\....\\temporaryfile")) returned 0 [0033.758] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960\\temporaryfile")) returned 1 [0033.759] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.759] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.759] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.759] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.760] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.760] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.760] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.760] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960\\temporaryfile")) returned 1 [0033.760] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x192f7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x192f7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x192f7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.760] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.760] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102960" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102960")) returned 1 [0033.760] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\H938whtrhk.lnk") returned 0 [0033.760] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\H938whtrhk.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h938whtrhk.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.761] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x278, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x278, lpOverlapped=0x0) returned 1 [0033.762] CloseHandle (hObject=0xd8) returned 1 [0033.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\hap-mdvd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hap-mdvd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.763] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf1c [0033.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf24) returned 0x2649f0 [0033.763] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf1c, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf1c, lpOverlapped=0x0) returned 1 [0033.763] CloseHandle (hObject=0xd8) returned 1 [0033.764] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\hap-mdvd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hap-mdvd.lnk")) returned 1 [0033.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.764] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.764] GetTickCount () returned 0x19240 [0033.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265920 [0033.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.765] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.765] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\hap-mdvd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hap-mdvd.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976\\....\\temporaryfile")) returned 0 [0033.765] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976\\temporaryfile")) returned 1 [0033.766] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.766] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.766] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.766] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.767] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.767] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.767] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.767] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976\\temporaryfile")) returned 1 [0033.767] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.767] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.767] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976")) returned 1 [0033.767] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\hap-mdvd.lnk") returned 0 [0033.768] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\hap-mdvd.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hap-mdvd.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.768] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xf20, lpOverlapped=0x0) returned 1 [0033.769] CloseHandle (hObject=0xd8) returned 1 [0033.770] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\HDB0GdLUiySD7s83WAzQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hdb0gdluiysd7s83wazq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.770] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x429 [0033.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x431) returned 0x262590 [0033.770] ReadFile (in: hFile=0xd8, lpBuffer=0x262598, nNumberOfBytesToRead=0x429, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesRead=0x18fe10*=0x429, lpOverlapped=0x0) returned 1 [0033.770] CloseHandle (hObject=0xd8) returned 1 [0033.770] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\HDB0GdLUiySD7s83WAzQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hdb0gdluiysd7s83wazq.lnk")) returned 1 [0033.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.771] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.771] GetTickCount () returned 0x19240 [0033.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.772] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.772] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\HDB0GdLUiySD7s83WAzQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hdb0gdluiysd7s83wazq.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976\\....\\temporaryfile")) returned 0 [0033.773] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976\\temporaryfile")) returned 1 [0033.774] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.774] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.774] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.774] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.774] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.774] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.774] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.774] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976\\temporaryfile")) returned 1 [0033.774] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1931d4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1931d4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1931d4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.774] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.774] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102976" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102976")) returned 1 [0033.775] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\HDB0GdLUiySD7s83WAzQ.lnk") returned 0 [0033.775] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\HDB0GdLUiySD7s83WAzQ.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hdb0gdluiysd7s83wazq.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.775] WriteFile (in: hFile=0xd8, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdf8*=0x430, lpOverlapped=0x0) returned 1 [0033.776] CloseHandle (hObject=0xd8) returned 1 [0033.777] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\hYLZvHOHq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hylzvhohq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.778] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3ed [0033.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3f5) returned 0x25c570 [0033.778] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x3ed, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x3ed, lpOverlapped=0x0) returned 1 [0033.778] CloseHandle (hObject=0xd8) returned 1 [0033.779] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\hYLZvHOHq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hylzvhohq.lnk")) returned 1 [0033.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.779] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.779] GetTickCount () returned 0x1924f [0033.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262590 [0033.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.781] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.781] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\hYLZvHOHq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hylzvhohq.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991\\....\\temporaryfile")) returned 0 [0033.781] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991\\temporaryfile")) returned 1 [0033.782] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.782] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.782] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.782] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.783] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.783] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.783] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.783] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991\\temporaryfile")) returned 1 [0033.783] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.783] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.783] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991")) returned 1 [0033.783] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\hYLZvHOHq.lnk") returned 0 [0033.783] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\hYLZvHOHq.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hylzvhohq.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.784] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x3f8, lpOverlapped=0x0) returned 1 [0033.785] CloseHandle (hObject=0xd8) returned 1 [0033.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\i4dQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i4dq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.786] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1bd [0033.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c5) returned 0x25c570 [0033.786] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x1bd, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x1bd, lpOverlapped=0x0) returned 1 [0033.786] CloseHandle (hObject=0xd8) returned 1 [0033.786] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\i4dQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i4dq.lnk")) returned 1 [0033.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.787] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.787] GetTickCount () returned 0x1924f [0033.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c740 [0033.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.788] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.788] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\i4dQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i4dq.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991\\....\\temporaryfile")) returned 0 [0033.789] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991\\temporaryfile")) returned 1 [0033.790] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.790] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.790] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.790] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.790] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.790] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.790] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.790] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991\\temporaryfile")) returned 1 [0033.790] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19343640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19343640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19343640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.790] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.790] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18102991" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18102991")) returned 1 [0033.791] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\i4dQ.lnk") returned 0 [0033.791] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\i4dQ.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i4dq.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.791] WriteFile (in: hFile=0xd8, lpBuffer=0x25c748*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c748*, lpNumberOfBytesWritten=0x18fdf8*=0x1c8, lpOverlapped=0x0) returned 1 [0033.792] CloseHandle (hObject=0xd8) returned 1 [0033.794] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\iJAd4NLQA5m2_U7sFDwi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ijad4nlqa5m2_u7sfdwi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.794] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xaa5 [0033.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaad) returned 0x2649f0 [0033.794] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xaa5, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xaa5, lpOverlapped=0x0) returned 1 [0033.794] CloseHandle (hObject=0xd8) returned 1 [0033.795] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\iJAd4NLQA5m2_U7sFDwi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ijad4nlqa5m2_u7sfdwi.lnk")) returned 1 [0033.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.795] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.795] GetTickCount () returned 0x1925f [0033.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.796] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.796] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\iJAd4NLQA5m2_U7sFDwi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ijad4nlqa5m2_u7sfdwi.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007\\....\\temporaryfile")) returned 0 [0033.796] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007\\temporaryfile")) returned 1 [0033.797] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.797] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.798] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.798] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.798] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.798] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.798] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007\\temporaryfile")) returned 1 [0033.798] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.798] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007")) returned 1 [0033.798] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\iJAd4NLQA5m2_U7sFDwi.lnk") returned 0 [0033.799] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\iJAd4NLQA5m2_U7sFDwi.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ijad4nlqa5m2_u7sfdwi.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.799] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xab0, lpOverlapped=0x0) returned 1 [0033.800] CloseHandle (hObject=0xd8) returned 1 [0033.801] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\imF1N2GKr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\imf1n2gkr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.801] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x23e [0033.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x246) returned 0x25c570 [0033.801] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x23e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x23e, lpOverlapped=0x0) returned 1 [0033.801] CloseHandle (hObject=0xd8) returned 1 [0033.802] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\imF1N2GKr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\imf1n2gkr.lnk")) returned 1 [0033.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.802] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.802] GetTickCount () returned 0x1925f [0033.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c7c0 [0033.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.803] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.803] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\imF1N2GKr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\imf1n2gkr.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007\\....\\temporaryfile")) returned 0 [0033.804] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007\\temporaryfile")) returned 1 [0033.805] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.805] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.805] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.805] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.805] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.805] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.805] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.805] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007\\temporaryfile")) returned 1 [0033.805] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x193697a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x193697a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x193697a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.805] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.805] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103007" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103007")) returned 1 [0033.806] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\imF1N2GKr.lnk") returned 0 [0033.806] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\imF1N2GKr.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\imf1n2gkr.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.806] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x248, lpOverlapped=0x0) returned 1 [0033.807] CloseHandle (hObject=0xd8) returned 1 [0033.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\IpQ3E_cZPa8PdDey.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ipq3e_czpa8pddey.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.808] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x261 [0033.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x269) returned 0x25c570 [0033.808] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x261, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x261, lpOverlapped=0x0) returned 1 [0033.809] CloseHandle (hObject=0xd8) returned 1 [0033.809] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\IpQ3E_cZPa8PdDey.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ipq3e_czpa8pddey.ots.lnk")) returned 1 [0033.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.810] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.810] GetTickCount () returned 0x1926f [0033.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.811] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.811] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\IpQ3E_cZPa8PdDey.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ipq3e_czpa8pddey.ots.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023\\....\\temporaryfile")) returned 0 [0033.811] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023\\temporaryfile")) returned 1 [0033.815] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.815] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.815] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.815] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.815] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.815] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.815] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.815] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023\\temporaryfile")) returned 1 [0033.815] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.815] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.815] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023")) returned 1 [0033.815] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\IpQ3E_cZPa8PdDey.ots.lnk") returned 0 [0033.816] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\IpQ3E_cZPa8PdDey.ots.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ipq3e_czpa8pddey.ots.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.816] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x268, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x268, lpOverlapped=0x0) returned 1 [0033.817] CloseHandle (hObject=0xd8) returned 1 [0033.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\iqVhjJhZSIBuxl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iqvhjjhzsibuxl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.818] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xe71 [0033.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe79) returned 0x2649f0 [0033.818] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xe71, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xe71, lpOverlapped=0x0) returned 1 [0033.819] CloseHandle (hObject=0xd8) returned 1 [0033.819] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\iqVhjJhZSIBuxl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iqvhjjhzsibuxl.lnk")) returned 1 [0033.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.819] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.820] GetTickCount () returned 0x1926f [0033.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.820] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.821] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\iqVhjJhZSIBuxl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iqvhjjhzsibuxl.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023\\....\\temporaryfile")) returned 0 [0033.821] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023\\temporaryfile")) returned 1 [0033.822] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.822] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.822] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.822] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.822] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.822] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.822] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.822] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023\\temporaryfile")) returned 1 [0033.822] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1938f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1938f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1938f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.822] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.823] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103023" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103023")) returned 1 [0033.823] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\iqVhjJhZSIBuxl.lnk") returned 0 [0033.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\iqVhjJhZSIBuxl.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iqvhjjhzsibuxl.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.823] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xe78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xe78, lpOverlapped=0x0) returned 1 [0033.875] CloseHandle (hObject=0xd8) returned 1 [0033.876] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\IvQM2Pg89mN43.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ivqm2pg89mn43.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.876] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa38 [0033.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa40) returned 0x2649f0 [0033.876] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa38, lpOverlapped=0x0) returned 1 [0033.877] CloseHandle (hObject=0xd8) returned 1 [0033.877] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\IvQM2Pg89mN43.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ivqm2pg89mn43.lnk")) returned 1 [0033.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.878] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.878] GetTickCount () returned 0x192ad [0033.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.878] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.879] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\IvQM2Pg89mN43.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ivqm2pg89mn43.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085\\....\\temporaryfile")) returned 0 [0033.879] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085\\temporaryfile")) returned 1 [0033.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.880] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.880] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.880] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.880] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.880] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.880] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085\\temporaryfile")) returned 1 [0033.881] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.881] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.881] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085")) returned 1 [0033.881] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\IvQM2Pg89mN43.lnk") returned 0 [0033.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\IvQM2Pg89mN43.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ivqm2pg89mn43.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.882] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa40, lpOverlapped=0x0) returned 1 [0033.882] CloseHandle (hObject=0xd8) returned 1 [0033.883] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\jCl699k6cnu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jcl699k6cnu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.883] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf4e [0033.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf56) returned 0x2649f0 [0033.883] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf4e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf4e, lpOverlapped=0x0) returned 1 [0033.884] CloseHandle (hObject=0xd8) returned 1 [0033.884] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\jCl699k6cnu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jcl699k6cnu.lnk")) returned 1 [0033.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.885] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.885] GetTickCount () returned 0x192ad [0033.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265950 [0033.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.885] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\jCl699k6cnu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jcl699k6cnu.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085\\....\\temporaryfile")) returned 0 [0033.887] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085\\temporaryfile")) returned 1 [0033.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.888] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.888] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.888] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.888] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.888] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.888] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085\\temporaryfile")) returned 1 [0033.888] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19427e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19427e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19427e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.888] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.889] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103085" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103085")) returned 1 [0033.889] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\jCl699k6cnu.lnk") returned 0 [0033.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\jCl699k6cnu.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jcl699k6cnu.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.890] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xf58, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xf58, lpOverlapped=0x0) returned 1 [0033.890] CloseHandle (hObject=0xd8) returned 1 [0033.891] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\JYJ IrXH7S7J4lrI7c.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jyj irxh7s7j4lri7c.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.891] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa73 [0033.891] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa7b) returned 0x2649f0 [0033.891] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa73, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa73, lpOverlapped=0x0) returned 1 [0033.892] CloseHandle (hObject=0xd8) returned 1 [0033.892] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\JYJ IrXH7S7J4lrI7c.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jyj irxh7s7j4lri7c.lnk")) returned 1 [0033.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.893] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.893] GetTickCount () returned 0x192bd [0033.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.893] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.894] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\JYJ IrXH7S7J4lrI7c.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jyj irxh7s7j4lri7c.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101\\....\\temporaryfile")) returned 0 [0033.894] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101\\temporaryfile")) returned 1 [0033.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.895] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.895] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.895] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.895] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.895] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.896] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101\\temporaryfile")) returned 1 [0033.896] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.896] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.896] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101")) returned 1 [0033.896] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\JYJ IrXH7S7J4lrI7c.lnk") returned 0 [0033.896] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\JYJ IrXH7S7J4lrI7c.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jyj irxh7s7j4lri7c.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.897] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa78, lpOverlapped=0x0) returned 1 [0033.898] CloseHandle (hObject=0xd8) returned 1 [0033.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\k8AKeCkuzc4HIIi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k8akeckuzc4hiii.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.898] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa6e [0033.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa76) returned 0x2649f0 [0033.898] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa6e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa6e, lpOverlapped=0x0) returned 1 [0033.899] CloseHandle (hObject=0xd8) returned 1 [0033.899] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\k8AKeCkuzc4HIIi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k8akeckuzc4hiii.lnk")) returned 1 [0033.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.900] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.900] GetTickCount () returned 0x192bd [0033.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.901] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.901] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\k8AKeCkuzc4HIIi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k8akeckuzc4hiii.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101\\....\\temporaryfile")) returned 0 [0033.901] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101\\temporaryfile")) returned 1 [0033.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.903] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.903] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.903] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.903] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.903] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.903] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101\\temporaryfile")) returned 1 [0033.903] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1944dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1944dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1944dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.903] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.903] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103101" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103101")) returned 1 [0033.904] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\k8AKeCkuzc4HIIi.lnk") returned 0 [0033.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\k8AKeCkuzc4HIIi.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k8akeckuzc4hiii.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.904] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa78, lpOverlapped=0x0) returned 1 [0033.905] CloseHandle (hObject=0xd8) returned 1 [0033.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\KczBX1JhveWm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kczbx1jhvewm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.906] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa4d [0033.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa55) returned 0x2649f0 [0033.906] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa4d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa4d, lpOverlapped=0x0) returned 1 [0033.907] CloseHandle (hObject=0xd8) returned 1 [0033.907] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\KczBX1JhveWm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kczbx1jhvewm.lnk")) returned 1 [0033.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.908] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.908] GetTickCount () returned 0x192cc [0033.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.908] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103116\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103116\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.911] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\KczBX1JhveWm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kczbx1jhvewm.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103116\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103116\\....\\temporaryfile")) returned 0 [0033.911] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103116\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103116\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103116\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103116\\temporaryfile")) returned 1 [0033.912] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103116\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19474140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19474140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19474140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.912] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19474140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19474140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19474140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.912] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19474140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19474140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19474140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.912] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103116\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19474140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19474140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19474140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.912] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19474140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19474140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19474140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.912] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19474140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19474140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19474140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.913] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.913] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103116\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103116\\temporaryfile")) returned 1 [0033.913] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19474140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19474140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19474140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.913] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.913] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103116" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103116")) returned 1 [0033.913] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\KczBX1JhveWm.lnk") returned 0 [0033.913] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\KczBX1JhveWm.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kczbx1jhvewm.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.914] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa58, lpOverlapped=0x0) returned 1 [0033.915] CloseHandle (hObject=0xd8) returned 1 [0033.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\KlwMfLBW.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\klwmflbw.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.915] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x142a [0033.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1432) returned 0x28e9f8 [0033.915] ReadFile (in: hFile=0xd8, lpBuffer=0x28ea00, nNumberOfBytesToRead=0x142a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fe10*=0x142a, lpOverlapped=0x0) returned 1 [0033.916] CloseHandle (hObject=0xd8) returned 1 [0033.916] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\KlwMfLBW.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\klwmflbw.mkv.lnk")) returned 1 [0033.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.917] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.917] GetTickCount () returned 0x192dc [0033.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.918] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.919] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\KlwMfLBW.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\klwmflbw.mkv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\....\\temporaryfile")) returned 0 [0033.919] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\temporaryfile")) returned 1 [0033.920] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.920] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.920] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.920] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.920] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.920] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.920] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.920] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\temporaryfile")) returned 1 [0033.920] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.920] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.921] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132")) returned 1 [0033.921] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\KlwMfLBW.mkv.lnk") returned 0 [0033.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\KlwMfLBW.mkv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\klwmflbw.mkv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.921] WriteFile (in: hFile=0xd8, lpBuffer=0x28fe40*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28fe40*, lpNumberOfBytesWritten=0x18fdf8*=0x1430, lpOverlapped=0x0) returned 1 [0033.922] CloseHandle (hObject=0xd8) returned 1 [0033.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ky0CNsBAgguhn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ky0cnsbagguhn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.923] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf6f [0033.923] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf77) returned 0x2649f0 [0033.923] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf6f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf6f, lpOverlapped=0x0) returned 1 [0033.924] CloseHandle (hObject=0xd8) returned 1 [0033.924] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ky0CNsBAgguhn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ky0cnsbagguhn.lnk")) returned 1 [0033.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.925] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.925] GetTickCount () returned 0x192dc [0033.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.925] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.926] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ky0CNsBAgguhn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ky0cnsbagguhn.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\....\\temporaryfile")) returned 0 [0033.926] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\temporaryfile")) returned 1 [0033.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.927] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.927] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.927] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.927] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.927] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\temporaryfile")) returned 1 [0033.928] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.928] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132")) returned 1 [0033.928] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ky0CNsBAgguhn.lnk") returned 0 [0033.928] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ky0CNsBAgguhn.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ky0cnsbagguhn.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.929] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xf78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xf78, lpOverlapped=0x0) returned 1 [0033.930] CloseHandle (hObject=0xd8) returned 1 [0033.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\L8JGos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l8jgos.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.930] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9eb [0033.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9f3) returned 0x2649f0 [0033.930] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9eb, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x9eb, lpOverlapped=0x0) returned 1 [0033.931] CloseHandle (hObject=0xd8) returned 1 [0033.931] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\L8JGos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l8jgos.lnk")) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.932] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.932] GetTickCount () returned 0x192dc [0033.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.933] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.934] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\L8JGos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l8jgos.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\....\\temporaryfile")) returned 0 [0033.934] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\temporaryfile")) returned 1 [0033.935] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.936] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.936] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.936] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.936] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.936] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.936] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.936] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132\\temporaryfile")) returned 1 [0033.936] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1949a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1949a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1949a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.936] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.936] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103132" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103132")) returned 1 [0033.936] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\L8JGos.lnk") returned 0 [0033.937] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\L8JGos.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l8jgos.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.937] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0x9f0, lpOverlapped=0x0) returned 1 [0033.938] CloseHandle (hObject=0xd8) returned 1 [0033.939] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\LdyKq sH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ldykq sh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.939] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa21 [0033.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa29) returned 0x2649f0 [0033.939] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa21, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa21, lpOverlapped=0x0) returned 1 [0033.939] CloseHandle (hObject=0xd8) returned 1 [0033.940] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\LdyKq sH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ldykq sh.lnk")) returned 1 [0033.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.940] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.940] GetTickCount () returned 0x192eb [0033.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.941] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.941] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\LdyKq sH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ldykq sh.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147\\....\\temporaryfile")) returned 0 [0033.942] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147\\temporaryfile")) returned 1 [0033.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.943] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.943] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.943] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.943] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.943] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.943] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147\\temporaryfile")) returned 1 [0033.943] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.943] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.943] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147")) returned 1 [0033.944] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\LdyKq sH.lnk") returned 0 [0033.944] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\LdyKq sH.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ldykq sh.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.944] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa28, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa28, lpOverlapped=0x0) returned 1 [0033.945] CloseHandle (hObject=0xd8) returned 1 [0033.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\lE3JQhfZrFvsQUDm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\le3jqhfzrfvsqudm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.946] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x410 [0033.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x418) returned 0x262590 [0033.946] ReadFile (in: hFile=0xd8, lpBuffer=0x262598, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesRead=0x18fe10*=0x410, lpOverlapped=0x0) returned 1 [0033.947] CloseHandle (hObject=0xd8) returned 1 [0033.947] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\lE3JQhfZrFvsQUDm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\le3jqhfzrfvsqudm.lnk")) returned 1 [0033.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.948] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.948] GetTickCount () returned 0x192eb [0033.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2629b0 [0033.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.948] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.949] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\lE3JQhfZrFvsQUDm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\le3jqhfzrfvsqudm.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147\\....\\temporaryfile")) returned 0 [0033.949] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147\\temporaryfile")) returned 1 [0033.950] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.950] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.950] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.950] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.950] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.950] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.950] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.950] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147\\temporaryfile")) returned 1 [0033.951] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194c0400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194c0400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194c0400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.951] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.951] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103147" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103147")) returned 1 [0033.951] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\lE3JQhfZrFvsQUDm.lnk") returned 0 [0033.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\lE3JQhfZrFvsQUDm.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\le3jqhfzrfvsqudm.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.952] WriteFile (in: hFile=0xd8, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdf8*=0x418, lpOverlapped=0x0) returned 1 [0033.953] CloseHandle (hObject=0xd8) returned 1 [0033.953] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\MArt8B5Nnvr6CocV2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mart8b5nnvr6cocv2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.953] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xfbb [0033.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfc3) returned 0x2649f0 [0033.953] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xfbb, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xfbb, lpOverlapped=0x0) returned 1 [0033.954] CloseHandle (hObject=0xd8) returned 1 [0033.954] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\MArt8B5Nnvr6CocV2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mart8b5nnvr6cocv2.lnk")) returned 1 [0033.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.955] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.955] GetTickCount () returned 0x192fb [0033.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0033.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2659c0 [0033.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.956] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.956] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\MArt8B5Nnvr6CocV2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mart8b5nnvr6cocv2.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163\\....\\temporaryfile")) returned 0 [0033.956] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163\\temporaryfile")) returned 1 [0033.957] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.957] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.957] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.957] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.958] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.958] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.958] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.958] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163\\temporaryfile")) returned 1 [0033.958] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.958] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.958] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163")) returned 1 [0033.958] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\MArt8B5Nnvr6CocV2.lnk") returned 0 [0033.958] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\MArt8B5Nnvr6CocV2.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mart8b5nnvr6cocv2.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.959] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xfc0, lpOverlapped=0x0) returned 1 [0033.960] CloseHandle (hObject=0xd8) returned 1 [0033.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mJO8uMF6Tat.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mjo8umf6tat.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.961] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa22 [0033.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa2a) returned 0x2649f0 [0033.961] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa22, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa22, lpOverlapped=0x0) returned 1 [0033.961] CloseHandle (hObject=0xd8) returned 1 [0033.961] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mJO8uMF6Tat.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mjo8umf6tat.lnk")) returned 1 [0033.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.962] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.962] GetTickCount () returned 0x192fb [0033.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.963] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.963] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mJO8uMF6Tat.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mjo8umf6tat.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163\\....\\temporaryfile")) returned 0 [0033.963] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163\\temporaryfile")) returned 1 [0033.966] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.966] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.966] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.966] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.966] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.966] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.966] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.966] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163\\temporaryfile")) returned 1 [0033.966] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x194e6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x194e6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x194e6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.966] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.966] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103163" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103163")) returned 1 [0033.967] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mJO8uMF6Tat.lnk") returned 0 [0033.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mJO8uMF6Tat.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mjo8umf6tat.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.967] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa28, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa28, lpOverlapped=0x0) returned 1 [0033.968] CloseHandle (hObject=0xd8) returned 1 [0033.969] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mn5_uAB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mn5_uab.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.969] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9f6 [0033.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9fe) returned 0x2649f0 [0033.969] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9f6, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x9f6, lpOverlapped=0x0) returned 1 [0033.970] CloseHandle (hObject=0xd8) returned 1 [0033.970] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mn5_uAB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mn5_uab.lnk")) returned 1 [0033.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.971] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.971] GetTickCount () returned 0x1930b [0033.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0033.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.971] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103179\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103179\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.972] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mn5_uAB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mn5_uab.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103179\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103179\\....\\temporaryfile")) returned 0 [0033.972] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103179\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103179\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103179\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103179\\temporaryfile")) returned 1 [0033.976] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103179\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1950c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1950c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1950c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.976] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1950c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1950c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1950c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.976] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1950c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1950c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1950c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.976] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103179\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1950c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1950c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1950c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.977] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1950c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1950c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1950c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.977] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1950c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1950c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1950c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.977] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.977] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103179\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103179\\temporaryfile")) returned 1 [0033.977] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1950c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1950c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1950c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.977] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.977] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103179" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103179")) returned 1 [0033.977] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mn5_uAB.lnk") returned 0 [0033.977] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mn5_uAB.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mn5_uab.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.978] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa00, lpOverlapped=0x0) returned 1 [0033.979] CloseHandle (hObject=0xd8) returned 1 [0033.979] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mwGRgJsn.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mwgrgjsn.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.980] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x142a [0033.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1432) returned 0x28e9f8 [0033.980] ReadFile (in: hFile=0xd8, lpBuffer=0x28ea00, nNumberOfBytesToRead=0x142a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fe10*=0x142a, lpOverlapped=0x0) returned 1 [0033.980] CloseHandle (hObject=0xd8) returned 1 [0033.980] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mwGRgJsn.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mwgrgjsn.flv.lnk")) returned 1 [0033.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.981] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.981] GetTickCount () returned 0x1931a [0033.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0033.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0033.982] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.982] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.982] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mwGRgJsn.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mwgrgjsn.flv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194\\....\\temporaryfile")) returned 0 [0033.982] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194\\temporaryfile")) returned 1 [0033.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.983] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.984] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.984] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.984] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.984] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.984] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.984] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194\\temporaryfile")) returned 1 [0033.984] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.984] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.984] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194")) returned 1 [0033.984] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mwGRgJsn.flv.lnk") returned 0 [0033.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\mwGRgJsn.flv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mwgrgjsn.flv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.985] WriteFile (in: hFile=0xd8, lpBuffer=0x28fe40*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28fe40*, lpNumberOfBytesWritten=0x18fdf8*=0x1430, lpOverlapped=0x0) returned 1 [0033.986] CloseHandle (hObject=0xd8) returned 1 [0033.987] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.987] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x52a [0033.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x532) returned 0x259e70 [0033.987] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x52a, lpOverlapped=0x0) returned 1 [0033.988] CloseHandle (hObject=0xd8) returned 1 [0033.988] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk")) returned 1 [0033.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0033.988] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.989] GetTickCount () returned 0x1931a [0033.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a3b0 [0033.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.989] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0033.990] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194\\....\\temporaryfile")) returned 0 [0033.990] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194\\temporaryfile")) returned 1 [0033.991] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0033.991] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.991] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0033.991] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0033.991] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.991] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.991] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0033.991] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194\\temporaryfile")) returned 1 [0033.991] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19532820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19532820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19532820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0033.992] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0033.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103194" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103194")) returned 1 [0033.992] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Music.lnk") returned 0 [0033.992] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Music.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.993] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0x530, lpOverlapped=0x0) returned 1 [0033.993] CloseHandle (hObject=0xd8) returned 1 [0033.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0033.994] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x54f [0033.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x557) returned 0x259e70 [0033.994] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x54f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x54f, lpOverlapped=0x0) returned 1 [0033.995] CloseHandle (hObject=0xd8) returned 1 [0033.995] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk")) returned 1 [0033.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0033.997] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0033.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0033.997] GetTickCount () returned 0x1932a [0033.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0033.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a3d0 [0033.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0033.998] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0033.999] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210\\....\\temporaryfile")) returned 0 [0033.999] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210\\temporaryfile")) returned 1 [0034.000] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.000] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.000] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.000] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.000] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.000] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.000] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.000] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210\\temporaryfile")) returned 1 [0034.001] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.001] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.001] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210")) returned 1 [0034.001] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Pictures.lnk") returned 0 [0034.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Pictures.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.002] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x558, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0x558, lpOverlapped=0x0) returned 1 [0034.002] CloseHandle (hObject=0xd8) returned 1 [0034.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.003] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x539 [0034.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x541) returned 0x259e70 [0034.003] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x539, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x539, lpOverlapped=0x0) returned 1 [0034.004] CloseHandle (hObject=0xd8) returned 1 [0034.004] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk")) returned 1 [0034.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.005] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.005] GetTickCount () returned 0x1932a [0034.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a3c0 [0034.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.006] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.006] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210\\....\\temporaryfile")) returned 0 [0034.006] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210\\temporaryfile")) returned 1 [0034.007] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.007] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.007] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.007] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.007] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.008] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.008] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.008] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210\\temporaryfile")) returned 1 [0034.008] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19558980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19558980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19558980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.008] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.008] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103210" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103210")) returned 1 [0034.008] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Videos.lnk") returned 0 [0034.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\My Videos.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.009] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0x540, lpOverlapped=0x0) returned 1 [0034.010] CloseHandle (hObject=0xd8) returned 1 [0034.010] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\niS1LNMjpLd63RldlE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nis1lnmjpld63rldle.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.010] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9f0 [0034.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9f8) returned 0x2649f0 [0034.011] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9f0, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x9f0, lpOverlapped=0x0) returned 1 [0034.011] CloseHandle (hObject=0xd8) returned 1 [0034.012] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\niS1LNMjpLd63RldlE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nis1lnmjpld63rldle.lnk")) returned 1 [0034.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.012] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.012] GetTickCount () returned 0x19339 [0034.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.013] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.013] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\niS1LNMjpLd63RldlE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nis1lnmjpld63rldle.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225\\....\\temporaryfile")) returned 0 [0034.013] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225\\temporaryfile")) returned 1 [0034.014] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.014] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.014] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.014] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.015] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.015] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.015] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.015] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225\\temporaryfile")) returned 1 [0034.015] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.015] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.015] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225")) returned 1 [0034.015] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\niS1LNMjpLd63RldlE.lnk") returned 0 [0034.015] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\niS1LNMjpLd63RldlE.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nis1lnmjpld63rldle.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.016] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x9f8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0x9f8, lpOverlapped=0x0) returned 1 [0034.017] CloseHandle (hObject=0xd8) returned 1 [0034.017] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oaNX t.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oanx t.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.018] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9eb [0034.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9f3) returned 0x2649f0 [0034.018] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9eb, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x9eb, lpOverlapped=0x0) returned 1 [0034.018] CloseHandle (hObject=0xd8) returned 1 [0034.018] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oaNX t.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oanx t.lnk")) returned 1 [0034.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.019] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.019] GetTickCount () returned 0x19339 [0034.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c570 [0034.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.020] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.020] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oaNX t.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oanx t.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225\\....\\temporaryfile")) returned 0 [0034.021] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225\\temporaryfile")) returned 1 [0034.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.022] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.022] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.022] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.022] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.022] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.022] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225\\temporaryfile")) returned 1 [0034.022] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1957eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1957eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1957eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.022] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.022] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103225" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103225")) returned 1 [0034.023] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oaNX t.lnk") returned 0 [0034.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oaNX t.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oanx t.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.023] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0x9f0, lpOverlapped=0x0) returned 1 [0034.024] CloseHandle (hObject=0xd8) returned 1 [0034.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oFYgBk4QtpG412-y.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofygbk4qtpg412-y.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.025] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa1a [0034.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa22) returned 0x2649f0 [0034.025] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa1a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa1a, lpOverlapped=0x0) returned 1 [0034.026] CloseHandle (hObject=0xd8) returned 1 [0034.026] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oFYgBk4QtpG412-y.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofygbk4qtpg412-y.mkv.lnk")) returned 1 [0034.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.027] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.027] GetTickCount () returned 0x19349 [0034.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.028] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.028] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oFYgBk4QtpG412-y.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofygbk4qtpg412-y.mkv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241\\....\\temporaryfile")) returned 0 [0034.028] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241\\temporaryfile")) returned 1 [0034.029] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.029] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.029] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.029] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.030] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.030] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.030] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.030] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241\\temporaryfile")) returned 1 [0034.030] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.030] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.030] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241")) returned 1 [0034.030] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oFYgBk4QtpG412-y.mkv.lnk") returned 0 [0034.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oFYgBk4QtpG412-y.mkv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ofygbk4qtpg412-y.mkv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.031] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa20, lpOverlapped=0x0) returned 1 [0034.032] CloseHandle (hObject=0xd8) returned 1 [0034.032] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ojzwNs9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ojzwns9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.032] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf22 [0034.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf2a) returned 0x2649f0 [0034.033] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf22, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf22, lpOverlapped=0x0) returned 1 [0034.033] CloseHandle (hObject=0xd8) returned 1 [0034.033] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ojzwNs9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ojzwns9.lnk")) returned 1 [0034.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.034] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.034] GetTickCount () returned 0x19349 [0034.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265928 [0034.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.035] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.035] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ojzwNs9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ojzwns9.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241\\....\\temporaryfile")) returned 0 [0034.035] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241\\temporaryfile")) returned 1 [0034.036] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.036] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.036] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.037] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.037] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.037] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.037] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.037] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241\\temporaryfile")) returned 1 [0034.037] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195a4c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195a4c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195a4c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.037] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.037] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103241" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103241")) returned 1 [0034.037] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ojzwNs9.lnk") returned 0 [0034.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ojzwNs9.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ojzwns9.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.038] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xf28, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xf28, lpOverlapped=0x0) returned 1 [0034.039] CloseHandle (hObject=0xd8) returned 1 [0034.041] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\okSd1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oksd1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.042] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x290 [0034.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x298) returned 0x25c570 [0034.042] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x290, lpOverlapped=0x0) returned 1 [0034.043] CloseHandle (hObject=0xd8) returned 1 [0034.043] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\okSd1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oksd1.lnk")) returned 1 [0034.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.044] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.044] GetTickCount () returned 0x19359 [0034.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c810 [0034.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.044] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\okSd1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oksd1.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257\\....\\temporaryfile")) returned 0 [0034.045] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257\\temporaryfile")) returned 1 [0034.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.046] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.046] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.046] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.046] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.046] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.046] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257\\temporaryfile")) returned 1 [0034.046] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.046] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257")) returned 1 [0034.047] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\okSd1.lnk") returned 0 [0034.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\okSd1.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oksd1.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.051] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x298, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x298, lpOverlapped=0x0) returned 1 [0034.052] CloseHandle (hObject=0xd8) returned 1 [0034.052] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oOeIcMMwhOI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ooeicmmwhoi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.052] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3f7 [0034.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ff) returned 0x25c570 [0034.052] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x3f7, lpOverlapped=0x0) returned 1 [0034.053] CloseHandle (hObject=0xd8) returned 1 [0034.053] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oOeIcMMwhOI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ooeicmmwhoi.lnk")) returned 1 [0034.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.054] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.054] GetTickCount () returned 0x19359 [0034.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262590 [0034.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.055] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.055] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oOeIcMMwhOI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ooeicmmwhoi.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257\\....\\temporaryfile")) returned 0 [0034.055] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257\\temporaryfile")) returned 1 [0034.056] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.056] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.056] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.056] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.057] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.057] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.057] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257\\temporaryfile")) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195cada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195cada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195cada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.057] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.057] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103257" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103257")) returned 1 [0034.057] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oOeIcMMwhOI.lnk") returned 0 [0034.057] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\oOeIcMMwhOI.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ooeicmmwhoi.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.059] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x400, lpOverlapped=0x0) returned 1 [0034.060] CloseHandle (hObject=0xd8) returned 1 [0034.061] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\OPn7B_oStEDZG-Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\opn7b_ostedzg-z.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.061] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1f8 [0034.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x200) returned 0x25c570 [0034.061] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x1f8, lpOverlapped=0x0) returned 1 [0034.062] CloseHandle (hObject=0xd8) returned 1 [0034.062] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\OPn7B_oStEDZG-Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\opn7b_ostedzg-z.lnk")) returned 1 [0034.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.062] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.062] GetTickCount () returned 0x19368 [0034.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.063] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.063] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\OPn7B_oStEDZG-Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\opn7b_ostedzg-z.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272\\....\\temporaryfile")) returned 0 [0034.063] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272\\temporaryfile")) returned 1 [0034.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.065] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.065] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.065] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.065] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.065] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.065] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.065] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272\\temporaryfile")) returned 1 [0034.065] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.065] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.065] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272")) returned 1 [0034.065] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\OPn7B_oStEDZG-Z.lnk") returned 0 [0034.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\OPn7B_oStEDZG-Z.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\opn7b_ostedzg-z.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.066] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x200, lpOverlapped=0x0) returned 1 [0034.067] CloseHandle (hObject=0xd8) returned 1 [0034.068] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\OXwvMzo7VU4DQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxwvmzo7vu4dq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.068] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa4d [0034.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa55) returned 0x2649f0 [0034.068] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa4d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa4d, lpOverlapped=0x0) returned 1 [0034.068] CloseHandle (hObject=0xd8) returned 1 [0034.069] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\OXwvMzo7VU4DQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxwvmzo7vu4dq.lnk")) returned 1 [0034.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.069] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.069] GetTickCount () returned 0x19368 [0034.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.070] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.071] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\OXwvMzo7VU4DQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxwvmzo7vu4dq.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272\\....\\temporaryfile")) returned 0 [0034.071] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272\\temporaryfile")) returned 1 [0034.072] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.072] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.072] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.072] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.072] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.072] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.072] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.072] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272\\temporaryfile")) returned 1 [0034.072] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x195f0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x195f0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x195f0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.072] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.072] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103272" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103272")) returned 1 [0034.073] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\OXwvMzo7VU4DQ.lnk") returned 0 [0034.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\OXwvMzo7VU4DQ.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxwvmzo7vu4dq.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.074] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0xa58, lpOverlapped=0x0) returned 1 [0034.074] CloseHandle (hObject=0xd8) returned 1 [0034.075] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p1IDCpnxsoIZs5eLNz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p1idcpnxsoizs5elnz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.075] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf9f [0034.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfa7) returned 0x2649f0 [0034.075] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf9f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf9f, lpOverlapped=0x0) returned 1 [0034.076] CloseHandle (hObject=0xd8) returned 1 [0034.076] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p1IDCpnxsoIZs5eLNz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p1idcpnxsoizs5elnz.lnk")) returned 1 [0034.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.077] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.077] GetTickCount () returned 0x19378 [0034.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2659a0 [0034.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.078] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.078] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p1IDCpnxsoIZs5eLNz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p1idcpnxsoizs5elnz.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288\\....\\temporaryfile")) returned 0 [0034.078] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288\\temporaryfile")) returned 1 [0034.079] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.079] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.079] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.079] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.079] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.079] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.079] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.079] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288\\temporaryfile")) returned 1 [0034.080] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.080] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288")) returned 1 [0034.080] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p1IDCpnxsoIZs5eLNz.lnk") returned 0 [0034.080] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p1IDCpnxsoIZs5eLNz.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p1idcpnxsoizs5elnz.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.081] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xfa8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xfa8, lpOverlapped=0x0) returned 1 [0034.082] CloseHandle (hObject=0xd8) returned 1 [0034.082] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p2v55AVj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p2v55avj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.082] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf1c [0034.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf24) returned 0x2649f0 [0034.082] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf1c, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf1c, lpOverlapped=0x0) returned 1 [0034.083] CloseHandle (hObject=0xd8) returned 1 [0034.083] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p2v55AVj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p2v55avj.lnk")) returned 1 [0034.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.084] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.084] GetTickCount () returned 0x19378 [0034.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265920 [0034.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.085] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.085] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p2v55AVj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p2v55avj.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288\\....\\temporaryfile")) returned 0 [0034.085] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288\\temporaryfile")) returned 1 [0034.086] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.086] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.086] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.087] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.087] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.087] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.087] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.087] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288\\temporaryfile")) returned 1 [0034.090] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19617060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19617060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19617060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.090] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103288" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103288")) returned 1 [0034.091] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p2v55AVj.lnk") returned 0 [0034.091] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p2v55AVj.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p2v55avj.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.092] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xf20, lpOverlapped=0x0) returned 1 [0034.095] CloseHandle (hObject=0xd8) returned 1 [0034.096] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p7HLkCBt6lrk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p7hlkcbt6lrk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.096] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa31 [0034.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa39) returned 0x28e9f8 [0034.096] ReadFile (in: hFile=0xd8, lpBuffer=0x28ea00, nNumberOfBytesToRead=0xa31, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fe10*=0xa31, lpOverlapped=0x0) returned 1 [0034.097] CloseHandle (hObject=0xd8) returned 1 [0034.097] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p7HLkCBt6lrk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p7hlkcbt6lrk.lnk")) returned 1 [0034.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.098] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.098] GetTickCount () returned 0x19387 [0034.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.098] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103303\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103303\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.099] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p7HLkCBt6lrk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p7hlkcbt6lrk.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103303\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103303\\....\\temporaryfile")) returned 0 [0034.099] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103303\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103303\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103303\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103303\\temporaryfile")) returned 1 [0034.100] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103303\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1963d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1963d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1963d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.100] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1963d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1963d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1963d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.100] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1963d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1963d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1963d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.100] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103303\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1963d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1963d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1963d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.100] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1963d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1963d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1963d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.100] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1963d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1963d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1963d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.100] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.100] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103303\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103303\\temporaryfile")) returned 1 [0034.101] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1963d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1963d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1963d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.101] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.101] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103303" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103303")) returned 1 [0034.101] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p7HLkCBt6lrk.lnk") returned 0 [0034.101] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\p7HLkCBt6lrk.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p7hlkcbt6lrk.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.102] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xa38, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0xa38, lpOverlapped=0x0) returned 1 [0034.102] CloseHandle (hObject=0xd8) returned 1 [0034.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\PQjPiQ-k5UaAunXcyp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pqjpiq-k5uaaunxcyp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.103] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x26b [0034.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x273) returned 0x25c570 [0034.103] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x26b, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x26b, lpOverlapped=0x0) returned 1 [0034.104] CloseHandle (hObject=0xd8) returned 1 [0034.104] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\PQjPiQ-k5UaAunXcyp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pqjpiq-k5uaaunxcyp.lnk")) returned 1 [0034.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.108] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.108] GetTickCount () returned 0x19397 [0034.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.108] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\PQjPiQ-k5UaAunXcyp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pqjpiq-k5uaaunxcyp.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319\\....\\temporaryfile")) returned 0 [0034.109] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319\\temporaryfile")) returned 1 [0034.110] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.110] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.110] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.110] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.110] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.110] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.110] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.110] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319\\temporaryfile")) returned 1 [0034.110] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.111] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.111] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319")) returned 1 [0034.111] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\PQjPiQ-k5UaAunXcyp.lnk") returned 0 [0034.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\PQjPiQ-k5UaAunXcyp.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pqjpiq-k5uaaunxcyp.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.112] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x270, lpOverlapped=0x0) returned 1 [0034.112] CloseHandle (hObject=0xd8) returned 1 [0034.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\pXbnvbUkulG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pxbnvbukulg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.113] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1e4 [0034.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ec) returned 0x25c570 [0034.113] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x1e4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x1e4, lpOverlapped=0x0) returned 1 [0034.114] CloseHandle (hObject=0xd8) returned 1 [0034.114] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\pXbnvbUkulG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pxbnvbukulg.lnk")) returned 1 [0034.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.115] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.115] GetTickCount () returned 0x19397 [0034.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c768 [0034.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.116] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\pXbnvbUkulG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pxbnvbukulg.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319\\....\\temporaryfile")) returned 0 [0034.116] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319\\temporaryfile")) returned 1 [0034.117] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.117] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.117] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.117] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.117] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.118] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.118] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.118] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319\\temporaryfile")) returned 1 [0034.118] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19663320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19663320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19663320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.118] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.118] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103319" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103319")) returned 1 [0034.118] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\pXbnvbUkulG.lnk") returned 0 [0034.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\pXbnvbUkulG.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pxbnvbukulg.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.119] WriteFile (in: hFile=0xd8, lpBuffer=0x25c770*, nNumberOfBytesToWrite=0x1e8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c770*, lpNumberOfBytesWritten=0x18fdf8*=0x1e8, lpOverlapped=0x0) returned 1 [0034.120] CloseHandle (hObject=0xd8) returned 1 [0034.121] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\PyIsTigOF966Nu_K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pyistigof966nu_k.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.121] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa72 [0034.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa7a) returned 0x2649f0 [0034.121] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa72, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa72, lpOverlapped=0x0) returned 1 [0034.122] CloseHandle (hObject=0xd8) returned 1 [0034.122] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\PyIsTigOF966Nu_K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pyistigof966nu_k.lnk")) returned 1 [0034.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.123] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.123] GetTickCount () returned 0x193a7 [0034.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.124] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.124] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\PyIsTigOF966Nu_K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pyistigof966nu_k.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335\\....\\temporaryfile")) returned 0 [0034.124] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335\\temporaryfile")) returned 1 [0034.125] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.125] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.125] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.125] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.125] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.125] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.125] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335\\temporaryfile")) returned 1 [0034.126] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.126] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.126] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335")) returned 1 [0034.126] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\PyIsTigOF966Nu_K.lnk") returned 0 [0034.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\PyIsTigOF966Nu_K.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pyistigof966nu_k.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.127] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xa78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xa78, lpOverlapped=0x0) returned 1 [0034.128] CloseHandle (hObject=0xd8) returned 1 [0034.128] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\qli3XF0tWwDGKFecggK7.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qli3xf0twwdgkfecggk7.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.128] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x14ae [0034.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14b6) returned 0x291460 [0034.128] ReadFile (in: hFile=0xd8, lpBuffer=0x291468, nNumberOfBytesToRead=0x14ae, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesRead=0x18fe10*=0x14ae, lpOverlapped=0x0) returned 1 [0034.129] CloseHandle (hObject=0xd8) returned 1 [0034.129] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\qli3XF0tWwDGKFecggK7.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qli3xf0twwdgkfecggk7.mkv.lnk")) returned 1 [0034.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.130] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.130] GetTickCount () returned 0x193a7 [0034.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.131] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.131] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\qli3XF0tWwDGKFecggK7.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qli3xf0twwdgkfecggk7.mkv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335\\....\\temporaryfile")) returned 0 [0034.131] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335\\temporaryfile")) returned 1 [0034.132] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.132] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.132] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.133] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.133] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.133] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.133] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.133] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335\\temporaryfile")) returned 1 [0034.133] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19689480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19689480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19689480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.133] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.133] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103335" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103335")) returned 1 [0034.133] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\qli3XF0tWwDGKFecggK7.mkv.lnk") returned 0 [0034.134] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\qli3XF0tWwDGKFecggK7.mkv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qli3xf0twwdgkfecggk7.mkv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.134] WriteFile (in: hFile=0xd8, lpBuffer=0x292928*, nNumberOfBytesToWrite=0x14b8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x292928*, lpNumberOfBytesWritten=0x18fdf8*=0x14b8, lpOverlapped=0x0) returned 1 [0034.135] CloseHandle (hObject=0xd8) returned 1 [0034.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\R19lpaVKOfq7YVANQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r19lpavkofq7yvanq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.136] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xfbb [0034.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfc3) returned 0x2649f0 [0034.136] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xfbb, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xfbb, lpOverlapped=0x0) returned 1 [0034.137] CloseHandle (hObject=0xd8) returned 1 [0034.137] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\R19lpaVKOfq7YVANQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r19lpavkofq7yvanq.lnk")) returned 1 [0034.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.138] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.138] GetTickCount () returned 0x193b6 [0034.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2659c0 [0034.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.139] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.139] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\R19lpaVKOfq7YVANQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r19lpavkofq7yvanq.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350\\....\\temporaryfile")) returned 0 [0034.139] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350\\temporaryfile")) returned 1 [0034.140] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.140] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.140] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.140] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.141] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.141] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.141] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.141] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350\\temporaryfile")) returned 1 [0034.141] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.141] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.141] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350")) returned 1 [0034.141] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\R19lpaVKOfq7YVANQ.lnk") returned 0 [0034.141] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\R19lpaVKOfq7YVANQ.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r19lpavkofq7yvanq.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.142] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xfc0, lpOverlapped=0x0) returned 1 [0034.143] CloseHandle (hObject=0xd8) returned 1 [0034.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\R7_g8IwpOeJE _.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r7_g8iwpoeje _.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.144] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf9e [0034.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfa6) returned 0x2649f0 [0034.144] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf9e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf9e, lpOverlapped=0x0) returned 1 [0034.144] CloseHandle (hObject=0xd8) returned 1 [0034.144] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\R7_g8IwpOeJE _.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r7_g8iwpoeje _.lnk")) returned 1 [0034.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.145] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.145] GetTickCount () returned 0x193b6 [0034.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2659a0 [0034.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.146] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.146] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\R7_g8IwpOeJE _.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r7_g8iwpoeje _.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350\\....\\temporaryfile")) returned 0 [0034.146] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350\\temporaryfile")) returned 1 [0034.147] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.148] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.148] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.148] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.148] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.148] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.148] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350\\temporaryfile")) returned 1 [0034.148] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196af5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196af5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196af5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.148] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.148] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103350" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103350")) returned 1 [0034.149] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\R7_g8IwpOeJE _.lnk") returned 0 [0034.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\R7_g8IwpOeJE _.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r7_g8iwpoeje _.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.149] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xfa8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xfa8, lpOverlapped=0x0) returned 1 [0034.150] CloseHandle (hObject=0xd8) returned 1 [0034.151] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\r9fxrCjn_fvX0.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r9fxrcjn_fvx0.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.151] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x401 [0034.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x409) returned 0x262590 [0034.151] ReadFile (in: hFile=0xd8, lpBuffer=0x262598, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesRead=0x18fe10*=0x401, lpOverlapped=0x0) returned 1 [0034.152] CloseHandle (hObject=0xd8) returned 1 [0034.152] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\r9fxrCjn_fvX0.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r9fxrcjn_fvx0.flv.lnk")) returned 1 [0034.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.153] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.153] GetTickCount () returned 0x193c6 [0034.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2629a8 [0034.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.153] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.154] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\r9fxrCjn_fvX0.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r9fxrcjn_fvx0.flv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366\\....\\temporaryfile")) returned 0 [0034.154] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366\\temporaryfile")) returned 1 [0034.155] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.155] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.155] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.155] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.155] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.155] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.155] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.155] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366\\temporaryfile")) returned 1 [0034.156] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.156] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.156] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366")) returned 1 [0034.156] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\r9fxrCjn_fvX0.flv.lnk") returned 0 [0034.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\r9fxrCjn_fvX0.flv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r9fxrcjn_fvx0.flv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.157] WriteFile (in: hFile=0xd8, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x408, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdf8*=0x408, lpOverlapped=0x0) returned 1 [0034.158] CloseHandle (hObject=0xd8) returned 1 [0034.158] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\rF_ok6UvUojb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rf_ok6uvuojb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.158] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa4d [0034.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa55) returned 0x28e9f8 [0034.158] ReadFile (in: hFile=0xd8, lpBuffer=0x28ea00, nNumberOfBytesToRead=0xa4d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fe10*=0xa4d, lpOverlapped=0x0) returned 1 [0034.159] CloseHandle (hObject=0xd8) returned 1 [0034.159] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\rF_ok6UvUojb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rf_ok6uvuojb.lnk")) returned 1 [0034.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.160] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.160] GetTickCount () returned 0x193c6 [0034.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.161] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.161] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\rF_ok6UvUojb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rf_ok6uvuojb.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366\\....\\temporaryfile")) returned 0 [0034.161] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366\\temporaryfile")) returned 1 [0034.162] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.162] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.163] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.163] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.163] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.163] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.163] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366\\temporaryfile")) returned 1 [0034.163] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196d5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196d5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196d5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.163] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103366" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103366")) returned 1 [0034.163] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\rF_ok6UvUojb.lnk") returned 0 [0034.164] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\rF_ok6UvUojb.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rf_ok6uvuojb.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.164] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0xa58, lpOverlapped=0x0) returned 1 [0034.165] CloseHandle (hObject=0xd8) returned 1 [0034.166] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\RgozBY-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgozby-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.166] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x93a [0034.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x942) returned 0x28e9f8 [0034.166] ReadFile (in: hFile=0xd8, lpBuffer=0x28ea00, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fe10*=0x93a, lpOverlapped=0x0) returned 1 [0034.167] CloseHandle (hObject=0xd8) returned 1 [0034.167] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\RgozBY-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgozby-.lnk")) returned 1 [0034.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.168] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.168] GetTickCount () returned 0x193d5 [0034.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28f348 [0034.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.169] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.169] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\RgozBY-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgozby-.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381\\....\\temporaryfile")) returned 0 [0034.169] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381\\temporaryfile")) returned 1 [0034.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.170] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.170] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.170] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.170] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.170] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.170] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381\\temporaryfile")) returned 1 [0034.171] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.171] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.171] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381")) returned 1 [0034.171] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\RgozBY-.lnk") returned 0 [0034.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\RgozBY-.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgozby-.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.172] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0x940, lpOverlapped=0x0) returned 1 [0034.173] CloseHandle (hObject=0xd8) returned 1 [0034.174] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\RIHbvM5AACGsvn9b3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rihbvm5aacgsvn9b3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.174] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa84 [0034.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa8c) returned 0x2649f0 [0034.174] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa84, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa84, lpOverlapped=0x0) returned 1 [0034.175] CloseHandle (hObject=0xd8) returned 1 [0034.175] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\RIHbvM5AACGsvn9b3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rihbvm5aacgsvn9b3.lnk")) returned 1 [0034.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.176] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.176] GetTickCount () returned 0x193d5 [0034.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.177] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.177] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\RIHbvM5AACGsvn9b3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rihbvm5aacgsvn9b3.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381\\....\\temporaryfile")) returned 0 [0034.177] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381\\temporaryfile")) returned 1 [0034.178] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.178] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.178] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.178] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.178] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.179] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.179] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.179] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381\\temporaryfile")) returned 1 [0034.179] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x196fb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x196fb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x196fb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.179] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.179] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103381" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103381")) returned 1 [0034.179] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\RIHbvM5AACGsvn9b3.lnk") returned 0 [0034.179] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\RIHbvM5AACGsvn9b3.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rihbvm5aacgsvn9b3.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.180] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xa88, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xa88, lpOverlapped=0x0) returned 1 [0034.181] CloseHandle (hObject=0xd8) returned 1 [0034.181] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Rj1_r3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rj1_r3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.182] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf0d [0034.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf15) returned 0x2649f0 [0034.182] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf0d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf0d, lpOverlapped=0x0) returned 1 [0034.182] CloseHandle (hObject=0xd8) returned 1 [0034.183] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Rj1_r3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rj1_r3.lnk")) returned 1 [0034.184] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.184] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.184] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.184] GetTickCount () returned 0x193e5 [0034.184] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.184] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265910 [0034.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.185] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.185] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Rj1_r3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rj1_r3.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397\\....\\temporaryfile")) returned 0 [0034.185] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397\\temporaryfile")) returned 1 [0034.186] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.186] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.186] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.186] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.186] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.186] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.186] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.187] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397\\temporaryfile")) returned 1 [0034.187] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.187] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.187] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397")) returned 1 [0034.187] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Rj1_r3.lnk") returned 0 [0034.187] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Rj1_r3.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rj1_r3.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.188] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xf18, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xf18, lpOverlapped=0x0) returned 1 [0034.189] CloseHandle (hObject=0xd8) returned 1 [0034.189] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.190] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x303 [0034.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30b) returned 0x25c570 [0034.190] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x303, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x303, lpOverlapped=0x0) returned 1 [0034.190] CloseHandle (hObject=0xd8) returned 1 [0034.190] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 1 [0034.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.191] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.191] GetTickCount () returned 0x193e5 [0034.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c888 [0034.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.192] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.192] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397\\....\\temporaryfile")) returned 0 [0034.193] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397\\temporaryfile")) returned 1 [0034.194] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.194] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.194] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.194] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.194] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.194] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.194] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397\\temporaryfile")) returned 1 [0034.194] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19721a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19721a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19721a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.194] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103397" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103397")) returned 1 [0034.195] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned 0 [0034.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Roaming.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.195] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x308, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x308, lpOverlapped=0x0) returned 1 [0034.196] CloseHandle (hObject=0xd8) returned 1 [0034.197] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\sHSDSkZ0g_NoboxW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\shsdskz0g_noboxw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.197] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf67 [0034.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf6f) returned 0x2649f0 [0034.197] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf67, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf67, lpOverlapped=0x0) returned 1 [0034.198] CloseHandle (hObject=0xd8) returned 1 [0034.198] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\sHSDSkZ0g_NoboxW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\shsdskz0g_noboxw.lnk")) returned 1 [0034.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.199] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.199] GetTickCount () returned 0x193f5 [0034.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.199] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.200] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\sHSDSkZ0g_NoboxW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\shsdskz0g_noboxw.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413\\....\\temporaryfile")) returned 0 [0034.200] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413\\temporaryfile")) returned 1 [0034.201] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.201] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.201] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.201] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.201] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.201] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.201] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.201] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413\\temporaryfile")) returned 1 [0034.202] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.202] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.202] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413")) returned 1 [0034.202] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\sHSDSkZ0g_NoboxW.lnk") returned 0 [0034.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\sHSDSkZ0g_NoboxW.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\shsdskz0g_noboxw.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.203] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xf70, lpOverlapped=0x0) returned 1 [0034.203] CloseHandle (hObject=0xd8) returned 1 [0034.206] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\siXuQ8hvAO01ox4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sixuq8hvao01ox4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.206] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3d2 [0034.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3da) returned 0x25c570 [0034.207] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x3d2, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x3d2, lpOverlapped=0x0) returned 1 [0034.207] CloseHandle (hObject=0xd8) returned 1 [0034.207] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\siXuQ8hvAO01ox4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sixuq8hvao01ox4.lnk")) returned 1 [0034.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.208] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.208] GetTickCount () returned 0x193f5 [0034.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.209] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.210] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\siXuQ8hvAO01ox4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sixuq8hvao01ox4.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413\\....\\temporaryfile")) returned 0 [0034.210] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413\\temporaryfile")) returned 1 [0034.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.212] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.212] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.212] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.212] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.212] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.212] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413\\temporaryfile")) returned 1 [0034.212] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19747b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19747b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19747b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.212] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103413" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103413")) returned 1 [0034.212] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\siXuQ8hvAO01ox4.lnk") returned 0 [0034.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\siXuQ8hvAO01ox4.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sixuq8hvao01ox4.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.213] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x3d8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x3d8, lpOverlapped=0x0) returned 1 [0034.214] CloseHandle (hObject=0xd8) returned 1 [0034.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\sLz-Qn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\slz-qn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.215] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf06 [0034.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf0e) returned 0x2649f0 [0034.215] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf06, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf06, lpOverlapped=0x0) returned 1 [0034.216] CloseHandle (hObject=0xd8) returned 1 [0034.216] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\sLz-Qn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\slz-qn.lnk")) returned 1 [0034.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.217] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.217] GetTickCount () returned 0x19404 [0034.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265908 [0034.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.218] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\sLz-Qn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\slz-qn.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428\\....\\temporaryfile")) returned 0 [0034.218] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428\\temporaryfile")) returned 1 [0034.219] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.219] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.219] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.219] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.219] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.219] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.219] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428\\temporaryfile")) returned 1 [0034.220] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.220] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.220] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428")) returned 1 [0034.220] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\sLz-Qn.lnk") returned 0 [0034.220] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\sLz-Qn.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\slz-qn.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.221] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xf10, lpOverlapped=0x0) returned 1 [0034.221] CloseHandle (hObject=0xd8) returned 1 [0034.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\SS_0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ss_0.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.222] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x284 [0034.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28c) returned 0x25c570 [0034.222] ReadFile (in: hFile=0xd8, lpBuffer=0x25c578, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c578*, lpNumberOfBytesRead=0x18fe10*=0x284, lpOverlapped=0x0) returned 1 [0034.223] CloseHandle (hObject=0xd8) returned 1 [0034.223] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\SS_0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ss_0.lnk")) returned 1 [0034.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.224] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.224] GetTickCount () returned 0x19404 [0034.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c808 [0034.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.225] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.225] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\SS_0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ss_0.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428\\....\\temporaryfile")) returned 0 [0034.225] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428\\temporaryfile")) returned 1 [0034.226] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.226] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.227] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.227] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.227] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.227] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.227] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.227] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428\\temporaryfile")) returned 1 [0034.227] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1976dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1976dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1976dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.227] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.227] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103428" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103428")) returned 1 [0034.227] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\SS_0.lnk") returned 0 [0034.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\SS_0.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ss_0.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.228] WriteFile (in: hFile=0xd8, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x288, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdf8*=0x288, lpOverlapped=0x0) returned 1 [0034.229] CloseHandle (hObject=0xd8) returned 1 [0034.233] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tefEtu9q3KkgFxvT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tefetu9q3kkgfxvt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.233] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x410 [0034.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x418) returned 0x262590 [0034.233] ReadFile (in: hFile=0xd8, lpBuffer=0x262598, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesRead=0x18fe10*=0x410, lpOverlapped=0x0) returned 1 [0034.234] CloseHandle (hObject=0xd8) returned 1 [0034.234] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tefEtu9q3KkgFxvT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tefetu9q3kkgfxvt.lnk")) returned 1 [0034.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.234] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.234] GetTickCount () returned 0x19414 [0034.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2629b0 [0034.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.237] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.238] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tefEtu9q3KkgFxvT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tefetu9q3kkgfxvt.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444\\....\\temporaryfile")) returned 0 [0034.238] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444\\temporaryfile")) returned 1 [0034.239] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.239] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.239] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.239] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.239] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.239] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.239] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.239] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444\\temporaryfile")) returned 1 [0034.239] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.240] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.240] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444")) returned 1 [0034.240] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tefEtu9q3KkgFxvT.lnk") returned 0 [0034.240] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tefEtu9q3KkgFxvT.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tefetu9q3kkgfxvt.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.241] WriteFile (in: hFile=0xd8, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdf8*=0x418, lpOverlapped=0x0) returned 1 [0034.241] CloseHandle (hObject=0xd8) returned 1 [0034.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tf9tO-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tf9to-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.242] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf46 [0034.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf4e) returned 0x2649f0 [0034.242] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf46, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf46, lpOverlapped=0x0) returned 1 [0034.243] CloseHandle (hObject=0xd8) returned 1 [0034.243] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tf9tO-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tf9to-.lnk")) returned 1 [0034.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.244] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.244] GetTickCount () returned 0x19414 [0034.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x265948 [0034.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.244] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tf9tO-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tf9to-.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444\\....\\temporaryfile")) returned 0 [0034.245] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444\\temporaryfile")) returned 1 [0034.246] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.247] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.247] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.247] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.247] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.247] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.247] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.247] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444\\temporaryfile")) returned 1 [0034.247] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19793e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19793e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19793e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.247] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.247] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103444" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103444")) returned 1 [0034.247] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tf9tO-.lnk") returned 0 [0034.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tf9tO-.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tf9to-.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.248] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xf50, lpOverlapped=0x0) returned 1 [0034.249] CloseHandle (hObject=0xd8) returned 1 [0034.250] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ThsCTAWGPdf6ip5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\thsctawgpdf6ip5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.250] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa6e [0034.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa76) returned 0x2649f0 [0034.250] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa6e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa6e, lpOverlapped=0x0) returned 1 [0034.251] CloseHandle (hObject=0xd8) returned 1 [0034.251] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ThsCTAWGPdf6ip5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\thsctawgpdf6ip5.lnk")) returned 1 [0034.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.252] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.252] GetTickCount () returned 0x19423 [0034.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.252] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.253] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ThsCTAWGPdf6ip5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\thsctawgpdf6ip5.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459\\....\\temporaryfile")) returned 0 [0034.253] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459\\temporaryfile")) returned 1 [0034.254] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.254] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.254] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.254] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.254] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.254] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.254] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.254] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459\\temporaryfile")) returned 1 [0034.254] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.254] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.255] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459")) returned 1 [0034.255] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ThsCTAWGPdf6ip5.lnk") returned 0 [0034.255] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ThsCTAWGPdf6ip5.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\thsctawgpdf6ip5.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.255] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xa78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xa78, lpOverlapped=0x0) returned 1 [0034.256] CloseHandle (hObject=0xd8) returned 1 [0034.257] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tNxjHi4dfeQcdL.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tnxjhi4dfeqcdl.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.257] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xe83 [0034.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe8b) returned 0x2649f0 [0034.257] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xe83, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xe83, lpOverlapped=0x0) returned 1 [0034.258] CloseHandle (hObject=0xd8) returned 1 [0034.258] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tNxjHi4dfeQcdL.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tnxjhi4dfeqcdl.mkv.lnk")) returned 1 [0034.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.259] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.259] GetTickCount () returned 0x19423 [0034.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.259] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.260] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tNxjHi4dfeQcdL.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tnxjhi4dfeqcdl.mkv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459\\....\\temporaryfile")) returned 0 [0034.260] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459\\temporaryfile")) returned 1 [0034.262] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.262] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.262] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.262] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.262] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.262] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.262] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459\\temporaryfile")) returned 1 [0034.263] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197b9f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197b9f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197b9f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.263] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103459" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103459")) returned 1 [0034.263] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tNxjHi4dfeQcdL.mkv.lnk") returned 0 [0034.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\tNxjHi4dfeQcdL.mkv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tnxjhi4dfeqcdl.mkv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.264] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xe88, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xe88, lpOverlapped=0x0) returned 1 [0034.265] CloseHandle (hObject=0xd8) returned 1 [0034.265] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\T_P_-SNfCBkG8Aq2jj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t_p_-snfcbkg8aq2jj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.266] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf7d [0034.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf85) returned 0x2649f0 [0034.266] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf7d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf7d, lpOverlapped=0x0) returned 1 [0034.266] CloseHandle (hObject=0xd8) returned 1 [0034.266] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\T_P_-SNfCBkG8Aq2jj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t_p_-snfcbkg8aq2jj.lnk")) returned 1 [0034.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.267] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.267] GetTickCount () returned 0x19433 [0034.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.268] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.268] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\T_P_-SNfCBkG8Aq2jj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t_p_-snfcbkg8aq2jj.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475\\....\\temporaryfile")) returned 0 [0034.268] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475\\temporaryfile")) returned 1 [0034.269] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.270] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.270] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.270] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.270] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.270] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.270] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.270] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475\\temporaryfile")) returned 1 [0034.270] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.270] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.270] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475")) returned 1 [0034.270] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\T_P_-SNfCBkG8Aq2jj.lnk") returned 0 [0034.271] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\T_P_-SNfCBkG8Aq2jj.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t_p_-snfcbkg8aq2jj.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.271] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xf88, lpOverlapped=0x0) returned 1 [0034.272] CloseHandle (hObject=0xd8) returned 1 [0034.273] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\u8CGw8 qXyI_TQhqAida.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u8cgw8 qxyi_tqhqaida.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.273] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xe45 [0034.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe4d) returned 0x2649f0 [0034.273] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xe45, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xe45, lpOverlapped=0x0) returned 1 [0034.274] CloseHandle (hObject=0xd8) returned 1 [0034.274] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\u8CGw8 qXyI_TQhqAida.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u8cgw8 qxyi_tqhqaida.lnk")) returned 1 [0034.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.274] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.275] GetTickCount () returned 0x19433 [0034.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.275] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.276] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\u8CGw8 qXyI_TQhqAida.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u8cgw8 qxyi_tqhqaida.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475\\....\\temporaryfile")) returned 0 [0034.276] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475\\temporaryfile")) returned 1 [0034.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.601] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.601] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.601] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.601] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.601] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475\\temporaryfile")) returned 1 [0034.601] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197e00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x197e00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x197e00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.601] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103475" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103475")) returned 1 [0034.602] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\u8CGw8 qXyI_TQhqAida.lnk") returned 0 [0034.602] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\u8CGw8 qXyI_TQhqAida.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u8cgw8 qxyi_tqhqaida.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.603] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xe50, lpOverlapped=0x0) returned 1 [0034.603] CloseHandle (hObject=0xd8) returned 1 [0034.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\u8FNPSsnCaar3G.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u8fnpssncaar3g.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.605] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x146c [0034.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1474) returned 0x291460 [0034.605] ReadFile (in: hFile=0xd8, lpBuffer=0x291468, nNumberOfBytesToRead=0x146c, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesRead=0x18fe10*=0x146c, lpOverlapped=0x0) returned 1 [0034.606] CloseHandle (hObject=0xd8) returned 1 [0034.606] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\u8FNPSsnCaar3G.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u8fnpssncaar3g.mkv.lnk")) returned 1 [0034.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.606] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.606] GetTickCount () returned 0x1958a [0034.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.607] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.607] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\u8FNPSsnCaar3G.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u8fnpssncaar3g.mkv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818\\....\\temporaryfile")) returned 0 [0034.607] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818\\temporaryfile")) returned 1 [0034.609] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.609] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.609] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.609] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.609] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.609] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.609] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.609] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818\\temporaryfile")) returned 1 [0034.609] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.609] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.609] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818")) returned 1 [0034.610] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\u8FNPSsnCaar3G.mkv.lnk") returned 0 [0034.610] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\u8FNPSsnCaar3G.mkv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u8fnpssncaar3g.mkv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.610] WriteFile (in: hFile=0xd8, lpBuffer=0x2928e8*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2928e8*, lpNumberOfBytesWritten=0x18fdf8*=0x1470, lpOverlapped=0x0) returned 1 [0034.611] CloseHandle (hObject=0xd8) returned 1 [0034.612] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VBGVmC8I55cDkr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vbgvmc8i55cdkr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.612] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9d3 [0034.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9db) returned 0x28e9f8 [0034.612] ReadFile (in: hFile=0xd8, lpBuffer=0x28ea00, nNumberOfBytesToRead=0x9d3, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fe10*=0x9d3, lpOverlapped=0x0) returned 1 [0034.613] CloseHandle (hObject=0xd8) returned 1 [0034.613] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VBGVmC8I55cDkr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vbgvmc8i55cdkr.lnk")) returned 1 [0034.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.614] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.614] GetTickCount () returned 0x1958a [0034.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.615] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.615] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VBGVmC8I55cDkr.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vbgvmc8i55cdkr.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818\\....\\temporaryfile")) returned 0 [0034.615] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818\\temporaryfile")) returned 1 [0034.616] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.616] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.617] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.617] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.617] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.617] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.617] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818\\temporaryfile")) returned 1 [0034.617] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b25f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b25f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b25f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.617] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.617] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103818" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103818")) returned 1 [0034.617] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VBGVmC8I55cDkr.lnk") returned 0 [0034.617] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VBGVmC8I55cDkr.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vbgvmc8i55cdkr.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.618] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x9d8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0x9d8, lpOverlapped=0x0) returned 1 [0034.619] CloseHandle (hObject=0xd8) returned 1 [0034.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VJDc9FNq06.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vjdc9fnq06.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.620] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1440 [0034.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1448) returned 0x291460 [0034.620] ReadFile (in: hFile=0xd8, lpBuffer=0x291468, nNumberOfBytesToRead=0x1440, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesRead=0x18fe10*=0x1440, lpOverlapped=0x0) returned 1 [0034.621] CloseHandle (hObject=0xd8) returned 1 [0034.621] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VJDc9FNq06.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vjdc9fnq06.mkv.lnk")) returned 1 [0034.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.622] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.622] GetTickCount () returned 0x1959a [0034.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.622] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.623] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VJDc9FNq06.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vjdc9fnq06.mkv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834\\....\\temporaryfile")) returned 0 [0034.623] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834\\temporaryfile")) returned 1 [0034.624] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.624] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.624] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.624] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.624] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.624] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.624] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.625] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834\\temporaryfile")) returned 1 [0034.625] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.625] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.625] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834")) returned 1 [0034.625] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VJDc9FNq06.mkv.lnk") returned 0 [0034.625] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VJDc9FNq06.mkv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vjdc9fnq06.mkv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.626] WriteFile (in: hFile=0xd8, lpBuffer=0x2928b8*, nNumberOfBytesToWrite=0x1448, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2928b8*, lpNumberOfBytesWritten=0x18fdf8*=0x1448, lpOverlapped=0x0) returned 1 [0034.627] CloseHandle (hObject=0xd8) returned 1 [0034.627] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\vuD7hrqb3Qw4jb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vud7hrqb3qw4jb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.628] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf9e [0034.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfa6) returned 0x2649f0 [0034.628] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf9e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf9e, lpOverlapped=0x0) returned 1 [0034.628] CloseHandle (hObject=0xd8) returned 1 [0034.628] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\vuD7hrqb3Qw4jb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vud7hrqb3qw4jb.lnk")) returned 1 [0034.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.629] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.629] GetTickCount () returned 0x1959a [0034.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2659a0 [0034.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.630] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.630] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\vuD7hrqb3Qw4jb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vud7hrqb3qw4jb.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834\\....\\temporaryfile")) returned 0 [0034.630] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834\\temporaryfile")) returned 1 [0034.632] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.632] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.632] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.632] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.632] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.632] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.632] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.632] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834\\temporaryfile")) returned 1 [0034.632] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b4c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b4c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b4c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.632] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.632] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103834" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103834")) returned 1 [0034.633] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\vuD7hrqb3Qw4jb.lnk") returned 0 [0034.633] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\vuD7hrqb3Qw4jb.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vud7hrqb3qw4jb.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.633] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xfa8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xfa8, lpOverlapped=0x0) returned 1 [0034.634] CloseHandle (hObject=0xd8) returned 1 [0034.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VVWQOJivCiw.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vvwqojivciw.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.660] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x248 [0034.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x250) returned 0x259e70 [0034.660] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x248, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x248, lpOverlapped=0x0) returned 1 [0034.661] CloseHandle (hObject=0xd8) returned 1 [0034.661] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VVWQOJivCiw.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vvwqojivciw.ots.lnk")) returned 1 [0034.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.662] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.662] GetTickCount () returned 0x195b9 [0034.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.662] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103865\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103865\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.663] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VVWQOJivCiw.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vvwqojivciw.ots.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103865\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103865\\....\\temporaryfile")) returned 0 [0034.663] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103865\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103865\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103865\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103865\\temporaryfile")) returned 1 [0034.664] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103865\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b98340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b98340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b98340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.664] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b98340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b98340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b98340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.664] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b98340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b98340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b98340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.664] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103865\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b98340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b98340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b98340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.665] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b98340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b98340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b98340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.665] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b98340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b98340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b98340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.665] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.665] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103865\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103865\\temporaryfile")) returned 1 [0034.665] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19b98340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19b98340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19b98340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.665] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.665] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103865" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103865")) returned 1 [0034.665] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VVWQOJivCiw.ots.lnk") returned 0 [0034.665] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\VVWQOJivCiw.ots.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vvwqojivciw.ots.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.666] WriteFile (in: hFile=0xd8, lpBuffer=0x25a0d0*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25a0d0*, lpNumberOfBytesWritten=0x18fdf8*=0x250, lpOverlapped=0x0) returned 1 [0034.667] CloseHandle (hObject=0xd8) returned 1 [0034.668] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w0Ctkj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w0ctkj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.668] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3dc [0034.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3e4) returned 0x259e70 [0034.668] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x3dc, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x3dc, lpOverlapped=0x0) returned 1 [0034.669] CloseHandle (hObject=0xd8) returned 1 [0034.669] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w0Ctkj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w0ctkj.lnk")) returned 1 [0034.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.670] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.670] GetTickCount () returned 0x195c9 [0034.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.678] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103881\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103881\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w0Ctkj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w0ctkj.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103881\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103881\\....\\temporaryfile")) returned 0 [0034.678] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103881\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103881\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103881\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103881\\temporaryfile")) returned 1 [0034.680] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103881\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19bbe4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19bbe4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19bbe4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.680] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19bbe4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19bbe4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19bbe4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.680] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19bbe4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19bbe4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19bbe4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.680] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103881\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19bbe4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19bbe4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19bbe4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.680] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19bbe4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19bbe4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19bbe4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.680] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19bbe4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19bbe4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19bbe4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.680] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.680] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103881\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103881\\temporaryfile")) returned 1 [0034.680] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19bbe4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19bbe4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19bbe4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.680] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.680] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103881" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103881")) returned 1 [0034.681] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w0Ctkj.lnk") returned 0 [0034.681] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w0Ctkj.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w0ctkj.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.681] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0x3e0, lpOverlapped=0x0) returned 1 [0034.683] CloseHandle (hObject=0xd8) returned 1 [0034.684] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w7j NA8Fc2Fqu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w7j na8fc2fqu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.684] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf64 [0034.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf6c) returned 0x2649f0 [0034.684] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf64, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf64, lpOverlapped=0x0) returned 1 [0034.685] CloseHandle (hObject=0xd8) returned 1 [0034.685] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w7j NA8Fc2Fqu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w7j na8fc2fqu.lnk")) returned 1 [0034.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.686] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.686] GetTickCount () returned 0x195d8 [0034.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.686] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103896\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103896\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w7j NA8Fc2Fqu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w7j na8fc2fqu.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103896\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103896\\....\\temporaryfile")) returned 0 [0034.687] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103896\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103896\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103896\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103896\\temporaryfile")) returned 1 [0034.688] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103896\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19be4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19be4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19be4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.688] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19be4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19be4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19be4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.688] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19be4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19be4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19be4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.688] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103896\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19be4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19be4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19be4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.688] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19be4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19be4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19be4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.688] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19be4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19be4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19be4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.688] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.688] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103896\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103896\\temporaryfile")) returned 1 [0034.688] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19be4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19be4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19be4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.689] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.689] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103896" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103896")) returned 1 [0034.689] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w7j NA8Fc2Fqu.lnk") returned 0 [0034.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w7j NA8Fc2Fqu.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w7j na8fc2fqu.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.689] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xf68, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xf68, lpOverlapped=0x0) returned 1 [0034.690] CloseHandle (hObject=0xd8) returned 1 [0034.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wcytZbmWqSORl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wcytzbmwqsorl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.691] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf8f [0034.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf97) returned 0x2649f0 [0034.691] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf8f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf8f, lpOverlapped=0x0) returned 1 [0034.697] CloseHandle (hObject=0xd8) returned 1 [0034.697] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wcytZbmWqSORl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wcytzbmwqsorl.lnk")) returned 1 [0034.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.698] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.698] GetTickCount () returned 0x195e8 [0034.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.699] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.699] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.699] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wcytZbmWqSORl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wcytzbmwqsorl.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912\\....\\temporaryfile")) returned 0 [0034.699] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912\\temporaryfile")) returned 1 [0034.701] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.701] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.701] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.701] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.701] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.701] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.701] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.701] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912\\temporaryfile")) returned 1 [0034.701] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.701] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.701] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912")) returned 1 [0034.702] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wcytZbmWqSORl.lnk") returned 0 [0034.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wcytZbmWqSORl.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wcytzbmwqsorl.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.702] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xf98, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xf98, lpOverlapped=0x0) returned 1 [0034.703] CloseHandle (hObject=0xd8) returned 1 [0034.704] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\WKgBkja.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wkgbkja.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.704] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x295 [0034.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x29d) returned 0x259e70 [0034.704] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x295, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x295, lpOverlapped=0x0) returned 1 [0034.705] CloseHandle (hObject=0xd8) returned 1 [0034.705] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\WKgBkja.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wkgbkja.lnk")) returned 1 [0034.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.706] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.706] GetTickCount () returned 0x195e8 [0034.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.706] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.707] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\WKgBkja.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wkgbkja.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912\\....\\temporaryfile")) returned 0 [0034.707] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912\\temporaryfile")) returned 1 [0034.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.708] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.708] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.708] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.708] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.708] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.708] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912\\temporaryfile")) returned 1 [0034.709] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c0a760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c0a760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c0a760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.709] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.709] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103912" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103912")) returned 1 [0034.709] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\WKgBkja.lnk") returned 0 [0034.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\WKgBkja.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wkgbkja.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.710] WriteFile (in: hFile=0xd8, lpBuffer=0x25a120*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25a120*, lpNumberOfBytesWritten=0x18fdf8*=0x2a0, lpOverlapped=0x0) returned 1 [0034.710] CloseHandle (hObject=0xd8) returned 1 [0034.711] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wt3HXsmzIUggPP_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt3hxsmziuggpp_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.711] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa6e [0034.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa76) returned 0x2649f0 [0034.711] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa6e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa6e, lpOverlapped=0x0) returned 1 [0034.712] CloseHandle (hObject=0xd8) returned 1 [0034.712] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wt3HXsmzIUggPP_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt3hxsmziuggpp_.lnk")) returned 1 [0034.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.721] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.722] GetTickCount () returned 0x195f7 [0034.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.722] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103927\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103927\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.722] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wt3HXsmzIUggPP_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt3hxsmziuggpp_.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103927\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103927\\....\\temporaryfile")) returned 0 [0034.722] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103927\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103927\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103927\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103927\\temporaryfile")) returned 1 [0034.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103927\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c308c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c308c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c308c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.724] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c308c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c308c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c308c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.724] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c308c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c308c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c308c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103927\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c308c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c308c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c308c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.724] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c308c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c308c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c308c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.724] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c308c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c308c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c308c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.724] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.724] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103927\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103927\\temporaryfile")) returned 1 [0034.724] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c308c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c308c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c308c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.725] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103927" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103927")) returned 1 [0034.725] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wt3HXsmzIUggPP_.lnk") returned 0 [0034.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wt3HXsmzIUggPP_.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt3hxsmziuggpp_.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.726] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xa78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xa78, lpOverlapped=0x0) returned 1 [0034.727] CloseHandle (hObject=0xd8) returned 1 [0034.728] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\WU-9paSh0TSA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wu-9pash0tsa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.728] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x98c [0034.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x994) returned 0x28e9f8 [0034.728] ReadFile (in: hFile=0xd8, lpBuffer=0x28ea00, nNumberOfBytesToRead=0x98c, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fe10*=0x98c, lpOverlapped=0x0) returned 1 [0034.729] CloseHandle (hObject=0xd8) returned 1 [0034.729] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\WU-9paSh0TSA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wu-9pash0tsa.lnk")) returned 1 [0034.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.730] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.730] GetTickCount () returned 0x19607 [0034.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.730] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.730] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\WU-9paSh0TSA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wu-9pash0tsa.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943\\....\\temporaryfile")) returned 0 [0034.730] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943\\temporaryfile")) returned 1 [0034.732] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.732] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.732] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.732] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.732] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.732] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.732] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.732] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943\\temporaryfile")) returned 1 [0034.732] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.732] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.732] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943")) returned 1 [0034.733] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\WU-9paSh0TSA.lnk") returned 0 [0034.733] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\WU-9paSh0TSA.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wu-9pash0tsa.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.733] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0x990, lpOverlapped=0x0) returned 1 [0034.734] CloseHandle (hObject=0xd8) returned 1 [0034.735] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wvisDVGwhMu ffvUh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wvisdvgwhmu ffvuh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.735] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xfbb [0034.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfc3) returned 0x2649f0 [0034.735] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xfbb, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xfbb, lpOverlapped=0x0) returned 1 [0034.736] CloseHandle (hObject=0xd8) returned 1 [0034.736] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wvisDVGwhMu ffvUh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wvisdvgwhmu ffvuh.lnk")) returned 1 [0034.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.737] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.737] GetTickCount () returned 0x19607 [0034.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2659c0 [0034.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.738] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.738] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wvisDVGwhMu ffvUh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wvisdvgwhmu ffvuh.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943\\....\\temporaryfile")) returned 0 [0034.738] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943\\temporaryfile")) returned 1 [0034.739] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.739] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.739] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.739] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.740] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.740] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.740] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.740] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943\\temporaryfile")) returned 1 [0034.740] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c56a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c56a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c56a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.740] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.740] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103943" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103943")) returned 1 [0034.740] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wvisDVGwhMu ffvUh.lnk") returned 0 [0034.740] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\wvisDVGwhMu ffvUh.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wvisdvgwhmu ffvuh.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.741] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xfc0, lpOverlapped=0x0) returned 1 [0034.742] CloseHandle (hObject=0xd8) returned 1 [0034.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w_MGGU cdFd.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w_mggu cdfd.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.743] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x248 [0034.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x250) returned 0x259e70 [0034.743] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x248, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x248, lpOverlapped=0x0) returned 1 [0034.744] CloseHandle (hObject=0xd8) returned 1 [0034.744] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w_MGGU cdFd.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w_mggu cdfd.flv.lnk")) returned 1 [0034.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.745] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.745] GetTickCount () returned 0x19617 [0034.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.746] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w_MGGU cdFd.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w_mggu cdfd.flv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959\\....\\temporaryfile")) returned 0 [0034.746] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959\\temporaryfile")) returned 1 [0034.747] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.747] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.747] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.747] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.747] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.748] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.748] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.748] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959\\temporaryfile")) returned 1 [0034.748] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.748] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.748] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959")) returned 1 [0034.748] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w_MGGU cdFd.flv.lnk") returned 0 [0034.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\w_MGGU cdFd.flv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w_mggu cdfd.flv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.749] WriteFile (in: hFile=0xd8, lpBuffer=0x25a0d0*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25a0d0*, lpNumberOfBytesWritten=0x18fdf8*=0x250, lpOverlapped=0x0) returned 1 [0034.750] CloseHandle (hObject=0xd8) returned 1 [0034.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\X4gIJecgSY-_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x4gijecgsy-_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.750] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa31 [0034.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa39) returned 0x28e9f8 [0034.751] ReadFile (in: hFile=0xd8, lpBuffer=0x28ea00, nNumberOfBytesToRead=0xa31, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fe10*=0xa31, lpOverlapped=0x0) returned 1 [0034.751] CloseHandle (hObject=0xd8) returned 1 [0034.751] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\X4gIJecgSY-_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x4gijecgsy-_.lnk")) returned 1 [0034.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.752] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.752] GetTickCount () returned 0x19617 [0034.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.753] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.753] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\X4gIJecgSY-_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x4gijecgsy-_.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959\\....\\temporaryfile")) returned 0 [0034.754] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959\\temporaryfile")) returned 1 [0034.755] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.755] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.755] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.755] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.755] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.755] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.755] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959\\temporaryfile")) returned 1 [0034.755] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19c7cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19c7cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19c7cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.755] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103959" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103959")) returned 1 [0034.756] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\X4gIJecgSY-_.lnk") returned 0 [0034.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\X4gIJecgSY-_.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x4gijecgsy-_.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.756] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xa38, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0xa38, lpOverlapped=0x0) returned 1 [0034.757] CloseHandle (hObject=0xd8) returned 1 [0034.758] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\xF rEYVMCXzUTbMksZVb.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xf reyvmcxzutbmkszvb.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.758] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x14ae [0034.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14b6) returned 0x291460 [0034.758] ReadFile (in: hFile=0xd8, lpBuffer=0x291468, nNumberOfBytesToRead=0x14ae, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesRead=0x18fe10*=0x14ae, lpOverlapped=0x0) returned 1 [0034.759] CloseHandle (hObject=0xd8) returned 1 [0034.759] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\xF rEYVMCXzUTbMksZVb.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xf reyvmcxzutbmkszvb.mkv.lnk")) returned 1 [0034.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.760] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.760] GetTickCount () returned 0x19626 [0034.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.760] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.761] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\xF rEYVMCXzUTbMksZVb.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xf reyvmcxzutbmkszvb.mkv.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\....\\temporaryfile")) returned 0 [0034.761] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\temporaryfile")) returned 1 [0034.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.762] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.762] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.762] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.762] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.762] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.762] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\temporaryfile")) returned 1 [0034.762] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.762] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974")) returned 1 [0034.763] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\xF rEYVMCXzUTbMksZVb.mkv.lnk") returned 0 [0034.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\xF rEYVMCXzUTbMksZVb.mkv.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xf reyvmcxzutbmkszvb.mkv.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.764] WriteFile (in: hFile=0xd8, lpBuffer=0x292928*, nNumberOfBytesToWrite=0x14b8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x292928*, lpNumberOfBytesWritten=0x18fdf8*=0x14b8, lpOverlapped=0x0) returned 1 [0034.764] CloseHandle (hObject=0xd8) returned 1 [0034.765] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\xzSJ7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xzsj7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.765] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x289 [0034.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x291) returned 0x259e70 [0034.765] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x289, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x289, lpOverlapped=0x0) returned 1 [0034.766] CloseHandle (hObject=0xd8) returned 1 [0034.766] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\xzSJ7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xzsj7.lnk")) returned 1 [0034.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.767] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.767] GetTickCount () returned 0x19626 [0034.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.768] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.768] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\xzSJ7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xzsj7.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\....\\temporaryfile")) returned 0 [0034.768] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\temporaryfile")) returned 1 [0034.769] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.769] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.769] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.769] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.769] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.769] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.770] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.770] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\temporaryfile")) returned 1 [0034.770] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.770] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.770] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974")) returned 1 [0034.770] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\xzSJ7.lnk") returned 0 [0034.770] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\xzSJ7.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xzsj7.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.771] WriteFile (in: hFile=0xd8, lpBuffer=0x25a118*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25a118*, lpNumberOfBytesWritten=0x18fdf8*=0x290, lpOverlapped=0x0) returned 1 [0034.772] CloseHandle (hObject=0xd8) returned 1 [0034.772] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YBis7kkv5pT8UqO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ybis7kkv5pt8uqo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.772] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf58 [0034.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf60) returned 0x2649f0 [0034.773] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf58, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf58, lpOverlapped=0x0) returned 1 [0034.773] CloseHandle (hObject=0xd8) returned 1 [0034.773] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YBis7kkv5pT8UqO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ybis7kkv5pt8uqo.lnk")) returned 1 [0034.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.774] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.774] GetTickCount () returned 0x19626 [0034.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.775] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.776] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YBis7kkv5pT8UqO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ybis7kkv5pt8uqo.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\....\\temporaryfile")) returned 0 [0034.776] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\temporaryfile")) returned 1 [0034.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19cc8e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19cc8e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.777] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19cc8e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19cc8e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.777] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.777] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.777] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.777] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974\\temporaryfile")) returned 1 [0034.777] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ca2ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ca2ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ca2ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.777] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103974" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103974")) returned 1 [0034.778] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YBis7kkv5pT8UqO.lnk") returned 0 [0034.778] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YBis7kkv5pT8UqO.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ybis7kkv5pt8uqo.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.779] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xf60, lpOverlapped=0x0) returned 1 [0034.779] CloseHandle (hObject=0xd8) returned 1 [0034.780] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\yF7UTSD8x5Tqa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yf7utsd8x5tqa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.780] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa38 [0034.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa40) returned 0x28e9f8 [0034.780] ReadFile (in: hFile=0xd8, lpBuffer=0x28ea00, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesRead=0x18fe10*=0xa38, lpOverlapped=0x0) returned 1 [0034.781] CloseHandle (hObject=0xd8) returned 1 [0034.781] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\yF7UTSD8x5Tqa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yf7utsd8x5tqa.lnk")) returned 1 [0034.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.782] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.782] GetTickCount () returned 0x19636 [0034.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.782] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103990\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.796] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\yF7UTSD8x5Tqa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yf7utsd8x5tqa.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103990\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103990\\....\\temporaryfile")) returned 0 [0034.796] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103990\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103990\\temporaryfile")) returned 1 [0034.797] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103990\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19cc8e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ceefa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ceefa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.797] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19cc8e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ceefa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ceefa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.797] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19cc8e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19cc8e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19cc8e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.797] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103990\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19cc8e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19cc8e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19cc8e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.798] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19cc8e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19cc8e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19cc8e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.798] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19cc8e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19cc8e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19cc8e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.798] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103990\\temporaryfile")) returned 1 [0034.798] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19cc8e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19cc8e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19cc8e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.798] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18103990" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18103990")) returned 1 [0034.798] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\yF7UTSD8x5Tqa.lnk") returned 0 [0034.798] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\yF7UTSD8x5Tqa.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yf7utsd8x5tqa.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.799] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0xa40, lpOverlapped=0x0) returned 1 [0034.800] CloseHandle (hObject=0xd8) returned 1 [0034.800] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YitNJanVQcH2FO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yitnjanvqch2fo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.801] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf51 [0034.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf59) returned 0x2649f0 [0034.801] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf51, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf51, lpOverlapped=0x0) returned 1 [0034.801] CloseHandle (hObject=0xd8) returned 1 [0034.801] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YitNJanVQcH2FO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yitnjanvqch2fo.lnk")) returned 1 [0034.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.802] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.802] GetTickCount () returned 0x19645 [0034.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0034.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.803] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104005\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104005\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.803] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YitNJanVQcH2FO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yitnjanvqch2fo.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104005\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104005\\....\\temporaryfile")) returned 0 [0034.803] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104005\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104005\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104005\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104005\\temporaryfile")) returned 1 [0034.805] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104005\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ceefa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ceefa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ceefa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.805] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ceefa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ceefa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ceefa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.805] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ceefa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ceefa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ceefa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.805] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104005\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ceefa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ceefa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ceefa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.805] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ceefa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ceefa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ceefa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.805] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ceefa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ceefa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ceefa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.805] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.805] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104005\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104005\\temporaryfile")) returned 1 [0034.805] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ceefa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ceefa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ceefa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.805] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.805] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104005" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104005")) returned 1 [0034.805] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YitNJanVQcH2FO.lnk") returned 0 [0034.806] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YitNJanVQcH2FO.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yitnjanvqch2fo.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.806] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xf58, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xf58, lpOverlapped=0x0) returned 1 [0034.807] CloseHandle (hObject=0xd8) returned 1 [0034.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\yNNti.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ynnti.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.808] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xf33 [0034.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf3b) returned 0x2649f0 [0034.808] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xf33, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xf33, lpOverlapped=0x0) returned 1 [0034.809] CloseHandle (hObject=0xd8) returned 1 [0034.809] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\yNNti.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ynnti.lnk")) returned 1 [0034.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.810] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.810] GetTickCount () returned 0x19655 [0034.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.811] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.811] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\yNNti.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ynnti.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021\\....\\temporaryfile")) returned 0 [0034.811] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021\\temporaryfile")) returned 1 [0034.814] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.814] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.814] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.814] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.814] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.814] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.814] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.814] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021\\temporaryfile")) returned 1 [0034.815] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.815] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.815] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021")) returned 1 [0034.815] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\yNNti.lnk") returned 0 [0034.815] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\yNNti.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ynnti.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.816] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xf38, lpOverlapped=0x0) returned 1 [0034.816] CloseHandle (hObject=0xd8) returned 1 [0034.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YqrvAc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yqrvac.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.818] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x22d [0034.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x235) returned 0x259e70 [0034.818] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x22d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x22d, lpOverlapped=0x0) returned 1 [0034.818] CloseHandle (hObject=0xd8) returned 1 [0034.819] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YqrvAc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yqrvac.lnk")) returned 1 [0034.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.819] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.819] GetTickCount () returned 0x19655 [0034.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.820] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.821] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YqrvAc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yqrvac.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021\\....\\temporaryfile")) returned 0 [0034.821] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021\\temporaryfile")) returned 1 [0034.822] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.822] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.822] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.822] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.822] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.822] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.822] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.822] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021\\temporaryfile")) returned 1 [0034.822] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d15100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d15100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d15100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.822] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.822] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104021" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104021")) returned 1 [0034.823] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YqrvAc.lnk") returned 0 [0034.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\YqrvAc.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yqrvac.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.824] WriteFile (in: hFile=0xd8, lpBuffer=0x25a0b8*, nNumberOfBytesToWrite=0x238, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25a0b8*, lpNumberOfBytesWritten=0x18fdf8*=0x238, lpOverlapped=0x0) returned 1 [0034.825] CloseHandle (hObject=0xd8) returned 1 [0034.825] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Y_JdOEwgYzgJjoB_mnj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y_jdoewgyzgjjob_mnj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.825] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa7a [0034.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa82) returned 0x2649f0 [0034.825] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa7a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa7a, lpOverlapped=0x0) returned 1 [0034.826] CloseHandle (hObject=0xd8) returned 1 [0034.826] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Y_JdOEwgYzgJjoB_mnj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y_jdoewgyzgjjob_mnj.lnk")) returned 1 [0034.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.827] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.827] GetTickCount () returned 0x19665 [0034.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.828] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.828] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Y_JdOEwgYzgJjoB_mnj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y_jdoewgyzgjjob_mnj.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037\\....\\temporaryfile")) returned 0 [0034.828] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037\\temporaryfile")) returned 1 [0034.829] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.829] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.829] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.829] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.829] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.829] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.829] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.829] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037\\temporaryfile")) returned 1 [0034.830] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.830] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.830] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037")) returned 1 [0034.830] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Y_JdOEwgYzgJjoB_mnj.lnk") returned 0 [0034.830] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\Y_JdOEwgYzgJjoB_mnj.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y_jdoewgyzgjjob_mnj.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.831] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xa80, lpOverlapped=0x0) returned 1 [0034.831] CloseHandle (hObject=0xd8) returned 1 [0034.832] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ZwQr6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zwqr6.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.832] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xef3 [0034.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xefb) returned 0x2649f0 [0034.832] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xef3, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xef3, lpOverlapped=0x0) returned 1 [0034.833] CloseHandle (hObject=0xd8) returned 1 [0034.833] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ZwQr6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zwqr6.lnk")) returned 1 [0034.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.834] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.834] GetTickCount () returned 0x19665 [0034.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.834] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.835] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ZwQr6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zwqr6.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037\\....\\temporaryfile")) returned 0 [0034.835] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037\\temporaryfile")) returned 1 [0034.836] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.836] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.836] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.836] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.836] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.836] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.836] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.837] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037\\temporaryfile")) returned 1 [0034.837] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d3b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.837] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.837] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104037" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104037")) returned 1 [0034.837] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ZwQr6.lnk") returned 0 [0034.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\ZwQr6.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zwqr6.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.842] WriteFile (in: hFile=0xd8, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdf8*=0xef8, lpOverlapped=0x0) returned 1 [0034.843] CloseHandle (hObject=0xd8) returned 1 [0034.843] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0034.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x19d3b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d3b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0034.844] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0034.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.844] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0034.844] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcf66470, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0034.844] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a) returned 0x262998 [0034.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.844] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd600 [0034.844] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd608) returned 0x291460 [0034.844] ReadFile (in: hFile=0xdc, lpBuffer=0x291468, nNumberOfBytesToRead=0xd600, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesRead=0x18fdf0*=0xd600, lpOverlapped=0x0) returned 1 [0034.845] CloseHandle (hObject=0xdc) returned 1 [0034.845] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms")) returned 1 [0034.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.846] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.847] GetTickCount () returned 0x19674 [0034.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0034.847] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104052\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104052\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.847] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104052\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104052\\....\\temporaryfile")) returned 0 [0034.847] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104052\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104052\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104052\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104052\\temporaryfile")) returned 1 [0034.848] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104052\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d613c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d613c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d613c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.849] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d613c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d613c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d613c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.849] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d613c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d613c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d613c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.849] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104052\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d613c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d613c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d613c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0034.849] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d613c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d613c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d613c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.849] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d613c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d613c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d613c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.849] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0034.849] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104052\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104052\\temporaryfile")) returned 1 [0034.849] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d613c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d613c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d613c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.849] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.849] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104052" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104052")) returned 1 [0034.849] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms") returned 0 [0034.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.851] WriteFile (in: hFile=0xdc, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0xd608, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdd8*=0xd608, lpOverlapped=0x0) returned 1 [0034.853] CloseHandle (hObject=0xdc) returned 1 [0034.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.857] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a00 [0034.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a08) returned 0x291460 [0034.857] ReadFile (in: hFile=0xdc, lpBuffer=0x291468, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesRead=0x18fdf0*=0x1a00, lpOverlapped=0x0) returned 1 [0034.859] CloseHandle (hObject=0xdc) returned 1 [0034.859] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms")) returned 1 [0034.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.860] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.860] GetTickCount () returned 0x19684 [0034.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595f8 [0034.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0034.860] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104068\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104068\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.860] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104068\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104068\\....\\temporaryfile")) returned 0 [0034.861] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104068\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104068\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104068\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104068\\temporaryfile")) returned 1 [0034.862] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104068\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d87520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d87520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d87520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.862] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d87520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d87520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d87520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.862] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d87520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d87520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d87520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.862] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104068\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d87520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d87520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d87520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0034.862] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d87520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d87520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d87520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.862] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d87520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d87520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d87520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.862] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0034.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104068\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104068\\temporaryfile")) returned 1 [0034.862] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19d87520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19d87520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19d87520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.862] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104068" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104068")) returned 1 [0034.863] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned 0 [0034.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.863] WriteFile (in: hFile=0xdc, lpBuffer=0x292e78*, nNumberOfBytesToWrite=0x1a08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x292e78*, lpNumberOfBytesWritten=0x18fdd8*=0x1a08, lpOverlapped=0x0) returned 1 [0034.864] CloseHandle (hObject=0xdc) returned 1 [0034.866] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.869] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe00 [0034.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2649f0 [0034.869] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xe00, lpOverlapped=0x0) returned 1 [0034.871] CloseHandle (hObject=0xdc) returned 1 [0034.871] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms")) returned 1 [0034.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.872] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.872] GetTickCount () returned 0x19693 [0034.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595c0 [0034.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0034.872] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.872] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083\\....\\temporaryfile")) returned 0 [0034.873] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083\\temporaryfile")) returned 1 [0034.874] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.874] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.874] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.874] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0034.874] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.874] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.874] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0034.874] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083\\temporaryfile")) returned 1 [0034.874] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.874] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.874] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083")) returned 1 [0034.874] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms") returned 0 [0034.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\eb282ead62b4db87.automaticDestinations-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\eb282ead62b4db87.automaticdestinations-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.875] WriteFile (in: hFile=0xdc, lpBuffer=0x291468*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesWritten=0x18fdd8*=0xe08, lpOverlapped=0x0) returned 1 [0034.876] CloseHandle (hObject=0xdc) returned 1 [0034.877] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.877] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0034.877] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.877] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.878] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0034.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x27) returned 0x2596b8 [0034.878] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.879] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18 [0034.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x255c48 [0034.879] ReadFile (in: hFile=0xdc, lpBuffer=0x255c50, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x255c50*, lpNumberOfBytesRead=0x18fdf0*=0x18, lpOverlapped=0x0) returned 1 [0034.880] CloseHandle (hObject=0xdc) returned 1 [0034.880] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms")) returned 1 [0034.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.881] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0034.881] GetTickCount () returned 0x19693 [0034.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0034.881] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.882] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083\\....\\temporaryfile")) returned 0 [0034.882] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083\\temporaryfile")) returned 1 [0034.883] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.883] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19, cFileName="..", cAlternateFileName="")) returned 1 [0034.883] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.883] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0034.883] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.883] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.883] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0034.884] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083\\temporaryfile")) returned 1 [0034.884] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dad680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dad680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dad680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.884] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.884] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104083" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104083")) returned 1 [0034.884] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms") returned 0 [0034.884] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.888] WriteFile (in: hFile=0xdc, lpBuffer=0x259690*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259690*, lpNumberOfBytesWritten=0x18fdd8*=0x20, lpOverlapped=0x0) returned 1 [0034.889] CloseHandle (hObject=0xdc) returned 1 [0034.890] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.890] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f68 [0034.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f70) returned 0x291460 [0034.890] ReadFile (in: hFile=0xdc, lpBuffer=0x291468, nNumberOfBytesToRead=0x1f68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesRead=0x18fdf0*=0x1f68, lpOverlapped=0x0) returned 1 [0034.892] CloseHandle (hObject=0xdc) returned 1 [0034.892] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms")) returned 1 [0034.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.893] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.893] GetTickCount () returned 0x196a3 [0034.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0034.893] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104099\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104099\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.894] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104099\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104099\\....\\temporaryfile")) returned 0 [0034.894] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104099\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104099\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104099\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104099\\temporaryfile")) returned 1 [0034.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104099\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dd37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dd37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dd37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.895] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dd37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dd37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dd37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.895] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dd37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dd37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dd37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104099\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dd37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dd37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dd37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0034.895] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dd37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dd37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dd37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.895] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dd37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dd37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dd37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.895] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0034.895] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104099\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104099\\temporaryfile")) returned 1 [0034.895] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19dd37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19dd37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19dd37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.896] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.896] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104099" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104099")) returned 1 [0034.896] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned 0 [0034.896] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.897] WriteFile (in: hFile=0xdc, lpBuffer=0x2933e0*, nNumberOfBytesToWrite=0x1f70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2933e0*, lpNumberOfBytesWritten=0x18fdd8*=0x1f70, lpOverlapped=0x0) returned 1 [0034.898] CloseHandle (hObject=0xdc) returned 1 [0034.899] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.899] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x43a3 [0034.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x43ab) returned 0x291460 [0034.899] ReadFile (in: hFile=0xdc, lpBuffer=0x291468, nNumberOfBytesToRead=0x43a3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesRead=0x18fdf0*=0x43a3, lpOverlapped=0x0) returned 1 [0034.901] CloseHandle (hObject=0xdc) returned 1 [0034.901] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms")) returned 1 [0034.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.902] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0034.902] GetTickCount () returned 0x196b3 [0034.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0034.903] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.903] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115\\....\\temporaryfile")) returned 0 [0034.903] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115\\temporaryfile")) returned 1 [0034.904] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.904] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.904] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.904] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0034.904] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.904] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.904] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0034.905] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115\\temporaryfile")) returned 1 [0034.905] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.905] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.905] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115")) returned 1 [0034.905] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms") returned 0 [0034.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.906] WriteFile (in: hFile=0xdc, lpBuffer=0x295820*, nNumberOfBytesToWrite=0x43a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x295820*, lpNumberOfBytesWritten=0x18fdd8*=0x43a8, lpOverlapped=0x0) returned 1 [0034.907] CloseHandle (hObject=0xdc) returned 1 [0034.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.909] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17d4 [0034.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17dc) returned 0x291460 [0034.909] ReadFile (in: hFile=0xdc, lpBuffer=0x291468, nNumberOfBytesToRead=0x17d4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesRead=0x18fdf0*=0x17d4, lpOverlapped=0x0) returned 1 [0034.910] CloseHandle (hObject=0xdc) returned 1 [0034.910] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms")) returned 1 [0034.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.911] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.911] GetTickCount () returned 0x196b3 [0034.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0034.912] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.912] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115\\....\\temporaryfile")) returned 0 [0034.912] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115\\temporaryfile")) returned 1 [0034.913] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.914] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.914] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0034.914] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.914] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.914] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0034.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115\\temporaryfile")) returned 1 [0034.914] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19df9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19df9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19df9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.914] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104115" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104115")) returned 1 [0034.914] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms") returned 0 [0034.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\5d696d521de238c3.customDestinations-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5d696d521de238c3.customdestinations-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.915] WriteFile (in: hFile=0xdc, lpBuffer=0x292c50*, nNumberOfBytesToWrite=0x17d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x292c50*, lpNumberOfBytesWritten=0x18fdd8*=0x17d8, lpOverlapped=0x0) returned 1 [0034.917] CloseHandle (hObject=0xdc) returned 1 [0034.918] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.918] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18 [0034.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x255c48 [0034.919] ReadFile (in: hFile=0xdc, lpBuffer=0x255c50, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x255c50*, lpNumberOfBytesRead=0x18fdf0*=0x18, lpOverlapped=0x0) returned 1 [0034.920] CloseHandle (hObject=0xdc) returned 1 [0034.920] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms")) returned 1 [0034.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.920] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0034.921] GetTickCount () returned 0x196c2 [0034.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0034.921] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104130\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104130\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.921] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104130\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104130\\....\\temporaryfile")) returned 0 [0034.921] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104130\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104130\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104130\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104130\\temporaryfile")) returned 1 [0034.922] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104130\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e1faa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e1faa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e1faa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.922] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e1faa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e1faa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e1faa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.922] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e1faa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e1faa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e1faa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.922] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104130\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e1faa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e1faa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e1faa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0034.923] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e1faa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e1faa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e1faa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.923] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e1faa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e1faa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e1faa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.923] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0034.923] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104130\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104130\\temporaryfile")) returned 1 [0034.923] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e1faa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e1faa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e1faa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.923] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.923] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104130" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104130")) returned 1 [0034.923] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned 0 [0034.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.924] WriteFile (in: hFile=0xdc, lpBuffer=0x259690*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259690*, lpNumberOfBytesWritten=0x18fdd8*=0x20, lpOverlapped=0x0) returned 1 [0034.925] CloseHandle (hObject=0xdc) returned 1 [0034.925] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.929] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x23ff [0034.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2407) returned 0x291460 [0034.929] ReadFile (in: hFile=0xdc, lpBuffer=0x291468, nNumberOfBytesToRead=0x23ff, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesRead=0x18fdf0*=0x23ff, lpOverlapped=0x0) returned 1 [0034.931] CloseHandle (hObject=0xdc) returned 1 [0034.931] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms")) returned 1 [0034.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.932] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.932] GetTickCount () returned 0x196d2 [0034.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0034.933] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.933] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146\\....\\temporaryfile")) returned 0 [0034.933] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146\\temporaryfile")) returned 1 [0034.934] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.934] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.934] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.934] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0034.934] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.934] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.934] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0034.934] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146\\temporaryfile")) returned 1 [0034.935] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.935] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.935] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146")) returned 1 [0034.935] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms") returned 0 [0034.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\be71009ff8bb02a2.customDestinations-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\be71009ff8bb02a2.customdestinations-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.936] WriteFile (in: hFile=0xdc, lpBuffer=0x293878*, nNumberOfBytesToWrite=0x2408, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x293878*, lpNumberOfBytesWritten=0x18fdd8*=0x2408, lpOverlapped=0x0) returned 1 [0034.937] CloseHandle (hObject=0xdc) returned 1 [0034.937] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.939] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f68 [0034.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f70) returned 0x291460 [0034.939] ReadFile (in: hFile=0xdc, lpBuffer=0x291468, nNumberOfBytesToRead=0x1f68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x291468*, lpNumberOfBytesRead=0x18fdf0*=0x1f68, lpOverlapped=0x0) returned 1 [0034.940] CloseHandle (hObject=0xdc) returned 1 [0034.940] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms")) returned 1 [0034.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.941] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0034.941] GetTickCount () returned 0x196d2 [0034.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0034.942] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.942] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146\\....\\temporaryfile")) returned 0 [0034.942] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146\\temporaryfile")) returned 1 [0034.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.943] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.943] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0034.943] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.944] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.944] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0034.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146\\temporaryfile")) returned 1 [0034.944] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e45c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.944] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104146" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104146")) returned 1 [0034.944] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms") returned 0 [0034.944] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0034.945] WriteFile (in: hFile=0xdc, lpBuffer=0x2933e0*, nNumberOfBytesToWrite=0x1f70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2933e0*, lpNumberOfBytesWritten=0x18fdd8*=0x1f70, lpOverlapped=0x0) returned 1 [0034.946] CloseHandle (hObject=0xdc) returned 1 [0034.947] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.947] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x19e45c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e45c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0034.947] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.947] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0034.947] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0034.949] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0034.949] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0034.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a) returned 0x2595c0 [0034.949] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.950] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3 [0034.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x2561e0 [0034.950] ReadFile (in: hFile=0xd8, lpBuffer=0x2561e8, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2561e8*, lpNumberOfBytesRead=0x18fe10*=0x3, lpOverlapped=0x0) returned 1 [0034.951] CloseHandle (hObject=0xd8) returned 1 [0034.951] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget")) returned 1 [0034.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.951] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.952] GetTickCount () returned 0x196e1 [0034.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x2595f8 [0034.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.952] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104161\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104161\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.952] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104161\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104161\\....\\temporaryfile")) returned 0 [0034.953] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104161\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104161\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104161\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104161\\temporaryfile")) returned 1 [0034.954] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104161\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e6bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e6bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e6bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.954] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e6bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e6bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e6bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0034.954] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e6bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e6bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e6bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.954] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104161\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e6bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e6bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e6bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.954] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e6bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e6bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e6bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.954] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e6bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e6bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e6bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.954] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.954] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104161\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104161\\temporaryfile")) returned 1 [0034.954] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e6bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e6bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e6bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.954] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.954] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104161" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104161")) returned 1 [0034.956] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget") returned 0 [0034.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.957] WriteFile (in: hFile=0xd8, lpBuffer=0x2561d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2561d0*, lpNumberOfBytesWritten=0x18fdf8*=0x8, lpOverlapped=0x0) returned 1 [0034.958] CloseHandle (hObject=0xd8) returned 1 [0034.959] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.964] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x7 [0034.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x2561e0 [0034.964] ReadFile (in: hFile=0xd8, lpBuffer=0x2561e8, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2561e8*, lpNumberOfBytesRead=0x18fe10*=0x7, lpOverlapped=0x0) returned 1 [0034.964] CloseHandle (hObject=0xd8) returned 1 [0034.965] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink")) returned 1 [0034.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.965] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0034.965] GetTickCount () returned 0x196f1 [0034.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.966] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.966] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177\\....\\temporaryfile")) returned 0 [0034.966] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177\\temporaryfile")) returned 1 [0034.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.967] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.967] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.967] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.968] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.968] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.968] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177\\temporaryfile")) returned 1 [0034.968] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.968] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.968] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177")) returned 1 [0034.968] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink") returned 0 [0034.968] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.969] WriteFile (in: hFile=0xd8, lpBuffer=0x25cd98*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25cd98*, lpNumberOfBytesWritten=0x18fdf8*=0x10, lpOverlapped=0x0) returned 1 [0034.970] CloseHandle (hObject=0xd8) returned 1 [0034.970] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.971] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x22e [0034.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x236) returned 0x259e70 [0034.971] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x22e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x22e, lpOverlapped=0x0) returned 1 [0034.972] CloseHandle (hObject=0xd8) returned 1 [0034.972] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 1 [0034.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.973] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.973] GetTickCount () returned 0x196f1 [0034.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.973] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.974] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177\\....\\temporaryfile")) returned 0 [0034.974] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177\\temporaryfile")) returned 1 [0034.975] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.975] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.975] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.975] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.975] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.975] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.975] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.975] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177\\temporaryfile")) returned 1 [0034.975] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19e91ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19e91ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19e91ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.976] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.976] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104177" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104177")) returned 1 [0034.976] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned 0 [0034.976] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.976] WriteFile (in: hFile=0xd8, lpBuffer=0x25a0b8*, nNumberOfBytesToWrite=0x238, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25a0b8*, lpNumberOfBytesWritten=0x18fdf8*=0x238, lpOverlapped=0x0) returned 1 [0034.977] CloseHandle (hObject=0xd8) returned 1 [0034.978] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Documents.mydocs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.978] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x0 [0034.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c990 [0034.979] ReadFile (in: hFile=0xd8, lpBuffer=0x25c998, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c998*, lpNumberOfBytesRead=0x18fe10*=0x0, lpOverlapped=0x0) returned 1 [0034.979] CloseHandle (hObject=0xd8) returned 1 [0034.979] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Documents.mydocs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs")) returned 1 [0034.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.979] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.979] GetTickCount () returned 0x19701 [0034.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.979] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.980] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Documents.mydocs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\....\\temporaryfile")) returned 0 [0034.980] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\temporaryfile")) returned 1 [0034.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.981] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.981] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.981] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.981] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.981] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.981] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\temporaryfile")) returned 1 [0034.981] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.982] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.982] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193")) returned 1 [0034.982] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Documents.mydocs") returned 0 [0034.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Documents.mydocs.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.982] WriteFile (in: hFile=0xd8, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fdf8*=0x0, lpOverlapped=0x0) returned 1 [0034.982] CloseHandle (hObject=0xd8) returned 1 [0034.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.983] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x4d6 [0034.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4de) returned 0x259e70 [0034.983] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4d6, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x4d6, lpOverlapped=0x0) returned 1 [0034.985] CloseHandle (hObject=0xd8) returned 1 [0034.985] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 1 [0034.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0034.985] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.985] GetTickCount () returned 0x19701 [0034.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0034.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.986] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0034.986] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\....\\temporaryfile")) returned 0 [0034.987] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\temporaryfile")) returned 1 [0034.987] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.988] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.988] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.988] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.988] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.988] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.988] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.988] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\temporaryfile")) returned 1 [0034.988] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.988] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.988] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193")) returned 1 [0034.989] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned 0 [0034.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.989] WriteFile (in: hFile=0xd8, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdf8*=0x4e0, lpOverlapped=0x0) returned 1 [0034.990] CloseHandle (hObject=0xd8) returned 1 [0034.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.991] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x4 [0034.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561e0 [0034.991] ReadFile (in: hFile=0xd8, lpBuffer=0x2561e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2561e8*, lpNumberOfBytesRead=0x18fe10*=0x4, lpOverlapped=0x0) returned 1 [0034.992] CloseHandle (hObject=0xd8) returned 1 [0034.992] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail")) returned 1 [0034.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0034.993] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0034.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0034.993] GetTickCount () returned 0x19701 [0034.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0034.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0034.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0034.993] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0034.994] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\....\\temporaryfile")) returned 0 [0034.995] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\temporaryfile")) returned 1 [0034.996] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ede180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ede180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0034.996] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ede180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ede180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.996] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0034.996] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0034.996] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.996] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.996] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0034.996] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193\\temporaryfile")) returned 1 [0034.996] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19eb8020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19eb8020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19eb8020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0034.996] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0034.996] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104193" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104193")) returned 1 [0034.997] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail") returned 0 [0034.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.997] WriteFile (in: hFile=0xd8, lpBuffer=0x2561d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2561d0*, lpNumberOfBytesWritten=0x18fdf8*=0x8, lpOverlapped=0x0) returned 1 [0034.998] CloseHandle (hObject=0xd8) returned 1 [0034.999] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0034.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x19ede180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ede180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0034.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0034.999] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0034.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0034.999] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0034.999] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561c8 [0034.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0034.999] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xae [0034.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb6) returned 0x25c780 [0034.999] ReadFile (in: hFile=0xd8, lpBuffer=0x25c788, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesRead=0x18fe10*=0xae, lpOverlapped=0x0) returned 1 [0035.000] CloseHandle (hObject=0xd8) returned 1 [0035.000] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 1 [0035.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0035.001] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.001] GetTickCount () returned 0x19710 [0035.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0035.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c840 [0035.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0035.001] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208\\...."), lpSecurityAttributes=0x256198) returned 1 [0035.002] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208\\....\\temporaryfile")) returned 0 [0035.002] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208\\temporaryfile")) returned 1 [0035.003] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ede180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ede180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ede180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0035.003] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ede180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ede180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ede180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0035.003] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ede180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ede180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ede180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.003] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ede180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ede180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ede180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.004] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ede180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ede180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ede180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.004] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ede180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ede180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ede180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.004] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.004] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208\\temporaryfile")) returned 1 [0035.004] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ede180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19ede180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ede180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.004] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0035.004] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208")) returned 1 [0035.004] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned 0 [0035.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0035.005] WriteFile (in: hFile=0xd8, lpBuffer=0x25c848*, nNumberOfBytesToWrite=0xb8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25c848*, lpNumberOfBytesWritten=0x18fdf8*=0xb8, lpOverlapped=0x0) returned 1 [0035.006] CloseHandle (hObject=0xd8) returned 1 [0035.006] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0035.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x19ede180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19ede180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0035.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0035.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0035.007] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0035.007] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0035.007] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0035.007] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256198 [0035.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.007] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1dc [0035.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e4) returned 0x25c780 [0035.007] ReadFile (in: hFile=0xdc, lpBuffer=0x25c788, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesRead=0x18fdf0*=0x1dc, lpOverlapped=0x0) returned 1 [0035.008] CloseHandle (hObject=0xdc) returned 1 [0035.008] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 1 [0035.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561f8 [0035.009] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.009] GetTickCount () returned 0x19710 [0035.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0035.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x259e70 [0035.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0035.011] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208\\...."), lpSecurityAttributes=0x2561f8) returned 1 [0035.011] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208\\....\\temporaryfile")) returned 0 [0035.011] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208\\temporaryfile")) returned 1 [0035.012] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ede180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.012] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19ede180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName="..", cAlternateFileName="")) returned 1 [0035.012] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.012] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.012] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.012] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.012] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.013] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208\\temporaryfile")) returned 1 [0035.013] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.013] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.013] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104208" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104208")) returned 1 [0035.013] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini") returned 0 [0035.013] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.014] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x1e0, lpOverlapped=0x0) returned 1 [0035.015] CloseHandle (hObject=0xdc) returned 1 [0035.016] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.016] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x58b [0035.016] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x593) returned 0x259e70 [0035.016] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x58b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x58b, lpOverlapped=0x0) returned 1 [0035.019] CloseHandle (hObject=0xdc) returned 1 [0035.019] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 1 [0035.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0035.020] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.020] GetTickCount () returned 0x19720 [0035.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0035.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a410 [0035.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0035.020] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104224\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104224\\...."), lpSecurityAttributes=0x256198) returned 1 [0035.021] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104224\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104224\\....\\temporaryfile")) returned 0 [0035.021] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104224\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104224\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104224\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104224\\temporaryfile")) returned 1 [0035.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104224\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.022] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.022] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104224\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.022] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.022] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.022] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.022] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104224\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104224\\temporaryfile")) returned 1 [0035.022] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f042e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f042e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f042e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.022] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104224" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104224")) returned 1 [0035.023] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk") returned 0 [0035.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.023] WriteFile (in: hFile=0xdc, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdd8*=0x590, lpOverlapped=0x0) returned 1 [0035.024] CloseHandle (hObject=0xdc) returned 1 [0035.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.026] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5ad [0035.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b5) returned 0x259e70 [0035.026] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5ad, lpOverlapped=0x0) returned 1 [0035.027] CloseHandle (hObject=0xdc) returned 1 [0035.027] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 1 [0035.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0035.028] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.028] GetTickCount () returned 0x1972f [0035.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0035.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a430 [0035.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0035.029] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239\\...."), lpSecurityAttributes=0x256198) returned 1 [0035.029] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239\\....\\temporaryfile")) returned 0 [0035.029] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239\\temporaryfile")) returned 1 [0035.030] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.030] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.030] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.030] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.030] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.030] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.031] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.031] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239\\temporaryfile")) returned 1 [0035.031] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.031] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.031] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239")) returned 1 [0035.031] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk") returned 0 [0035.031] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.032] WriteFile (in: hFile=0xdc, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdd8*=0x5b8, lpOverlapped=0x0) returned 1 [0035.033] CloseHandle (hObject=0xdc) returned 1 [0035.033] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0035.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0035.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0035.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.033] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0035.033] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0035.033] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1 [0035.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13) returned 0x25cd90 [0035.034] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.034] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x500 [0035.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x508) returned 0x259e70 [0035.034] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x500, lpOverlapped=0x0) returned 1 [0035.035] CloseHandle (hObject=0xe0) returned 1 [0035.035] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 1 [0035.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561f8 [0035.036] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.036] GetTickCount () returned 0x1972f [0035.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0035.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a380 [0035.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0035.037] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239\\...."), lpSecurityAttributes=0x2561f8) returned 1 [0035.038] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239\\....\\temporaryfile")) returned 0 [0035.038] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239\\temporaryfile")) returned 1 [0035.039] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.039] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.039] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.039] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.039] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.039] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.039] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.039] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239\\temporaryfile")) returned 1 [0035.039] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f2a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f2a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f2a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.040] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.040] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104239" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104239")) returned 1 [0035.040] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk") returned 0 [0035.040] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.041] WriteFile (in: hFile=0xe0, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x508, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdb8*=0x508, lpOverlapped=0x0) returned 1 [0035.041] CloseHandle (hObject=0xe0) returned 1 [0035.042] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.042] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2a6 [0035.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ae) returned 0x259e70 [0035.042] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2a6, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x2a6, lpOverlapped=0x0) returned 1 [0035.043] CloseHandle (hObject=0xe0) returned 1 [0035.043] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1 [0035.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0035.044] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.044] GetTickCount () returned 0x1973f [0035.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0035.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c780 [0035.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0035.045] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255\\...."), lpSecurityAttributes=0x256210) returned 1 [0035.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255\\....\\temporaryfile")) returned 0 [0035.045] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255\\temporaryfile")) returned 1 [0035.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.046] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.046] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.046] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.046] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.046] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.046] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255\\temporaryfile")) returned 1 [0035.046] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.046] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255")) returned 1 [0035.047] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned 0 [0035.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.047] WriteFile (in: hFile=0xe0, lpBuffer=0x25a130*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25a130*, lpNumberOfBytesWritten=0x18fdb8*=0x2b0, lpOverlapped=0x0) returned 1 [0035.048] CloseHandle (hObject=0xe0) returned 1 [0035.049] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.052] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x518 [0035.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x520) returned 0x259e70 [0035.052] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x518, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x518, lpOverlapped=0x0) returned 1 [0035.054] CloseHandle (hObject=0xe0) returned 1 [0035.054] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 1 [0035.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561f8 [0035.055] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.055] GetTickCount () returned 0x1973f [0035.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0035.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a398 [0035.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0035.055] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255\\...."), lpSecurityAttributes=0x2561f8) returned 1 [0035.056] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255\\....\\temporaryfile")) returned 0 [0035.056] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255\\temporaryfile")) returned 1 [0035.058] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.058] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.058] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.058] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.058] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.058] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.058] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.058] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255\\temporaryfile")) returned 1 [0035.058] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f505a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f505a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f505a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.058] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.059] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104255" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104255")) returned 1 [0035.059] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk") returned 0 [0035.059] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.059] WriteFile (in: hFile=0xe0, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdb8*=0x520, lpOverlapped=0x0) returned 1 [0035.060] CloseHandle (hObject=0xe0) returned 1 [0035.061] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.062] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x106 [0035.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10e) returned 0x29ea88 [0035.062] ReadFile (in: hFile=0xe0, lpBuffer=0x29ea90, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x29ea90*, lpNumberOfBytesRead=0x18fdd0*=0x106, lpOverlapped=0x0) returned 1 [0035.062] CloseHandle (hObject=0xe0) returned 1 [0035.063] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 1 [0035.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0035.063] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.063] GetTickCount () returned 0x1974f [0035.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0035.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c780 [0035.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0035.064] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104271\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104271\\...."), lpSecurityAttributes=0x256210) returned 1 [0035.064] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104271\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104271\\....\\temporaryfile")) returned 0 [0035.065] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104271\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104271\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104271\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104271\\temporaryfile")) returned 1 [0035.066] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104271\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f76700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f76700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f76700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.066] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f76700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f76700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f76700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.066] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f76700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f76700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f76700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.066] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104271\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f76700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f76700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f76700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.066] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f76700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f76700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f76700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.066] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f76700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f76700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f76700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.066] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.066] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104271\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104271\\temporaryfile")) returned 1 [0035.066] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f76700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f76700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f76700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.066] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.066] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104271" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104271")) returned 1 [0035.067] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk") returned 0 [0035.067] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.067] WriteFile (in: hFile=0xe0, lpBuffer=0x25c788*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesWritten=0x18fdb8*=0x110, lpOverlapped=0x0) returned 1 [0035.068] CloseHandle (hObject=0xe0) returned 1 [0035.069] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.070] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4cc [0035.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4d4) returned 0x259e70 [0035.070] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x4cc, lpOverlapped=0x0) returned 1 [0035.072] CloseHandle (hObject=0xe0) returned 1 [0035.072] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 1 [0035.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0035.073] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.073] GetTickCount () returned 0x1975e [0035.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0035.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a350 [0035.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0035.073] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286\\...."), lpSecurityAttributes=0x256210) returned 1 [0035.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286\\....\\temporaryfile")) returned 0 [0035.073] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286\\temporaryfile")) returned 1 [0035.074] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.075] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.075] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.075] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.075] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.075] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.075] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.075] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286\\temporaryfile")) returned 1 [0035.075] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.075] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.075] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286")) returned 1 [0035.075] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk") returned 0 [0035.076] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.076] WriteFile (in: hFile=0xe0, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fdb8*=0x4d0, lpOverlapped=0x0) returned 1 [0035.077] CloseHandle (hObject=0xe0) returned 1 [0035.077] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.077] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0035.078] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.078] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0035.078] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0035.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561f8 [0035.078] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.078] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2c0 [0035.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c8) returned 0x259e70 [0035.078] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x2c0, lpOverlapped=0x0) returned 1 [0035.079] CloseHandle (hObject=0xe4) returned 1 [0035.079] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 1 [0035.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0035.080] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.080] GetTickCount () returned 0x1975e [0035.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256240 [0035.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c808 [0035.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0035.081] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286\\...."), lpSecurityAttributes=0x256228) returned 1 [0035.086] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286\\....\\temporaryfile")) returned 0 [0035.086] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286\\temporaryfile")) returned 1 [0035.087] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.087] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.087] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.087] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.087] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.087] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.087] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.088] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286\\temporaryfile")) returned 1 [0035.088] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19f9c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19f9c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19f9c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.088] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.088] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104286" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104286")) returned 1 [0035.088] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini") returned 0 [0035.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.089] WriteFile (in: hFile=0xe4, lpBuffer=0x25a148*, nNumberOfBytesToWrite=0x2c8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25a148*, lpNumberOfBytesWritten=0x18fd98*=0x2c8, lpOverlapped=0x0) returned 1 [0035.090] CloseHandle (hObject=0xe4) returned 1 [0035.090] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.091] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x54e [0035.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x556) returned 0x259e70 [0035.091] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x54e, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x54e, lpOverlapped=0x0) returned 1 [0035.095] CloseHandle (hObject=0xe4) returned 1 [0035.095] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 1 [0035.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561f8 [0035.096] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.096] GetTickCount () returned 0x1976e [0035.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0035.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a3d0 [0035.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0035.097] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104302\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104302\\...."), lpSecurityAttributes=0x2561f8) returned 1 [0035.097] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104302\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104302\\....\\temporaryfile")) returned 0 [0035.097] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104302\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104302\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104302\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104302\\temporaryfile")) returned 1 [0035.098] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104302\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fc29c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fc29c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fc29c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.098] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fc29c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fc29c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fc29c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.098] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fc29c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fc29c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fc29c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.098] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104302\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fc29c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fc29c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fc29c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.098] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fc29c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fc29c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fc29c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.098] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fc29c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fc29c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fc29c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.099] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.099] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104302\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104302\\temporaryfile")) returned 1 [0035.099] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fc29c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fc29c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fc29c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.099] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.099] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104302" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104302")) returned 1 [0035.099] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk") returned 0 [0035.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.100] WriteFile (in: hFile=0xe4, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x558, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fd98*=0x558, lpOverlapped=0x0) returned 1 [0035.101] CloseHandle (hObject=0xe4) returned 1 [0035.102] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.103] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x4ea [0035.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f2) returned 0x259e70 [0035.103] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4ea, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x4ea, lpOverlapped=0x0) returned 1 [0035.104] CloseHandle (hObject=0xe4) returned 1 [0035.104] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 1 [0035.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0035.105] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.105] GetTickCount () returned 0x1977d [0035.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256240 [0035.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c808 [0035.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0035.106] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317\\...."), lpSecurityAttributes=0x256228) returned 1 [0035.106] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317\\....\\temporaryfile")) returned 0 [0035.106] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317\\temporaryfile")) returned 1 [0035.107] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.107] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.107] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.107] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.107] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.107] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.107] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.107] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317\\temporaryfile")) returned 1 [0035.108] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.108] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.108] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317")) returned 1 [0035.108] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk") returned 0 [0035.108] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.109] WriteFile (in: hFile=0xe4, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fd98*=0x4f0, lpOverlapped=0x0) returned 1 [0035.110] CloseHandle (hObject=0xe4) returned 1 [0035.110] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.111] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x4ee [0035.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f6) returned 0x259e70 [0035.111] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x4ee, lpOverlapped=0x0) returned 1 [0035.112] CloseHandle (hObject=0xe4) returned 1 [0035.112] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 1 [0035.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561f8 [0035.113] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.113] GetTickCount () returned 0x1977d [0035.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256240 [0035.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c808 [0035.114] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0035.114] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317\\...."), lpSecurityAttributes=0x2561f8) returned 1 [0035.114] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317\\....\\temporaryfile")) returned 0 [0035.114] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317\\temporaryfile")) returned 1 [0035.115] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.115] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.115] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.115] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.116] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.116] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.116] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.116] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317\\temporaryfile")) returned 1 [0035.116] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x19fe8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x19fe8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x19fe8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.116] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.116] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104317" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104317")) returned 1 [0035.116] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk") returned 0 [0035.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.117] WriteFile (in: hFile=0xe4, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fd98*=0x4f8, lpOverlapped=0x0) returned 1 [0035.118] CloseHandle (hObject=0xe4) returned 1 [0035.120] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.120] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x4e2 [0035.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4ea) returned 0x259e70 [0035.120] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4e2, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x4e2, lpOverlapped=0x0) returned 1 [0035.122] CloseHandle (hObject=0xe4) returned 1 [0035.122] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 1 [0035.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0035.123] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.123] GetTickCount () returned 0x1978d [0035.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0035.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c810 [0035.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0035.123] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333\\...."), lpSecurityAttributes=0x256228) returned 1 [0035.124] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333\\....\\temporaryfile")) returned 0 [0035.124] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333\\temporaryfile")) returned 1 [0035.125] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.125] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.125] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.125] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.125] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.125] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.125] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333\\temporaryfile")) returned 1 [0035.125] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.125] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333")) returned 1 [0035.126] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk") returned 0 [0035.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.126] WriteFile (in: hFile=0xe4, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x4e8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fd98*=0x4e8, lpOverlapped=0x0) returned 1 [0035.127] CloseHandle (hObject=0xe4) returned 1 [0035.128] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.128] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0035.128] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.128] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.128] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0035.128] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0035.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0035.128] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.129] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x106 [0035.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10e) returned 0x29ea88 [0035.129] ReadFile (in: hFile=0xe4, lpBuffer=0x29ea90, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29ea90*, lpNumberOfBytesRead=0x18fdb0*=0x106, lpOverlapped=0x0) returned 1 [0035.130] CloseHandle (hObject=0xe4) returned 1 [0035.130] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 1 [0035.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561f8 [0035.131] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.131] GetTickCount () returned 0x1978d [0035.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256240 [0035.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c808 [0035.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0035.132] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333\\...."), lpSecurityAttributes=0x2561f8) returned 1 [0035.132] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333\\....\\temporaryfile")) returned 0 [0035.132] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333\\temporaryfile")) returned 1 [0035.133] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.133] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.133] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.133] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.134] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.134] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.134] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.134] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333\\temporaryfile")) returned 1 [0035.134] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a00ec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a00ec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a00ec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.134] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.134] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104333" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104333")) returned 1 [0035.134] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk") returned 0 [0035.134] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.135] WriteFile (in: hFile=0xe4, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fd98*=0x110, lpOverlapped=0x0) returned 1 [0035.136] CloseHandle (hObject=0xe4) returned 1 [0035.137] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.137] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x106 [0035.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10e) returned 0x29ea88 [0035.137] ReadFile (in: hFile=0xe4, lpBuffer=0x29ea90, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x29ea90*, lpNumberOfBytesRead=0x18fdb0*=0x106, lpOverlapped=0x0) returned 1 [0035.138] CloseHandle (hObject=0xe4) returned 1 [0035.138] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 1 [0035.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0035.139] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.139] GetTickCount () returned 0x1979d [0035.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0035.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c808 [0035.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0035.139] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349\\...."), lpSecurityAttributes=0x256210) returned 1 [0035.140] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349\\....\\temporaryfile")) returned 0 [0035.140] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349\\temporaryfile")) returned 1 [0035.141] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.141] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.141] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.141] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.141] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.141] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.141] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.141] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349\\temporaryfile")) returned 1 [0035.141] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.142] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.142] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349")) returned 1 [0035.142] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk") returned 0 [0035.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.143] WriteFile (in: hFile=0xe4, lpBuffer=0x25c810*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25c810*, lpNumberOfBytesWritten=0x18fd98*=0x110, lpOverlapped=0x0) returned 1 [0035.143] CloseHandle (hObject=0xe4) returned 1 [0035.144] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.144] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2e2 [0035.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ea) returned 0x259e70 [0035.144] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x2e2, lpOverlapped=0x0) returned 1 [0035.145] CloseHandle (hObject=0xe4) returned 1 [0035.145] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 1 [0035.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561f8 [0035.146] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.146] GetTickCount () returned 0x1979d [0035.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256240 [0035.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c808 [0035.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0035.147] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349\\...."), lpSecurityAttributes=0x2561f8) returned 1 [0035.147] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349\\....\\temporaryfile")) returned 0 [0035.147] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349\\temporaryfile")) returned 1 [0035.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.148] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.148] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.149] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.149] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.149] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.149] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349\\temporaryfile")) returned 1 [0035.149] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a034de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a034de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a034de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.149] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.149] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104349" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104349")) returned 1 [0035.149] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini") returned 0 [0035.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.150] WriteFile (in: hFile=0xe4, lpBuffer=0x25a170*, nNumberOfBytesToWrite=0x2e8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25a170*, lpNumberOfBytesWritten=0x18fd98*=0x2e8, lpOverlapped=0x0) returned 1 [0035.151] CloseHandle (hObject=0xe4) returned 1 [0035.152] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.153] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x5df [0035.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5e7) returned 0x259e70 [0035.153] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5df, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x5df, lpOverlapped=0x0) returned 1 [0035.165] CloseHandle (hObject=0xe4) returned 1 [0035.165] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 1 [0035.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0035.167] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0035.167] GetTickCount () returned 0x197bc [0035.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0035.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a460 [0035.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0035.169] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104380\\...."), lpSecurityAttributes=0x256210) returned 1 [0035.169] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104380\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104380\\....\\temporaryfile")) returned 0 [0035.169] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104380\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104380\\temporaryfile")) returned 1 [0035.178] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104380\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0810a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0810a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0810a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.178] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0810a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0810a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0810a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.178] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0810a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0810a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0810a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.178] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104380\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0810a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0810a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0810a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.178] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0810a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0810a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0810a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.178] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0810a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0810a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0810a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.178] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.178] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104380\\temporaryfile")) returned 1 [0035.179] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0810a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0810a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0810a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.179] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.179] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104380" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104380")) returned 1 [0035.179] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk") returned 0 [0035.179] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.180] WriteFile (in: hFile=0xe4, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x5e8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fd98*=0x5e8, lpOverlapped=0x0) returned 1 [0035.182] CloseHandle (hObject=0xe4) returned 1 [0035.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.184] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x51a [0035.184] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x522) returned 0x259e70 [0035.184] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x51a, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x51a, lpOverlapped=0x0) returned 1 [0035.185] CloseHandle (hObject=0xe4) returned 1 [0035.185] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 1 [0035.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0035.186] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.186] GetTickCount () returned 0x197cb [0035.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0035.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25a3a0 [0035.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0035.186] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395\\...."), lpSecurityAttributes=0x256210) returned 1 [0035.187] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395\\....\\temporaryfile")) returned 0 [0035.187] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395\\temporaryfile")) returned 1 [0035.188] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.188] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.188] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.188] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.188] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.188] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.188] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.188] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395\\temporaryfile")) returned 1 [0035.189] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.189] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.189] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395")) returned 1 [0035.189] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk") returned 0 [0035.189] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0035.190] WriteFile (in: hFile=0xe4, lpBuffer=0x28ea00*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28ea00*, lpNumberOfBytesWritten=0x18fd98*=0x520, lpOverlapped=0x0) returned 1 [0035.191] CloseHandle (hObject=0xe4) returned 1 [0035.191] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.192] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0035.192] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.192] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.192] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.192] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0035.192] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256198 [0035.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.192] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xae [0035.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb6) returned 0x25c780 [0035.192] ReadFile (in: hFile=0xe0, lpBuffer=0x25c788, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesRead=0x18fdd0*=0xae, lpOverlapped=0x0) returned 1 [0035.193] CloseHandle (hObject=0xe0) returned 1 [0035.193] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 1 [0035.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0035.194] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.194] GetTickCount () returned 0x197cb [0035.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0035.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c840 [0035.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0035.195] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395\\...."), lpSecurityAttributes=0x256228) returned 1 [0035.195] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395\\....\\temporaryfile")) returned 0 [0035.195] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395\\temporaryfile")) returned 1 [0035.196] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.196] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName="..", cAlternateFileName="")) returned 1 [0035.197] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.197] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.197] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.197] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.197] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.197] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395\\temporaryfile")) returned 1 [0035.197] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0a7200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0a7200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0a7200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.197] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.197] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104395" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104395")) returned 1 [0035.197] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini") returned 0 [0035.198] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.198] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0xb8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0xb8, lpOverlapped=0x0) returned 1 [0035.199] CloseHandle (hObject=0xe0) returned 1 [0035.200] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0035.200] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.200] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0035.200] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0035.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0035.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.200] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e [0035.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x146) returned 0x25c780 [0035.201] ReadFile (in: hFile=0xe0, lpBuffer=0x25c788, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesRead=0x18fdd0*=0x13e, lpOverlapped=0x0) returned 1 [0035.201] CloseHandle (hObject=0xe0) returned 1 [0035.201] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1 [0035.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0035.202] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.202] GetTickCount () returned 0x197db [0035.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0035.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c8d0 [0035.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0035.203] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411\\...."), lpSecurityAttributes=0x256210) returned 1 [0035.203] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411\\....\\temporaryfile")) returned 0 [0035.203] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411\\temporaryfile")) returned 1 [0035.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.204] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName="..", cAlternateFileName="")) returned 1 [0035.204] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.204] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.204] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.205] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411\\temporaryfile")) returned 1 [0035.205] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1d, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.205] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411")) returned 1 [0035.205] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini") returned 0 [0035.205] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.206] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x148, lpOverlapped=0x0) returned 1 [0035.207] CloseHandle (hObject=0xe0) returned 1 [0035.207] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.208] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x106 [0035.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10e) returned 0x29ea88 [0035.208] ReadFile (in: hFile=0xe0, lpBuffer=0x29ea90, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x29ea90*, lpNumberOfBytesRead=0x18fdd0*=0x106, lpOverlapped=0x0) returned 1 [0035.209] CloseHandle (hObject=0xe0) returned 1 [0035.209] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 1 [0035.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0035.210] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.210] GetTickCount () returned 0x197db [0035.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0035.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c780 [0035.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0035.211] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411\\...."), lpSecurityAttributes=0x256228) returned 1 [0035.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411\\....\\temporaryfile")) returned 0 [0035.211] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411\\temporaryfile")) returned 1 [0035.215] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0f34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0f34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.215] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0f34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0f34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.215] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.215] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.215] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.215] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.215] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.215] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411\\temporaryfile")) returned 1 [0035.215] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0cd360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0cd360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0cd360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.216] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.216] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104411" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104411")) returned 1 [0035.216] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk") returned 0 [0035.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.217] WriteFile (in: hFile=0xe0, lpBuffer=0x25c788*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesWritten=0x18fdb8*=0x110, lpOverlapped=0x0) returned 1 [0035.217] CloseHandle (hObject=0xe0) returned 1 [0035.218] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.218] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a0f34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0f34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0035.218] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.219] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.219] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0035.219] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256198 [0035.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.219] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xae [0035.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb6) returned 0x25c780 [0035.219] ReadFile (in: hFile=0xe0, lpBuffer=0x25c788, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesRead=0x18fdd0*=0xae, lpOverlapped=0x0) returned 1 [0035.220] CloseHandle (hObject=0xe0) returned 1 [0035.220] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 1 [0035.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0035.221] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.221] GetTickCount () returned 0x197eb [0035.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0035.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c840 [0035.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0035.221] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104427\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104427\\...."), lpSecurityAttributes=0x256210) returned 1 [0035.222] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104427\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104427\\....\\temporaryfile")) returned 0 [0035.222] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104427\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104427\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104427\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104427\\temporaryfile")) returned 1 [0035.223] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104427\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0f34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0f34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0f34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.223] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0f34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0f34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0f34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.223] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0f34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0f34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0f34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.223] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104427\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0f34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0f34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0f34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.223] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0f34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0f34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0f34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.223] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0f34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0f34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0f34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.223] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.223] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104427\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104427\\temporaryfile")) returned 1 [0035.224] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a0f34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a0f34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0f34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.224] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.224] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104427" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104427")) returned 1 [0035.224] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini") returned 0 [0035.224] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0035.225] WriteFile (in: hFile=0xe0, lpBuffer=0x25c848*, nNumberOfBytesToWrite=0xb8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25c848*, lpNumberOfBytesWritten=0x18fdb8*=0xb8, lpOverlapped=0x0) returned 1 [0035.226] CloseHandle (hObject=0xe0) returned 1 [0035.226] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.226] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a0f34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a0f34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0035.227] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.227] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0035.227] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0035.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0035.227] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0035.227] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 0 [0035.228] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0035.228] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0035.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0035.228] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0035.228] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0035.228] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0035.228] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x28cff640, dwReserved1=0x1d2dd9c, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 1 [0035.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18) returned 0x25cd90 [0035.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0035.229] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9cfab [0035.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9cfb3) returned 0x1d70020 [0035.229] ReadFile (in: hFile=0xd8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x9cfab, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe10*=0x9cfab, lpOverlapped=0x0) returned 1 [0035.243] CloseHandle (hObject=0xd8) returned 1 [0035.243] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 1 [0035.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0035.249] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.249] GetTickCount () returned 0x1980a [0035.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0035.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x262998 [0035.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0035.250] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104458\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104458\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0035.250] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104458\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104458\\....\\temporaryfile")) returned 0 [0035.250] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104458\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104458\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104458\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104458\\temporaryfile")) returned 1 [0035.251] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104458\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a13f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a13f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a13f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0035.251] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a13f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a13f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a13f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0035.252] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a13f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a13f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a13f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.252] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104458\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a13f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a13f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a13f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.252] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a13f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a13f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a13f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.252] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a13f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a13f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a13f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.252] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.252] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104458\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104458\\temporaryfile")) returned 1 [0035.252] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a13f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a13f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a13f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.252] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0035.252] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104458" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104458")) returned 1 [0035.252] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg") returned 0 [0035.275] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0035.278] WriteFile (in: hFile=0xd8, lpBuffer=0x23f0028*, nNumberOfBytesToWrite=0x9cfb0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x23f0028*, lpNumberOfBytesWritten=0x18fdf8*=0x9cfb0, lpOverlapped=0x0) returned 1 [0035.288] CloseHandle (hObject=0xd8) returned 1 [0035.305] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0035.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1a18ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a18ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0035.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0035.306] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0035.306] FindClose (in: hFindFile=0x259580 | out: hFindFile=0x259580) returned 1 [0035.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Word\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f71aa70, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0035.308] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f71aa70, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0035.308] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f71aa70, dwReserved1=0x1d2dda4, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0035.308] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f71aa70, dwReserved1=0x1d2dda4, cFileName="STARTUP", cAlternateFileName="")) returned 0 [0035.308] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0035.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Word\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f71aa70, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289a10 [0035.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0035.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Word\\STARTUP\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27c7d150, dwReserved1=0x1d3aaba, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0035.309] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27c7d150, dwReserved1=0x1d3aaba, cFileName="..", cAlternateFileName="")) returned 1 [0035.309] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27c7d150, dwReserved1=0x1d3aaba, cFileName="..", cAlternateFileName="")) returned 0 [0035.309] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0035.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Microsoft\\Word\\STARTUP\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27c7d150, dwReserved1=0x1d3aaba, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0035.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0035.309] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0035.309] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0035.309] FindClose (in: hFindFile=0x25c530 | out: hFindFile=0x25c530) returned 1 [0035.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0035.310] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0035.310] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0035.310] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="Firefox", cAlternateFileName="")) returned 1 [0035.310] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="Firefox", cAlternateFileName="")) returned 0 [0035.310] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0035.310] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0035.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0035.310] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Extensions\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb458e750, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.315] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb458e750, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0035.315] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb458e750, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 0 [0035.315] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Extensions\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb458e750, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0035.315] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.316] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0035.317] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1 [0035.317] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="Profiles", cAlternateFileName="")) returned 1 [0035.317] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="profiles.ini", cAlternateFileName="")) returned 1 [0035.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561b0 [0035.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0035.317] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x6f [0035.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x77) returned 0x24f858 [0035.317] ReadFile (in: hFile=0xd4, lpBuffer=0x24f860, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x24f860*, lpNumberOfBytesRead=0x18fe30*=0x6f, lpOverlapped=0x0) returned 1 [0035.318] CloseHandle (hObject=0xd4) returned 1 [0035.318] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 1 [0035.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0035.319] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.319] GetTickCount () returned 0x19848 [0035.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0035.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c530 [0035.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0035.319] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104520\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104520\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0035.320] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104520\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104520\\....\\temporaryfile")) returned 0 [0035.320] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104520\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104520\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104520\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104520\\temporaryfile")) returned 1 [0035.321] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104520\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1d7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1d7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1d7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.321] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1d7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1d7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1d7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0035.321] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1d7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1d7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1d7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.321] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104520\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1d7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1d7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1d7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.322] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1d7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1d7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1d7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.322] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1d7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1d7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1d7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.322] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.322] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104520\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104520\\temporaryfile")) returned 1 [0035.322] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1d7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1d7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1d7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.323] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.323] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104520" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104520")) returned 1 [0035.323] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\profiles.ini") returned 0 [0035.323] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\profiles.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0035.324] WriteFile (in: hFile=0xd4, lpBuffer=0x25c788*, nNumberOfBytesToWrite=0x78, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesWritten=0x18fe18*=0x78, lpOverlapped=0x0) returned 1 [0035.324] CloseHandle (hObject=0xd4) returned 1 [0035.325] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0035.325] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x1a1fde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1fde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0035.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0035.325] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.329] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0035.329] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 1 [0035.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x255c48 [0035.330] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0035.331] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa [0035.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cd90 [0035.331] ReadFile (in: hFile=0xd8, lpBuffer=0x25cd98, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25cd98*, lpNumberOfBytesRead=0x18fe10*=0xa, lpOverlapped=0x0) returned 1 [0035.332] CloseHandle (hObject=0xd8) returned 1 [0035.332] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332")) returned 1 [0035.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0035.333] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.333] GetTickCount () returned 0x19858 [0035.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0035.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c530 [0035.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0035.334] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104536\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0035.334] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104536\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104536\\....\\temporaryfile")) returned 0 [0035.335] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104536\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104536\\temporaryfile")) returned 1 [0035.336] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104536\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1fde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1fde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1fde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.336] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1fde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1fde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1fde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="..", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1fde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1fde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1fde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.336] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104536\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1fde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1fde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1fde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.336] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1fde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1fde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1fde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1fde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1fde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1fde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.336] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104536\\temporaryfile")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a1fde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a1fde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a1fde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.336] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0035.337] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104536" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104536")) returned 1 [0035.337] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332") returned 0 [0035.337] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0035.338] WriteFile (in: hFile=0xd8, lpBuffer=0x25cdd8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25cdd8*, lpNumberOfBytesWritten=0x18fdf8*=0x10, lpOverlapped=0x0) returned 1 [0035.339] CloseHandle (hObject=0xd8) returned 1 [0035.339] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x1a223fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a223fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0035.340] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.344] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0035.344] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0035.344] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0035.344] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0035.344] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0035.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0035.344] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0035.350] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0035.355] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76a6d10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb76a6d10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb76a6d10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xb264df80, dwReserved1=0x1d2dda4, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 1 [0035.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561b0 [0035.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.356] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18 [0035.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20) returned 0x255c48 [0035.356] ReadFile (in: hFile=0xdc, lpBuffer=0x255c50, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x255c50*, lpNumberOfBytesRead=0x18fdf0*=0x18, lpOverlapped=0x0) returned 1 [0035.357] CloseHandle (hObject=0xdc) returned 1 [0035.357] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json")) returned 1 [0035.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0035.358] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.358] GetTickCount () returned 0x19877 [0035.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0035.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c530 [0035.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.359] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104567\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104567\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0035.359] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104567\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104567\\....\\temporaryfile")) returned 0 [0035.359] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104567\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104567\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104567\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104567\\temporaryfile")) returned 1 [0035.360] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104567\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a24a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a24a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a24a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.360] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a24a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a24a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a24a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName="..", cAlternateFileName="")) returned 1 [0035.360] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a24a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a24a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a24a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.360] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104567\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a24a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a24a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a24a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.360] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a24a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a24a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a24a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.361] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a24a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a24a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a24a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.361] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.361] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104567\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104567\\temporaryfile")) returned 1 [0035.361] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a24a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a24a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a24a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x19, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.361] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.361] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104567" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104567")) returned 1 [0035.361] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json") returned 0 [0035.361] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\addons.json.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\addons.json.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.362] WriteFile (in: hFile=0xdc, lpBuffer=0x2596c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2596c0*, lpNumberOfBytesWritten=0x18fdd8*=0x20, lpOverlapped=0x0) returned 1 [0035.363] CloseHandle (hObject=0xdc) returned 1 [0035.364] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.368] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10000 [0035.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10008) returned 0x2a0a70 [0035.369] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x10000, lpOverlapped=0x0) returned 1 [0035.371] CloseHandle (hObject=0xdc) returned 1 [0035.371] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db")) returned 1 [0035.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0035.373] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.373] GetTickCount () returned 0x19887 [0035.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0035.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x25c530 [0035.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.373] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0035.373] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583\\....\\temporaryfile")) returned 0 [0035.374] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583\\temporaryfile")) returned 1 [0035.375] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a270280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a270280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a270280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.375] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a270280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a270280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a270280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.375] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a270280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a270280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a270280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.375] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a270280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a270280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a270280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.375] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a270280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a270280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a270280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.375] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a270280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a270280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a270280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.375] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.375] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583\\temporaryfile")) returned 1 [0035.375] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a270280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a270280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a270280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.375] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.375] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583")) returned 1 [0035.376] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db") returned 0 [0035.377] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cert8.db.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cert8.db.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.378] WriteFile (in: hFile=0xdc, lpBuffer=0x2b0a88*, nNumberOfBytesToWrite=0x10008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b0a88*, lpNumberOfBytesWritten=0x18fdd8*=0x10008, lpOverlapped=0x0) returned 1 [0035.379] CloseHandle (hObject=0xdc) returned 1 [0035.381] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.381] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xce [0035.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd6) returned 0x25c780 [0035.381] ReadFile (in: hFile=0xdc, lpBuffer=0x25c788, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesRead=0x18fdf0*=0xce, lpOverlapped=0x0) returned 1 [0035.382] CloseHandle (hObject=0xdc) returned 1 [0035.382] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini")) returned 1 [0035.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0035.383] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.383] GetTickCount () returned 0x19887 [0035.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0035.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.392] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0035.393] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583\\....\\temporaryfile")) returned 0 [0035.393] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583\\temporaryfile")) returned 1 [0035.394] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a270280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2963e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2963e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.394] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a270280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2963e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2963e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.394] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2963e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2963e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2963e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.394] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2963e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2963e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2963e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.394] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2963e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2963e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2963e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.394] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2963e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2963e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2963e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.394] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.395] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583\\temporaryfile")) returned 1 [0035.395] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2963e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2963e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2963e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.395] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.395] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104583" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104583")) returned 1 [0035.395] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini") returned 0 [0035.395] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.396] WriteFile (in: hFile=0xdc, lpBuffer=0x25c868*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25c868*, lpNumberOfBytesWritten=0x18fdd8*=0xd8, lpOverlapped=0x0) returned 1 [0035.397] CloseHandle (hObject=0xdc) returned 1 [0035.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.400] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x38000 [0035.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x38008) returned 0x2a0a70 [0035.400] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x38000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x38000, lpOverlapped=0x0) returned 1 [0035.403] CloseHandle (hObject=0xdc) returned 1 [0035.403] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite")) returned 1 [0035.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0035.405] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.406] GetTickCount () returned 0x198a6 [0035.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0035.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.406] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104614\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104614\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0035.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104614\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104614\\....\\temporaryfile")) returned 0 [0035.406] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104614\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104614\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104614\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104614\\temporaryfile")) returned 1 [0035.408] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104614\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2bc540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2bc540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2bc540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.408] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2bc540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2bc540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2bc540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.408] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2bc540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2bc540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2bc540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.408] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104614\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2bc540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2bc540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2bc540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.408] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2bc540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2bc540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2bc540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.408] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2bc540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2bc540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2bc540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.408] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.408] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104614\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104614\\temporaryfile")) returned 1 [0035.408] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a2bc540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a2bc540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a2bc540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.408] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.408] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104614" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104614")) returned 1 [0035.409] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite") returned 0 [0035.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\content-prefs.sqlite.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\content-prefs.sqlite.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.415] WriteFile (in: hFile=0xdc, lpBuffer=0x2d8a88*, nNumberOfBytesToWrite=0x38008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d8a88*, lpNumberOfBytesWritten=0x18fdd8*=0x38008, lpOverlapped=0x0) returned 1 [0035.418] CloseHandle (hObject=0xdc) returned 1 [0035.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.422] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x80000 [0035.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80008) returned 0x1d70020 [0035.422] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0x80000, lpOverlapped=0x0) returned 1 [0035.437] CloseHandle (hObject=0xdc) returned 1 [0035.437] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite")) returned 1 [0035.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0035.441] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.442] GetTickCount () returned 0x198c5 [0035.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0035.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.442] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104645\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104645\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0035.442] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104645\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104645\\....\\temporaryfile")) returned 0 [0035.442] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104645\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104645\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104645\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104645\\temporaryfile")) returned 1 [0035.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104645\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a308800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a308800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a308800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a308800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a308800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a308800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a308800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a308800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a308800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104645\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a308800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a308800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a308800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a308800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a308800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a308800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a308800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a308800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a308800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.444] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.444] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104645\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104645\\temporaryfile")) returned 1 [0035.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a308800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a308800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a308800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.444] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.444] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104645" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104645")) returned 1 [0035.445] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite") returned 0 [0035.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.464] WriteFile (in: hFile=0xdc, lpBuffer=0x23e0028*, nNumberOfBytesToWrite=0x80008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23e0028*, lpNumberOfBytesWritten=0x18fdd8*=0x80008, lpOverlapped=0x0) returned 1 [0035.473] CloseHandle (hObject=0xdc) returned 1 [0035.482] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.484] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18000 [0035.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18008) returned 0x2a0a70 [0035.484] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x18000, lpOverlapped=0x0) returned 1 [0035.486] CloseHandle (hObject=0xdc) returned 1 [0035.486] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite")) returned 1 [0035.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0035.487] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.487] GetTickCount () returned 0x198f4 [0035.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0035.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.488] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104692\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104692\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0035.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104692\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104692\\....\\temporaryfile")) returned 0 [0035.488] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104692\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104692\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104692\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104692\\temporaryfile")) returned 1 [0035.489] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104692\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a37ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a37ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a37ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.490] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a37ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a37ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a37ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.490] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a37ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a37ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a37ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.490] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104692\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a37ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a37ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a37ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.490] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a37ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a37ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a37ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.490] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a37ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a37ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a37ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.490] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.490] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104692\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104692\\temporaryfile")) returned 1 [0035.490] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a37ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a37ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a37ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.490] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.490] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104692" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104692")) returned 1 [0035.490] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite") returned 0 [0035.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\downloads.sqlite.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\downloads.sqlite.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.493] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8a88*, nNumberOfBytesToWrite=0x18008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8a88*, lpNumberOfBytesWritten=0x18fdd8*=0x18008, lpOverlapped=0x0) returned 1 [0035.495] CloseHandle (hObject=0xdc) returned 1 [0035.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.499] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8d [0035.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x95) returned 0x259580 [0035.499] ReadFile (in: hFile=0xdc, lpBuffer=0x259588, nNumberOfBytesToRead=0x8d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259588*, lpNumberOfBytesRead=0x18fdf0*=0x8d, lpOverlapped=0x0) returned 1 [0035.500] CloseHandle (hObject=0xdc) returned 1 [0035.500] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini")) returned 1 [0035.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0035.501] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.501] GetTickCount () returned 0x19903 [0035.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0035.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.502] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104707\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104707\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0035.502] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104707\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104707\\....\\temporaryfile")) returned 0 [0035.502] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104707\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104707\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104707\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104707\\temporaryfile")) returned 1 [0035.504] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104707\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3a0d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3a0d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3a0d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.504] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3a0d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3a0d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3a0d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.504] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3a0d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3a0d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3a0d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.504] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104707\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3a0d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3a0d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3a0d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.504] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3a0d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3a0d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3a0d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.504] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3a0d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3a0d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3a0d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.504] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.504] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104707\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104707\\temporaryfile")) returned 1 [0035.504] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3a0d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3a0d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3a0d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.504] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.504] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104707" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104707")) returned 1 [0035.505] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini") returned 0 [0035.505] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.505] WriteFile (in: hFile=0xdc, lpBuffer=0x25c788*, nNumberOfBytesToWrite=0x98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesWritten=0x18fdd8*=0x98, lpOverlapped=0x0) returned 1 [0035.506] CloseHandle (hObject=0xdc) returned 1 [0035.507] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.507] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x70000 [0035.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x70008) returned 0x2a0a70 [0035.507] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x70000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x70000, lpOverlapped=0x0) returned 1 [0035.511] CloseHandle (hObject=0xdc) returned 1 [0035.511] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite")) returned 1 [0035.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0035.515] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.515] GetTickCount () returned 0x19913 [0035.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0035.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.516] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104723\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104723\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0035.516] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104723\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104723\\....\\temporaryfile")) returned 0 [0035.516] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104723\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104723\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104723\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104723\\temporaryfile")) returned 1 [0035.517] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104723\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3c6ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3c6ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3c6ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.517] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3c6ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3c6ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3c6ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.517] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3c6ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3c6ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3c6ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.517] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104723\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3c6ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3c6ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3c6ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.518] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3c6ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3c6ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3c6ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.518] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3c6ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3c6ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3c6ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.518] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.518] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104723\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104723\\temporaryfile")) returned 1 [0035.518] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a3c6ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a3c6ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a3c6ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.518] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.518] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104723" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104723")) returned 1 [0035.518] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite") returned 0 [0035.535] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.sqlite.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.sqlite.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.535] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x70008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x70008, lpOverlapped=0x0) returned 1 [0035.543] CloseHandle (hObject=0xdc) returned 1 [0035.548] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.548] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4000 [0035.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4008) returned 0x293460 [0035.548] ReadFile (in: hFile=0xdc, lpBuffer=0x293468, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x293468*, lpNumberOfBytesRead=0x18fdf0*=0x4000, lpOverlapped=0x0) returned 1 [0035.550] CloseHandle (hObject=0xdc) returned 1 [0035.550] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db")) returned 1 [0035.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0035.551] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.551] GetTickCount () returned 0x19932 [0035.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561b0 [0035.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.551] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104754\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104754\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0035.552] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104754\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104754\\....\\temporaryfile")) returned 0 [0035.552] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104754\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104754\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104754\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104754\\temporaryfile")) returned 1 [0035.553] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104754\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4131a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4131a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4131a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4131a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4131a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4131a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4131a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4131a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4131a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.553] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104754\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4131a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4131a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4131a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.553] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4131a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4131a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4131a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.553] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4131a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4131a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4131a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.553] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.553] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104754\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104754\\temporaryfile")) returned 1 [0035.554] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4131a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4131a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4131a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.554] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.554] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104754" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104754")) returned 1 [0035.554] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db") returned 0 [0035.555] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.555] WriteFile (in: hFile=0xdc, lpBuffer=0x297478*, nNumberOfBytesToWrite=0x4008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x297478*, lpNumberOfBytesWritten=0x18fdd8*=0x4008, lpOverlapped=0x0) returned 1 [0035.557] CloseHandle (hObject=0xdc) returned 1 [0035.562] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.564] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x501 [0035.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x509) returned 0x259e70 [0035.564] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x501, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x501, lpOverlapped=0x0) returned 1 [0035.565] CloseHandle (hObject=0xdc) returned 1 [0035.566] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf")) returned 1 [0035.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0035.566] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.566] GetTickCount () returned 0x19942 [0035.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0035.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.567] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104770\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0035.567] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104770\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104770\\....\\temporaryfile")) returned 0 [0035.567] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104770\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104770\\temporaryfile")) returned 1 [0035.569] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104770\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a439300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a439300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a439300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.569] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a439300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a439300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a439300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.569] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a439300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a439300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a439300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.569] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104770\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a439300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a439300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a439300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.569] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a439300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a439300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a439300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.569] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a439300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a439300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a439300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.569] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.569] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104770\\temporaryfile")) returned 1 [0035.569] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a439300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a439300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a439300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.570] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.570] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104770" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104770")) returned 1 [0035.570] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf") returned 0 [0035.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\localstore.rdf.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\localstore.rdf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.571] WriteFile (in: hFile=0xdc, lpBuffer=0x25d580*, nNumberOfBytesToWrite=0x508, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesWritten=0x18fdd8*=0x508, lpOverlapped=0x0) returned 1 [0035.572] CloseHandle (hObject=0xdc) returned 1 [0035.573] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.574] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x39 [0035.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x41) returned 0x25a590 [0035.574] ReadFile (in: hFile=0xdc, lpBuffer=0x25a598, nNumberOfBytesToRead=0x39, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25a598*, lpNumberOfBytesRead=0x18fdf0*=0x39, lpOverlapped=0x0) returned 1 [0035.574] CloseHandle (hObject=0xdc) returned 1 [0035.575] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log")) returned 1 [0035.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0035.575] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.575] GetTickCount () returned 0x19951 [0035.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0035.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.576] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104785\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104785\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0035.576] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104785\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104785\\....\\temporaryfile")) returned 0 [0035.576] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104785\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104785\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104785\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104785\\temporaryfile")) returned 1 [0035.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104785\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a45f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a45f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a45f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.578] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a45f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a45f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a45f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.578] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a45f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a45f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a45f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104785\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a45f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a45f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a45f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.578] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a45f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a45f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a45f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.578] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a45f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a45f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a45f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.578] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104785\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104785\\temporaryfile")) returned 1 [0035.578] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a45f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a45f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a45f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.578] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104785" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104785")) returned 1 [0035.579] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log") returned 0 [0035.579] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\marionette.log.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\marionette.log.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.580] WriteFile (in: hFile=0xdc, lpBuffer=0x25a5e8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a5e8*, lpNumberOfBytesWritten=0x18fdd8*=0x40, lpOverlapped=0x0) returned 1 [0035.580] CloseHandle (hObject=0xdc) returned 1 [0035.581] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.582] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xef3 [0035.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xefb) returned 0x25d578 [0035.582] ReadFile (in: hFile=0xdc, lpBuffer=0x25d580, nNumberOfBytesToRead=0xef3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fdf0*=0xef3, lpOverlapped=0x0) returned 1 [0035.586] CloseHandle (hObject=0xdc) returned 1 [0035.586] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf")) returned 1 [0035.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0035.587] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.587] GetTickCount () returned 0x19961 [0035.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0035.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.588] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0035.588] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801\\....\\temporaryfile")) returned 0 [0035.588] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801\\temporaryfile")) returned 1 [0035.590] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.590] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.590] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.590] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.590] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.590] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.590] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.590] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801\\temporaryfile")) returned 1 [0035.590] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.590] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.590] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801")) returned 1 [0035.591] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf") returned 0 [0035.591] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\mimeTypes.rdf.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\mimetypes.rdf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.591] WriteFile (in: hFile=0xdc, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdd8*=0xef8, lpOverlapped=0x0) returned 1 [0035.594] CloseHandle (hObject=0xdc) returned 1 [0035.595] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.596] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x0 [0035.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9d0 [0035.596] ReadFile (in: hFile=0xdc, lpBuffer=0x25c9d8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25c9d8*, lpNumberOfBytesRead=0x18fdf0*=0x0, lpOverlapped=0x0) returned 1 [0035.596] CloseHandle (hObject=0xdc) returned 1 [0035.596] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock")) returned 1 [0035.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0035.596] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.596] GetTickCount () returned 0x19961 [0035.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0035.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.597] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0035.600] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801\\....\\temporaryfile")) returned 0 [0035.600] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801\\temporaryfile")) returned 1 [0035.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.601] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.601] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.601] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.601] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.601] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801\\temporaryfile")) returned 1 [0035.602] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4855c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4855c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4855c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.602] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.602] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104801" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104801")) returned 1 [0035.602] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock") returned 0 [0035.602] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\parent.lock.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\parent.lock.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.603] WriteFile (in: hFile=0xdc, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fdd8*=0x0, lpOverlapped=0x0) returned 1 [0035.603] CloseHandle (hObject=0xdc) returned 1 [0035.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.603] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10000 [0035.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10008) returned 0x2350048 [0035.605] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x10000, lpOverlapped=0x0) returned 1 [0035.607] CloseHandle (hObject=0xdc) returned 1 [0035.608] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite")) returned 1 [0035.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0035.609] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0035.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0035.609] GetTickCount () returned 0x19971 [0035.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0035.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0035.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0035.609] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104817\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0035.610] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104817\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104817\\....\\temporaryfile")) returned 0 [0035.610] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104817\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104817\\temporaryfile")) returned 1 [0035.611] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104817\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4ab720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4ab720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4ab720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0035.611] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4ab720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4ab720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4ab720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.611] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4ab720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4ab720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4ab720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0035.611] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104817\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4ab720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4ab720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4ab720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0035.611] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4ab720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4ab720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4ab720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.612] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4ab720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4ab720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4ab720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.612] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0035.612] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104817\\temporaryfile")) returned 1 [0035.612] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a4ab720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a4ab720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a4ab720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0035.612] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0035.612] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18104817" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18104817")) returned 1 [0035.612] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite") returned 0 [0035.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\permissions.sqlite.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\permissions.sqlite.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.615] WriteFile (in: hFile=0xdc, lpBuffer=0x2360060*, nNumberOfBytesToWrite=0x10008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2360060*, lpNumberOfBytesWritten=0x18fdd8*=0x10008, lpOverlapped=0x0) returned 1 [0035.617] CloseHandle (hObject=0xdc) returned 1 [0035.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0035.619] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa00000 [0035.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa00008) returned 0x2450020 [0035.620] ReadFile (in: hFile=0xdc, lpBuffer=0x2450028, nNumberOfBytesToRead=0xa00000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450028*, lpNumberOfBytesRead=0x18fdf0*=0xa00000, lpOverlapped=0x0) returned 1 [0036.015] CloseHandle (hObject=0xdc) returned 1 [0036.015] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite")) returned 1 [0036.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0036.026] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0036.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0036.026] GetTickCount () returned 0x19b16 [0036.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0036.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0036.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0036.026] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18105238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18105238\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0036.027] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18105238\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18105238\\....\\temporaryfile")) returned 0 [0036.027] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18105238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18105238\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18105238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18105238\\temporaryfile")) returned 1 [0036.028] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18105238\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a8afc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a8afc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a8afc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0036.028] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a8afc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a8afc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a8afc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.028] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a8afc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a8afc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a8afc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0036.029] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18105238\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a8afc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a8afc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a8afc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0036.029] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a8afc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a8afc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a8afc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.029] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a8afc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a8afc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a8afc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.029] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0036.029] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18105238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18105238\\temporaryfile")) returned 1 [0036.029] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1a8afc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1a8afc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1a8afc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0036.029] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0036.029] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18105238" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18105238")) returned 1 [0036.029] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite") returned 0 [0036.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.sqlite.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlite.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0036.472] WriteFile (in: hFile=0xdc, lpBuffer=0x3870028*, nNumberOfBytesToWrite=0xa00008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x3870028*, lpNumberOfBytesWritten=0x18fdd8*=0xa00008, lpOverlapped=0x0) returned 1 [0036.708] CloseHandle (hObject=0xdc) returned 1 [0037.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.064] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe14 [0037.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe1c) returned 0x25d578 [0037.064] ReadFile (in: hFile=0xdc, lpBuffer=0x25d580, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fdf0*=0xe14, lpOverlapped=0x0) returned 1 [0037.067] CloseHandle (hObject=0xdc) returned 1 [0037.067] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat")) returned 1 [0037.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0037.068] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.068] GetTickCount () returned 0x19efc [0037.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0037.068] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106236\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0037.069] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106236\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106236\\....\\temporaryfile")) returned 0 [0037.069] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106236\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106236\\temporaryfile")) returned 1 [0037.070] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106236\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b235440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.071] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b235440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.071] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.071] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106236\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.071] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.071] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.071] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.071] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106236\\temporaryfile")) returned 1 [0037.071] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.071] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.071] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106236" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106236")) returned 1 [0037.071] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat") returned 0 [0037.072] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.072] WriteFile (in: hFile=0xdc, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdd8*=0xe18, lpOverlapped=0x0) returned 1 [0037.073] CloseHandle (hObject=0xdc) returned 1 [0037.074] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.075] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xfde [0037.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfe6) returned 0x25d578 [0037.075] ReadFile (in: hFile=0xdc, lpBuffer=0x25d580, nNumberOfBytesToRead=0xfde, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fdf0*=0xfde, lpOverlapped=0x0) returned 1 [0037.076] CloseHandle (hObject=0xdc) returned 1 [0037.077] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js")) returned 1 [0037.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.077] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.077] GetTickCount () returned 0x19f0c [0037.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0037.078] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106252\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106252\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.079] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106252\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106252\\....\\temporaryfile")) returned 0 [0037.079] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106252\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106252\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106252\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106252\\temporaryfile")) returned 1 [0037.080] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106252\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.080] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106252\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.080] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.080] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.080] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106252\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106252\\temporaryfile")) returned 1 [0037.081] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b25b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b25b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b25b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.081] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.081] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106252" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106252")) returned 1 [0037.081] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js") returned 0 [0037.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.082] WriteFile (in: hFile=0xdc, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xfe8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdd8*=0xfe8, lpOverlapped=0x0) returned 1 [0037.083] CloseHandle (hObject=0xdc) returned 1 [0037.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.085] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4183 [0037.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x418b) returned 0x293460 [0037.085] ReadFile (in: hFile=0xdc, lpBuffer=0x293468, nNumberOfBytesToRead=0x4183, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x293468*, lpNumberOfBytesRead=0x18fdf0*=0x4183, lpOverlapped=0x0) returned 1 [0037.086] CloseHandle (hObject=0xdc) returned 1 [0037.086] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json")) returned 1 [0037.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0037.087] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.087] GetTickCount () returned 0x19f1b [0037.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0037.088] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0037.089] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267\\....\\temporaryfile")) returned 0 [0037.089] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267\\temporaryfile")) returned 1 [0037.090] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.090] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.090] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.090] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.090] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267\\temporaryfile")) returned 1 [0037.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.090] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267")) returned 1 [0037.091] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json") returned 0 [0037.091] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\search.json.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\search.json.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.092] WriteFile (in: hFile=0xdc, lpBuffer=0x297600*, nNumberOfBytesToWrite=0x4188, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x297600*, lpNumberOfBytesWritten=0x18fdd8*=0x4188, lpOverlapped=0x0) returned 1 [0037.093] CloseHandle (hObject=0xdc) returned 1 [0037.095] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.096] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4000 [0037.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4008) returned 0x293460 [0037.096] ReadFile (in: hFile=0xdc, lpBuffer=0x293468, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x293468*, lpNumberOfBytesRead=0x18fdf0*=0x4000, lpOverlapped=0x0) returned 1 [0037.098] CloseHandle (hObject=0xdc) returned 1 [0037.098] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db")) returned 1 [0037.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.099] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.099] GetTickCount () returned 0x19f1b [0037.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0037.099] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.100] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267\\....\\temporaryfile")) returned 0 [0037.100] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267\\temporaryfile")) returned 1 [0037.101] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2a7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2a7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.101] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2a7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2a7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.101] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.101] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.101] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.101] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.102] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.102] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267\\temporaryfile")) returned 1 [0037.102] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b281700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b281700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b281700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.102] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.102] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106267" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106267")) returned 1 [0037.102] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db") returned 0 [0037.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\secmod.db.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\secmod.db.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.105] WriteFile (in: hFile=0xdc, lpBuffer=0x297478*, nNumberOfBytesToWrite=0x4008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x297478*, lpNumberOfBytesWritten=0x18fdd8*=0x4008, lpOverlapped=0x0) returned 1 [0037.106] CloseHandle (hObject=0xdc) returned 1 [0037.107] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.107] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d6 [0037.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3de) returned 0x259e70 [0037.107] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x3d6, lpOverlapped=0x0) returned 1 [0037.109] CloseHandle (hObject=0xdc) returned 1 [0037.109] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak")) returned 1 [0037.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0037.109] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.110] GetTickCount () returned 0x19f2b [0037.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0037.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0037.110] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106283\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106283\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0037.110] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106283\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106283\\....\\temporaryfile")) returned 0 [0037.111] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106283\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106283\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106283\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106283\\temporaryfile")) returned 1 [0037.112] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106283\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2a7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2a7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2a7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.112] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2a7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2a7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2a7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.112] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2a7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2a7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2a7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.112] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106283\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2a7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2a7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2a7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.112] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2a7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2a7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2a7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.112] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2a7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2a7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2a7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.112] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.112] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106283\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106283\\temporaryfile")) returned 1 [0037.112] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2a7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2a7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2a7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.112] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.113] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106283" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106283")) returned 1 [0037.113] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak") returned 0 [0037.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.bak.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.bak.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.113] WriteFile (in: hFile=0xdc, lpBuffer=0x25d580*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesWritten=0x18fdd8*=0x3e0, lpOverlapped=0x0) returned 1 [0037.114] CloseHandle (hObject=0xdc) returned 1 [0037.115] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.116] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbc5 [0037.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbcd) returned 0x25d578 [0037.116] ReadFile (in: hFile=0xdc, lpBuffer=0x25d580, nNumberOfBytesToRead=0xbc5, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fdf0*=0xbc5, lpOverlapped=0x0) returned 1 [0037.117] CloseHandle (hObject=0xdc) returned 1 [0037.118] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js")) returned 1 [0037.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.118] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.118] GetTickCount () returned 0x19f3b [0037.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0037.119] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106299\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106299\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.119] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106299\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106299\\....\\temporaryfile")) returned 0 [0037.119] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106299\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106299\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106299\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106299\\temporaryfile")) returned 1 [0037.120] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106299\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2cd9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2cd9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2cd9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.121] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2cd9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2cd9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2cd9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.121] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2cd9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2cd9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2cd9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.121] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106299\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2cd9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2cd9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2cd9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.121] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2cd9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2cd9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2cd9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.121] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2cd9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2cd9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2cd9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.121] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.121] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106299\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106299\\temporaryfile")) returned 1 [0037.121] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2cd9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2cd9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2cd9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.121] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.121] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106299" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106299")) returned 1 [0037.121] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js") returned 0 [0037.122] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.122] WriteFile (in: hFile=0xdc, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdd8*=0xbd0, lpOverlapped=0x0) returned 1 [0037.123] CloseHandle (hObject=0xdc) returned 1 [0037.124] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.124] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x50000 [0037.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x50008) returned 0x2350048 [0037.125] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x50000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x50000, lpOverlapped=0x0) returned 1 [0037.132] CloseHandle (hObject=0xdc) returned 1 [0037.132] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite")) returned 1 [0037.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0037.135] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.135] GetTickCount () returned 0x19f4a [0037.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0037.135] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106314\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106314\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0037.136] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106314\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106314\\....\\temporaryfile")) returned 0 [0037.136] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106314\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106314\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106314\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106314\\temporaryfile")) returned 1 [0037.137] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106314\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2f3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2f3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2f3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.137] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2f3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2f3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2f3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.137] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2f3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2f3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2f3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.137] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106314\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2f3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2f3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2f3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.137] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2f3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2f3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2f3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.137] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2f3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2f3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2f3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.137] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.137] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106314\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106314\\temporaryfile")) returned 1 [0037.137] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b2f3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b2f3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b2f3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.137] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.137] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106314" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106314")) returned 1 [0037.138] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite") returned 0 [0037.148] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\signons.sqlite.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\signons.sqlite.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.149] WriteFile (in: hFile=0xdc, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x50008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdd8*=0x50008, lpOverlapped=0x0) returned 1 [0037.154] CloseHandle (hObject=0xdc) returned 1 [0037.157] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.158] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d [0037.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25) returned 0x2596b8 [0037.158] ReadFile (in: hFile=0xdc, lpBuffer=0x2596c0, nNumberOfBytesToRead=0x1d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2596c0*, lpNumberOfBytesRead=0x18fdf0*=0x1d, lpOverlapped=0x0) returned 1 [0037.159] CloseHandle (hObject=0xdc) returned 1 [0037.159] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json")) returned 1 [0037.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.160] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0037.160] GetTickCount () returned 0x19f5a [0037.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0037.161] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106330\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.161] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106330\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106330\\....\\temporaryfile")) returned 0 [0037.161] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106330\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106330\\temporaryfile")) returned 1 [0037.162] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106330\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b319c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b319c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b319c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.162] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b319c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b319c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b319c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.162] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b319c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b319c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b319c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.162] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106330\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b319c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b319c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b319c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.162] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b319c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b319c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b319c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.163] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b319c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b319c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b319c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.163] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106330\\temporaryfile")) returned 1 [0037.163] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b319c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b319c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b319c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.163] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106330" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106330")) returned 1 [0037.163] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json") returned 0 [0037.163] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\times.json.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\times.json.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.164] WriteFile (in: hFile=0xdc, lpBuffer=0x28ea18*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28ea18*, lpNumberOfBytesWritten=0x18fdd8*=0x28, lpOverlapped=0x0) returned 1 [0037.165] CloseHandle (hObject=0xdc) returned 1 [0037.165] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.167] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18000 [0037.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18008) returned 0x2350048 [0037.167] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x18000, lpOverlapped=0x0) returned 1 [0037.168] CloseHandle (hObject=0xdc) returned 1 [0037.168] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite")) returned 1 [0037.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0037.170] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.170] GetTickCount () returned 0x19f69 [0037.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0037.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0037.170] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106345\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106345\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0037.171] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106345\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106345\\....\\temporaryfile")) returned 0 [0037.171] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106345\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106345\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106345\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106345\\temporaryfile")) returned 1 [0037.172] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106345\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b33fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b33fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b33fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.172] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b33fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b33fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b33fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.172] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b33fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b33fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b33fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.172] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106345\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b33fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b33fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b33fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.172] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b33fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b33fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b33fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.172] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b33fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b33fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b33fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.172] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.172] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106345\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106345\\temporaryfile")) returned 1 [0037.173] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b33fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b33fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b33fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.173] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.173] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106345" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106345")) returned 1 [0037.173] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite") returned 0 [0037.174] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webappsstore.sqlite.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webappsstore.sqlite.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0037.175] WriteFile (in: hFile=0xdc, lpBuffer=0x2368060*, nNumberOfBytesToWrite=0x18008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2368060*, lpNumberOfBytesWritten=0x18fdd8*=0x18008, lpOverlapped=0x0) returned 1 [0037.177] CloseHandle (hObject=0xdc) returned 1 [0037.179] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.179] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x1b33fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b33fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0037.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0037.179] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb5233c30, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.181] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb5233c30, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0037.181] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc37c9330, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc37c9330, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc37df2c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0xb5233c30, dwReserved1=0x1d2dda4, cFileName="bookmarks-2017-06-05_5.json", cAlternateFileName="BOOKMA~1.JSO")) returned 1 [0037.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c) returned 0x255c48 [0037.181] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0037.182] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbdb [0037.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbe3) returned 0x25d578 [0037.182] ReadFile (in: hFile=0xe0, lpBuffer=0x25d580, nNumberOfBytesToRead=0xbdb, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fdd0*=0xbdb, lpOverlapped=0x0) returned 1 [0037.183] CloseHandle (hObject=0xe0) returned 1 [0037.184] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json")) returned 1 [0037.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.185] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.185] GetTickCount () returned 0x19f79 [0037.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0037.185] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106361\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106361\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.185] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106361\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106361\\....\\temporaryfile")) returned 0 [0037.186] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106361\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106361\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106361\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106361\\temporaryfile")) returned 1 [0037.186] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106361\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b365f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b365f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b365f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1d, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.187] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b365f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b365f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b365f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1d, cFileName="..", cAlternateFileName="")) returned 1 [0037.187] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b365f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b365f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b365f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1d, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.187] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106361\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b365f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b365f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b365f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0037.187] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b365f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b365f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b365f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.187] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b365f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b365f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b365f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.187] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0037.187] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106361\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106361\\temporaryfile")) returned 1 [0037.187] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b365f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b365f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b365f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x1d, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.187] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.187] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106361" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106361")) returned 1 [0037.187] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json") returned 0 [0037.188] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-05_5.json.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0037.188] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xbe0, lpOverlapped=0x0) returned 1 [0037.189] CloseHandle (hObject=0xe0) returned 1 [0037.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0037.191] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbdb [0037.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbe3) returned 0x25d578 [0037.191] ReadFile (in: hFile=0xe0, lpBuffer=0x25d580, nNumberOfBytesToRead=0xbdb, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesRead=0x18fdd0*=0xbdb, lpOverlapped=0x0) returned 1 [0037.192] CloseHandle (hObject=0xe0) returned 1 [0037.192] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json")) returned 1 [0037.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.193] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.193] GetTickCount () returned 0x19f89 [0037.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0037.194] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.194] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377\\....\\temporaryfile")) returned 0 [0037.194] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377\\temporaryfile")) returned 1 [0037.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0037.196] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.196] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.196] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0037.196] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377\\temporaryfile")) returned 1 [0037.198] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.198] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.198] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377")) returned 1 [0037.198] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json") returned 0 [0037.199] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\bookmarks-2017-06-16_5.json.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0037.199] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xbe0, lpOverlapped=0x0) returned 1 [0037.200] CloseHandle (hObject=0xe0) returned 1 [0037.200] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.201] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0037.201] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.201] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6ff4f30, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.202] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6ff4f30, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0037.202] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6ff4f30, dwReserved1=0x1d2dda4, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 1 [0037.202] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6ff4f30, dwReserved1=0x1d2dda4, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 0 [0037.202] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6ff4f30, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0037.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb701b090, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.203] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb701b090, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0037.203] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb701b090, dwReserved1=0x1d2dda4, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1 [0037.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x2561b0 [0037.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0037.204] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x0 [0037.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9e0 [0037.204] ReadFile (in: hFile=0xe4, lpBuffer=0x25c9e8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x25c9e8*, lpNumberOfBytesRead=0x18fdb0*=0x0, lpOverlapped=0x0) returned 1 [0037.204] CloseHandle (hObject=0xe4) returned 1 [0037.204] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata")) returned 1 [0037.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0037.205] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.205] GetTickCount () returned 0x19f89 [0037.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0037.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0037.205] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377\\...."), lpSecurityAttributes=0x256198) returned 1 [0037.206] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377\\....\\temporaryfile")) returned 0 [0037.206] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377\\temporaryfile")) returned 1 [0037.207] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x20, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0037.207] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x20, cFileName="..", cAlternateFileName="")) returned 1 [0037.207] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x20, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.207] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0037.207] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.207] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.207] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0037.207] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377\\temporaryfile")) returned 1 [0037.207] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b38c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x20, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.208] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0037.208] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106377" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106377")) returned 1 [0037.208] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata") returned 0 [0037.208] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\.metadata.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\.metadata.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0037.209] WriteFile (in: hFile=0xe4, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0037.209] CloseHandle (hObject=0xe4) returned 1 [0037.209] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.209] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x1b38c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b38c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0037.209] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb701b090, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0037.213] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb701b090, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0037.213] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb701b090, dwReserved1=0x1d2dda4, cFileName="818200132aebmoouht", cAlternateFileName="818200~1")) returned 1 [0037.213] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0xb701b090, dwReserved1=0x1d2dda4, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 1 [0037.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x255c70 [0037.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe8 [0037.214] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x18fd90 | out: lpFileSizeHigh=0x18fd90*=0x0) returned 0xa0000 [0037.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa0008) returned 0x1d70020 [0037.214] ReadFile (in: hFile=0xe8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xa0000, lpNumberOfBytesRead=0x18fd90, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fd90*=0xa0000, lpOverlapped=0x0) returned 1 [0037.227] CloseHandle (hObject=0xe8) returned 1 [0037.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite")) returned 1 [0037.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0037.232] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc3c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.232] GetTickCount () returned 0x19fa8 [0037.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0037.233] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106408\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0037.233] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106408\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106408\\....\\temporaryfile")) returned 0 [0037.233] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106408\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106408\\temporaryfile")) returned 1 [0037.234] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106408\\*", lpFindFileData=0x18fb14 | out: lpFindFileData=0x18fb14*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b3d8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b3d8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b3d8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x21, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0037.234] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb14 | out: lpFindFileData=0x18fb14*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b3d8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b3d8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b3d8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x21, cFileName="..", cAlternateFileName="")) returned 1 [0037.234] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb14 | out: lpFindFileData=0x18fb14*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b3d8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b3d8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b3d8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x21, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.234] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106408\\TemporaryFile\\*", lpFindFileData=0x18f7b4 | out: lpFindFileData=0x18f7b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b3d8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b3d8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b3d8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0037.234] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7b4 | out: lpFindFileData=0x18f7b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b3d8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b3d8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b3d8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.234] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7b4 | out: lpFindFileData=0x18f7b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b3d8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b3d8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b3d8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.234] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0037.234] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106408\\temporaryfile")) returned 1 [0037.235] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb14 | out: lpFindFileData=0x18fb14*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b3d8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b3d8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b3d8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x21, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.235] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0037.235] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106408" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106408")) returned 1 [0037.235] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned 0 [0037.258] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe8 [0037.259] WriteFile (in: hFile=0xe8, lpBuffer=0x2500028*, nNumberOfBytesToWrite=0xa0008, lpNumberOfBytesWritten=0x18fd78, lpOverlapped=0x0 | out: lpBuffer=0x2500028*, lpNumberOfBytesWritten=0x18fd78*=0xa0008, lpOverlapped=0x0) returned 1 [0037.269] CloseHandle (hObject=0xe8) returned 1 [0037.279] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0037.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x1b424620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b424620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0037.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0037.280] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x18fc48 | out: lpFindFileData=0x18fc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb70ff8d0, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0037.281] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fc48 | out: lpFindFileData=0x18fc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb70ff8d0, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0037.281] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fc48 | out: lpFindFileData=0x18fc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb70ff8d0, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 0 [0037.281] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0037.281] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x18fc48 | out: lpFindFileData=0x18fc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb70ff8d0, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0037.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0037.281] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0037.281] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0037.281] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.282] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.282] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb26740e0, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb26740e0, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0037.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb26740e0, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 0 [0037.283] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb26740e0, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0037.283] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4f60210, dwReserved1=0x1d2dda4, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.284] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4f60210, dwReserved1=0x1d2dda4, cFileName="..", cAlternateFileName="")) returned 1 [0037.284] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0xb4f60210, dwReserved1=0x1d2dda4, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 1 [0037.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561b0 [0037.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0037.285] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2 [0037.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x2561e0 [0037.285] ReadFile (in: hFile=0xe0, lpBuffer=0x2561e8, nNumberOfBytesToRead=0x2, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2561e8*, lpNumberOfBytesRead=0x18fdd0*=0x2, lpOverlapped=0x0) returned 1 [0037.285] CloseHandle (hObject=0xe0) returned 1 [0037.286] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json")) returned 1 [0037.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0037.286] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.286] GetTickCount () returned 0x19fd7 [0037.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0037.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0037.287] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106455\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106455\\...."), lpSecurityAttributes=0x256198) returned 1 [0037.287] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106455\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106455\\....\\temporaryfile")) returned 0 [0037.287] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106455\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106455\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106455\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106455\\temporaryfile")) returned 1 [0037.289] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106455\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b44a780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240150, dwReserved1=0x773a5922, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0037.289] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b44a780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240150, dwReserved1=0x773a5922, cFileName="..", cAlternateFileName="")) returned 1 [0037.289] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4708e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240150, dwReserved1=0x773a5922, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.289] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106455\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4708e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0037.289] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4708e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.289] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4708e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.289] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0037.289] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106455\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106455\\temporaryfile")) returned 1 [0037.289] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4708e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240150, dwReserved1=0x773a5922, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.289] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0037.289] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106455" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106455")) returned 1 [0037.290] PathFileExistsA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json") returned 0 [0037.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\webapps.json.SKYSTARS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\webapps.json.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0037.290] WriteFile (in: hFile=0xe0, lpBuffer=0x2561a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2561a0*, lpNumberOfBytesWritten=0x18fdb8*=0x8, lpOverlapped=0x0) returned 1 [0037.291] CloseHandle (hObject=0xe0) returned 1 [0037.292] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.292] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x55005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0037.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0037.292] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0037.292] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.292] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.292] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.292] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0037.293] FindClose (in: hFindFile=0x259630 | out: hFindFile=0x259630) returned 1 [0037.293] FindFirstFileA (in: lpFileName="C:\\*.*", lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650064, dwReserved1=0x610066, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x289a10 [0037.293] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650064, dwReserved1=0x610066, cFileName="Boot", cAlternateFileName="")) returned 1 [0037.293] FindNextFileA (in: hFindFile=0x289a10, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x650064, dwReserved1=0x610066, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0037.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9a0 [0037.293] CreateFileA (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0037.294] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x5db2a [0037.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5db32) returned 0x2350048 [0037.294] ReadFile (in: hFile=0xc4, lpBuffer=0x2350050, nNumberOfBytesToRead=0x5db2a, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe70*=0x5db2a, lpOverlapped=0x0) returned 1 [0037.299] CloseHandle (hObject=0xc4) returned 1 [0037.299] DeleteFileA (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0 [0037.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0037.299] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.299] GetTickCount () returned 0x19fe6 [0037.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0037.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0037.300] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106470\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0037.300] MoveFileA (lpExistingFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106470\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106470\\....\\temporaryfile")) returned 1 [0037.301] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106470\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106470\\temporaryfile")) returned 1 [0037.302] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106470\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4708e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x773a58d2, dwReserved1=0x18f9fc, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0037.302] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4708e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x773a58d2, dwReserved1=0x18f9fc, cFileName="..", cAlternateFileName="")) returned 1 [0037.302] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4708e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x773a58d2, dwReserved1=0x18f9fc, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.302] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106470\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4708e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.303] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4708e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4708e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4708e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.303] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.303] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106470\\TemporaryFile\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106470\\temporaryfile\\temporaryfile")) returned 0 [0037.303] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.303] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0037.303] PathFileExistsA (pszPath="C:\\bootmgr") returned 0 [0037.309] CreateFileA (lpFileName="C:\\bootmgr.SKYSTARS" (normalized: "c:\\bootmgr.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0037.310] WriteFile (in: hFile=0xc4, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x5db30, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fe58*=0x5db30, lpOverlapped=0x0) returned 1 [0037.316] CloseHandle (hObject=0xc4) returned 1 [0037.322] CreateFileA (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0037.323] GetFileSize (in: hFile=0xc4, lpFileSizeHigh=0x18fe70 | out: lpFileSizeHigh=0x18fe70*=0x0) returned 0x2000 [0037.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2008) returned 0x297460 [0037.323] ReadFile (in: hFile=0xc4, lpBuffer=0x297468, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18fe70, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe70*=0x2000, lpOverlapped=0x0) returned 1 [0037.325] CloseHandle (hObject=0xc4) returned 1 [0037.325] DeleteFileA (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0 [0037.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.325] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.325] GetTickCount () returned 0x1a005 [0037.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0037.326] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106501\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106501\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.326] MoveFileA (lpExistingFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106501\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106501\\....\\temporaryfile")) returned 1 [0037.326] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106501\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106501\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106501\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106501\\temporaryfile")) returned 1 [0037.328] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106501\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4bcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4bcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4bcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0037.328] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4bcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4bcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4bcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0037.328] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4bcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4bcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4bcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.328] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106501\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4bcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4bcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4bcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.328] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4bcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4bcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4bcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.328] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.328] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106501\\TemporaryFile\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106501\\temporaryfile\\temporaryfile")) returned 0 [0037.328] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.328] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0037.329] PathFileExistsA (pszPath="C:\\BOOTSECT.BAK") returned 0 [0037.329] CreateFileA (lpFileName="C:\\BOOTSECT.BAK.SKYSTARS" (normalized: "c:\\bootsect.bak.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0037.329] WriteFile (in: hFile=0xc4, lpBuffer=0x299478*, nNumberOfBytesToWrite=0x2008, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x299478*, lpNumberOfBytesWritten=0x18fe58*=0x2008, lpOverlapped=0x0) returned 1 [0037.330] CloseHandle (hObject=0xc4) returned 1 [0037.334] CreateFileA (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0037.335] DeleteFileA (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys")) returned 0 [0037.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.335] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.335] GetTickCount () returned 0x1a015 [0037.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0037.335] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.336] MoveFileA (lpExistingFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517\\....\\temporaryfile")) returned 0 [0037.336] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517\\temporaryfile")) returned 1 [0037.337] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac54a060, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0037.337] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac54a060, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0037.337] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac54a060, dwReserved1=0x1d2de32, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.337] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.337] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.337] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.337] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.337] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517\\temporaryfile")) returned 1 [0037.337] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac54a060, dwReserved1=0x1d2de32, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.338] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0037.338] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517")) returned 1 [0037.338] PathFileExistsA (pszPath="C:\\hiberfil.sys") returned 0 [0037.338] CreateFileA (lpFileName="C:\\hiberfil.sys.SKYSTARS" (normalized: "c:\\hiberfil.sys.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0037.338] WriteFile (in: hFile=0xc4, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fe58*=0x0, lpOverlapped=0x0) returned 1 [0037.338] CloseHandle (hObject=0xc4) returned 1 [0037.338] CreateFileA (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0037.338] DeleteFileA (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys")) returned 0 [0037.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.338] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fd1c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.339] GetTickCount () returned 0x1a015 [0037.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a50 [0037.339] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.340] MoveFileA (lpExistingFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517\\....\\temporaryfile")) returned 0 [0037.340] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517\\temporaryfile")) returned 1 [0037.341] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\*", lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0037.341] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.341] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.341] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\TemporaryFile\\*", lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.341] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.341] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18f894 | out: lpFindFileData=0x18f894*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289a6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.341] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.341] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517\\temporaryfile")) returned 1 [0037.341] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fbf4 | out: lpFindFileData=0x18fbf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b4e2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b4e2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b4e2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.341] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0037.342] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106517" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106517")) returned 1 [0037.342] PathFileExistsA (pszPath="C:\\pagefile.sys") returned 0 [0037.342] CreateFileA (lpFileName="C:\\pagefile.sys.SKYSTARS" (normalized: "c:\\pagefile.sys.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc4 [0037.342] WriteFile (in: hFile=0xc4, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fe58, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fe58*=0x0, lpOverlapped=0x0) returned 1 [0037.342] CloseHandle (hObject=0xc4) returned 1 [0037.342] FindClose (in: hFindFile=0x289a10 | out: hFindFile=0x289a10) returned 1 [0037.342] FindFirstFileA (in: lpFileName="C:\\*.*", lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x70005c, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x289a10 [0037.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561c8 [0037.342] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd29f5adc, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0037.343] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd29f5adc, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0037.343] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd29f5adc, dwReserved1=0x1ca0431, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0037.343] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd29f5adc, dwReserved1=0x1ca0431, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0037.343] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0037.343] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd29f5adc, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0037.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0037.343] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfdd420, dwReserved1=0x1d2dd9c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.343] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dfdd420, dwReserved1=0x1d2dd9c, cFileName="..", cAlternateFileName="")) returned 1 [0037.343] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x2dfdd420, dwReserved1=0x1d2dd9c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561e0 [0037.343] CreateFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.343] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x81 [0037.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x89) returned 0x262a08 [0037.344] ReadFile (in: hFile=0xd4, lpBuffer=0x262a10, nNumberOfBytesToRead=0x81, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x262a10*, lpNumberOfBytesRead=0x18fe30*=0x81, lpOverlapped=0x0) returned 1 [0037.344] CloseHandle (hObject=0xd4) returned 1 [0037.344] DeleteFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0037.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0037.366] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.366] GetTickCount () returned 0x1a034 [0037.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0037.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0037.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0037.366] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\...."), lpSecurityAttributes=0x256198) returned 1 [0037.367] MoveFileA (lpExistingFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\....\\temporaryfile")) returned 0 [0037.367] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\temporaryfile")) returned 1 [0037.368] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.368] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0037.368] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.368] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0037.368] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.368] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.368] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.368] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\temporaryfile")) returned 1 [0037.368] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.369] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.369] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548")) returned 1 [0037.369] PathFileExistsA (pszPath="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 0 [0037.369] CreateFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.SKYSTARS" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.369] WriteFile (in: hFile=0xd4, lpBuffer=0x262aa8*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x262aa8*, lpNumberOfBytesWritten=0x18fe18*=0x88, lpOverlapped=0x0) returned 1 [0037.370] CloseHandle (hObject=0xd4) returned 1 [0037.371] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.371] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x24005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0037.371] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.371] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0037.371] FindFirstFileA (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac015040, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0037.371] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac015040, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0037.371] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xac015040, dwReserved1=0x1d2de32, cFileName="BCD", cAlternateFileName="")) returned 1 [0037.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4) returned 0x25c9d0 [0037.372] CreateFileA (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0037.372] DeleteFileA (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd")) returned 0 [0037.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0037.372] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.372] GetTickCount () returned 0x1a034 [0037.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0037.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0037.372] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0037.373] MoveFileA (lpExistingFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\....\\temporaryfile")) returned 0 [0037.373] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\temporaryfile")) returned 1 [0037.374] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.374] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName="..", cAlternateFileName="")) returned 1 [0037.374] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.374] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.374] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.374] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.374] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.374] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\temporaryfile")) returned 1 [0037.375] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.375] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.375] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548")) returned 1 [0037.375] PathFileExistsA (pszPath="C:\\Boot\\BCD") returned 1 [0037.375] CreateFileA (lpFileName="C:\\Boot\\BCD.SKYSTARS" (normalized: "c:\\boot\\bcd.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0037.376] WriteFile (in: hFile=0xd0, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fe38*=0x0, lpOverlapped=0x0) returned 1 [0037.376] CloseHandle (hObject=0xd0) returned 1 [0037.376] CreateFileA (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0037.376] DeleteFileA (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log")) returned 0 [0037.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0037.376] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.376] GetTickCount () returned 0x1a034 [0037.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0037.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0037.376] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0037.377] MoveFileA (lpExistingFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\....\\temporaryfile")) returned 0 [0037.377] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\temporaryfile")) returned 1 [0037.378] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.378] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.378] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.378] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.378] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.378] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.378] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.379] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548\\temporaryfile")) returned 1 [0037.379] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b52efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b52efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b52efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.379] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.379] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106548" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106548")) returned 1 [0037.379] PathFileExistsA (pszPath="C:\\Boot\\BCD.LOG") returned 1 [0037.379] CreateFileA (lpFileName="C:\\Boot\\BCD.LOG.SKYSTARS" (normalized: "c:\\boot\\bcd.log.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0037.380] WriteFile (in: hFile=0xd0, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fe38*=0x0, lpOverlapped=0x0) returned 1 [0037.380] CloseHandle (hObject=0xd0) returned 1 [0037.380] CreateFileA (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0037.380] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x0 [0037.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9b0 [0037.380] ReadFile (in: hFile=0xd0, lpBuffer=0x25c9b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25c9b8*, lpNumberOfBytesRead=0x18fe50*=0x0, lpOverlapped=0x0) returned 1 [0037.380] CloseHandle (hObject=0xd0) returned 1 [0037.380] DeleteFileA (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1")) returned 1 [0037.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0037.380] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.380] GetTickCount () returned 0x1a044 [0037.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0037.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0037.381] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0037.381] MoveFileA (lpExistingFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\....\\temporaryfile")) returned 0 [0037.381] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\temporaryfile")) returned 1 [0037.382] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.382] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.382] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.383] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.383] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.383] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.383] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.383] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\temporaryfile")) returned 1 [0037.383] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.383] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.383] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564")) returned 1 [0037.383] PathFileExistsA (pszPath="C:\\Boot\\BCD.LOG1") returned 0 [0037.384] CreateFileA (lpFileName="C:\\Boot\\BCD.LOG1.SKYSTARS" (normalized: "c:\\boot\\bcd.log1.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0037.384] WriteFile (in: hFile=0xd0, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fe38*=0x0, lpOverlapped=0x0) returned 1 [0037.384] CloseHandle (hObject=0xd0) returned 1 [0037.384] CreateFileA (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0037.385] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x0 [0037.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9b0 [0037.385] ReadFile (in: hFile=0xd0, lpBuffer=0x25c9b8, nNumberOfBytesToRead=0x0, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x25c9b8*, lpNumberOfBytesRead=0x18fe50*=0x0, lpOverlapped=0x0) returned 1 [0037.385] CloseHandle (hObject=0xd0) returned 1 [0037.385] DeleteFileA (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2")) returned 1 [0037.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0037.385] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.385] GetTickCount () returned 0x1a044 [0037.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0037.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0037.385] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0037.386] MoveFileA (lpExistingFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\....\\temporaryfile")) returned 0 [0037.386] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\temporaryfile")) returned 1 [0037.387] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.387] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.387] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.387] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.387] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.387] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.387] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.388] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\temporaryfile")) returned 1 [0037.388] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.388] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.388] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564")) returned 1 [0037.388] PathFileExistsA (pszPath="C:\\Boot\\BCD.LOG2") returned 0 [0037.388] CreateFileA (lpFileName="C:\\Boot\\BCD.LOG2.SKYSTARS" (normalized: "c:\\boot\\bcd.log2.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0037.389] WriteFile (in: hFile=0xd0, lpBuffer=0x41c2c7*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x41c2c7*, lpNumberOfBytesWritten=0x18fe38*=0x0, lpOverlapped=0x0) returned 1 [0037.389] CloseHandle (hObject=0xd0) returned 1 [0037.389] CreateFileA (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0037.390] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x10000 [0037.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10008) returned 0x2350048 [0037.391] ReadFile (in: hFile=0xd0, lpBuffer=0x2350050, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe50*=0x10000, lpOverlapped=0x0) returned 1 [0037.393] CloseHandle (hObject=0xd0) returned 1 [0037.393] DeleteFileA (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0037.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561b0 [0037.394] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.394] GetTickCount () returned 0x1a044 [0037.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0037.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0037.395] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\...."), lpSecurityAttributes=0x2561b0) returned 1 [0037.395] MoveFileA (lpExistingFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\....\\temporaryfile")) returned 0 [0037.395] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\temporaryfile")) returned 1 [0037.396] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.397] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.397] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.397] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.397] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.397] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.397] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.397] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564\\temporaryfile")) returned 1 [0037.397] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b555120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b555120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b555120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.397] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.397] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106564" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106564")) returned 1 [0037.398] PathFileExistsA (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned 0 [0037.399] CreateFileA (lpFileName="C:\\Boot\\BOOTSTAT.DAT.SKYSTARS" (normalized: "c:\\boot\\bootstat.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0037.399] WriteFile (in: hFile=0xd0, lpBuffer=0x2360060*, nNumberOfBytesToWrite=0x10008, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x2360060*, lpNumberOfBytesWritten=0x18fe38*=0x10008, lpOverlapped=0x0) returned 1 [0037.401] CloseHandle (hObject=0xd0) returned 1 [0037.402] CreateFileA (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0037.403] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0x76980 [0037.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x76988) returned 0x2350048 [0037.405] ReadFile (in: hFile=0xd0, lpBuffer=0x2350050, nNumberOfBytesToRead=0x76980, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe50*=0x76980, lpOverlapped=0x0) returned 1 [0037.412] CloseHandle (hObject=0xd0) returned 1 [0037.412] DeleteFileA (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0 [0037.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0037.412] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.412] GetTickCount () returned 0x1a063 [0037.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0037.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0037.413] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106595\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106595\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0037.413] MoveFileA (lpExistingFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106595\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106595\\....\\temporaryfile")) returned 0 [0037.413] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106595\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106595\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106595\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106595\\temporaryfile")) returned 1 [0037.414] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106595\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b5a13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b5a13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b5a13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.414] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b5a13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b5a13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b5a13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.414] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b5a13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b5a13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b5a13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.414] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106595\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b5a13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b5a13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b5a13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.414] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b5a13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b5a13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b5a13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.414] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b5a13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b5a13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b5a13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.414] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106595\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106595\\temporaryfile")) returned 1 [0037.415] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b5a13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b5a13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b5a13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.415] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106595" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106595")) returned 1 [0037.415] PathFileExistsA (pszPath="C:\\Boot\\memtest.exe") returned 1 [0037.440] CreateFileA (lpFileName="C:\\Boot\\memtest.exe.SKYSTARS" (normalized: "c:\\boot\\memtest.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0037.440] WriteFile (in: hFile=0xd0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x76988, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fe38*=0x76988, lpOverlapped=0x0) returned 1 [0037.448] CloseHandle (hObject=0xd0) returned 1 [0037.455] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0037.455] FindFirstFileA (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1b5c7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b5c7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0037.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0037.455] FindFirstFileA (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac015040, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.455] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac015040, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0037.455] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xac015040, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0037.456] CreateFileA (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.456] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x15c50 [0037.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15c58) returned 0x2a0a70 [0037.457] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x15c50, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x15c50, lpOverlapped=0x0) returned 1 [0037.460] CloseHandle (hObject=0xd4) returned 1 [0037.460] DeleteFileA (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0 [0037.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.460] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.460] GetTickCount () returned 0x1a092 [0037.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0037.461] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.461] MoveFileA (lpExistingFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642\\....\\temporaryfile")) returned 0 [0037.461] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642\\temporaryfile")) returned 1 [0037.462] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b613800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b613800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b613800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.462] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b613800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b613800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b613800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.462] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b613800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b613800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b613800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.462] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b613800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b613800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b613800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0037.462] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b613800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b613800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b613800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.462] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b613800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b613800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b613800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.462] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.462] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642\\temporaryfile")) returned 1 [0037.463] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b613800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b613800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b613800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.463] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.463] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642")) returned 1 [0037.463] PathFileExistsA (pszPath="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 1 [0037.466] CreateFileA (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.466] WriteFile (in: hFile=0xd4, lpBuffer=0x2b66d8*, nNumberOfBytesToWrite=0x15c58, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b66d8*, lpNumberOfBytesWritten=0x18fe18*=0x15c58, lpOverlapped=0x0) returned 1 [0037.468] CloseHandle (hObject=0xd4) returned 1 [0037.469] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.469] FindFirstFileA (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1b613800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b613800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0037.470] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.470] FindFirstFileA (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac015040, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.470] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac015040, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0037.470] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xac015040, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0037.470] CreateFileA (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.471] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x15640 [0037.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15648) returned 0x2a0a70 [0037.471] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x15640, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x15640, lpOverlapped=0x0) returned 1 [0037.473] CloseHandle (hObject=0xd4) returned 1 [0037.473] DeleteFileA (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0 [0037.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.473] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.473] GetTickCount () returned 0x1a092 [0037.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0037.476] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.476] MoveFileA (lpExistingFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642\\....\\temporaryfile")) returned 0 [0037.476] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642\\temporaryfile")) returned 1 [0037.477] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b613800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.477] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b613800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.477] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.477] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0037.478] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.478] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.478] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.478] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642\\temporaryfile")) returned 1 [0037.478] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.478] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.478] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106642" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106642")) returned 1 [0037.478] PathFileExistsA (pszPath="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 1 [0037.480] CreateFileA (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.480] WriteFile (in: hFile=0xd4, lpBuffer=0x2b60c8*, nNumberOfBytesToWrite=0x15648, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b60c8*, lpNumberOfBytesWritten=0x18fe18*=0x15648, lpOverlapped=0x0) returned 1 [0037.482] CloseHandle (hObject=0xd4) returned 1 [0037.483] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.483] FindFirstFileA (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0037.483] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.483] FindFirstFileA (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.484] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0037.484] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0037.484] CreateFileA (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.484] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x16640 [0037.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16648) returned 0x2a0a70 [0037.484] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x16640, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x16640, lpOverlapped=0x0) returned 1 [0037.486] CloseHandle (hObject=0xd4) returned 1 [0037.486] DeleteFileA (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0 [0037.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.486] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.486] GetTickCount () returned 0x1a0a1 [0037.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0037.487] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106657\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106657\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.487] MoveFileA (lpExistingFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106657\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106657\\....\\temporaryfile")) returned 0 [0037.487] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106657\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106657\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106657\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106657\\temporaryfile")) returned 1 [0037.488] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106657\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.488] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.488] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.488] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106657\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0037.489] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.489] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.489] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106657\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106657\\temporaryfile")) returned 1 [0037.489] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b639960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b639960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b639960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.489] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106657" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106657")) returned 1 [0037.489] PathFileExistsA (pszPath="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 1 [0037.491] CreateFileA (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.491] WriteFile (in: hFile=0xd4, lpBuffer=0x2b70c8*, nNumberOfBytesToWrite=0x16648, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b70c8*, lpNumberOfBytesWritten=0x18fe18*=0x16648, lpOverlapped=0x0) returned 1 [0037.493] CloseHandle (hObject=0xd4) returned 1 [0037.495] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.495] FindFirstFileA (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1b65fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b65fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0037.495] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.495] FindFirstFileA (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.495] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0037.495] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0037.495] CreateFileA (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.497] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x17250 [0037.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17258) returned 0x2a0a70 [0037.498] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x17250, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x17250, lpOverlapped=0x0) returned 1 [0037.499] CloseHandle (hObject=0xd4) returned 1 [0037.499] DeleteFileA (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0 [0037.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.499] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.500] GetTickCount () returned 0x1a0b1 [0037.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0037.500] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106673\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106673\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.500] MoveFileA (lpExistingFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106673\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106673\\....\\temporaryfile")) returned 0 [0037.500] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106673\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106673\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106673\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106673\\temporaryfile")) returned 1 [0037.501] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106673\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b65fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b65fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b65fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.502] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b65fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b65fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b65fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.502] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b65fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b65fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b65fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.502] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106673\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b65fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b65fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b65fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0037.502] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b65fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b65fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b65fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.502] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b65fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b65fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b65fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.502] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.502] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106673\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106673\\temporaryfile")) returned 1 [0037.502] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b65fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b65fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b65fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.502] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.502] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106673" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106673")) returned 1 [0037.502] PathFileExistsA (pszPath="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 1 [0037.504] CreateFileA (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.505] WriteFile (in: hFile=0xd4, lpBuffer=0x2b7cd8*, nNumberOfBytesToWrite=0x17258, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b7cd8*, lpNumberOfBytesWritten=0x18fe18*=0x17258, lpOverlapped=0x0) returned 1 [0037.507] CloseHandle (hObject=0xd4) returned 1 [0037.508] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.508] FindFirstFileA (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1b65fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b65fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0037.508] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.508] FindFirstFileA (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.509] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0037.509] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0037.509] CreateFileA (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.509] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x14c40 [0037.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14c48) returned 0x2a0a70 [0037.509] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x14c40, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x14c40, lpOverlapped=0x0) returned 1 [0037.511] CloseHandle (hObject=0xd4) returned 1 [0037.511] DeleteFileA (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0 [0037.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0037.511] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.511] GetTickCount () returned 0x1a0c1 [0037.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0037.511] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106689\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0037.512] MoveFileA (lpExistingFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106689\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106689\\....\\temporaryfile")) returned 0 [0037.512] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106689\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106689\\temporaryfile")) returned 1 [0037.513] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106689\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b685c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b685c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b685c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.513] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b685c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b685c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b685c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.513] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b685c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b685c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b685c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.513] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106689\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b685c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b685c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b685c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0037.513] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b685c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b685c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b685c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.513] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b685c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b685c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b685c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.513] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.513] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106689\\temporaryfile")) returned 1 [0037.513] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b685c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b685c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b685c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.514] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106689" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106689")) returned 1 [0037.514] PathFileExistsA (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 1 [0037.515] CreateFileA (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.517] WriteFile (in: hFile=0xd4, lpBuffer=0x2b56c8*, nNumberOfBytesToWrite=0x14c48, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b56c8*, lpNumberOfBytesWritten=0x18fe18*=0x14c48, lpOverlapped=0x0) returned 1 [0037.518] CloseHandle (hObject=0xd4) returned 1 [0037.520] CreateFileA (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.520] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xaa50 [0037.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaa58) returned 0x2a0a70 [0037.520] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xaa50, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0xaa50, lpOverlapped=0x0) returned 1 [0037.522] CloseHandle (hObject=0xd4) returned 1 [0037.522] DeleteFileA (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0 [0037.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0037.522] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.522] GetTickCount () returned 0x1a0d0 [0037.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.523] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0037.523] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0037.523] MoveFileA (lpExistingFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704\\....\\temporaryfile")) returned 0 [0037.523] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704\\temporaryfile")) returned 1 [0037.524] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.524] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.524] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.524] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0037.524] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.525] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.525] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.525] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704\\temporaryfile")) returned 1 [0037.525] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.525] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.525] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704")) returned 1 [0037.525] PathFileExistsA (pszPath="C:\\Boot\\en-US\\memtest.exe.mui") returned 1 [0037.526] CreateFileA (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.SKYSTARS" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.526] WriteFile (in: hFile=0xd4, lpBuffer=0x2ab4d8*, nNumberOfBytesToWrite=0xaa58, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2ab4d8*, lpNumberOfBytesWritten=0x18fe18*=0xaa58, lpOverlapped=0x0) returned 1 [0037.528] CloseHandle (hObject=0xd4) returned 1 [0037.528] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.529] FindFirstFileA (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0037.529] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.529] FindFirstFileA (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.530] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0037.530] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xac03b1a0, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0037.530] CreateFileA (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.530] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x16050 [0037.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16058) returned 0x2a0a70 [0037.530] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x16050, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x16050, lpOverlapped=0x0) returned 1 [0037.532] CloseHandle (hObject=0xd4) returned 1 [0037.532] DeleteFileA (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0 [0037.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0037.532] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.532] GetTickCount () returned 0x1a0d0 [0037.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0037.533] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0037.533] MoveFileA (lpExistingFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704\\....\\temporaryfile")) returned 0 [0037.533] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704\\temporaryfile")) returned 1 [0037.534] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.534] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.534] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.534] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0037.535] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.535] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.535] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.535] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704\\temporaryfile")) returned 1 [0037.535] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6abd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6abd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6abd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.535] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.535] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106704" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106704")) returned 1 [0037.535] PathFileExistsA (pszPath="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 1 [0037.537] CreateFileA (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.537] WriteFile (in: hFile=0xd4, lpBuffer=0x2b6ad8*, nNumberOfBytesToWrite=0x16058, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b6ad8*, lpNumberOfBytesWritten=0x18fe18*=0x16058, lpOverlapped=0x0) returned 1 [0037.539] CloseHandle (hObject=0xd4) returned 1 [0037.540] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.541] FindFirstFileA (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1b6d1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6d1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0037.541] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.541] FindFirstFileA (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.541] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0037.541] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0037.541] CreateFileA (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.541] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x15c40 [0037.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15c48) returned 0x2a0a70 [0037.541] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x15c40, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x15c40, lpOverlapped=0x0) returned 1 [0037.543] CloseHandle (hObject=0xd4) returned 1 [0037.543] DeleteFileA (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0 [0037.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0037.544] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.544] GetTickCount () returned 0x1a0e0 [0037.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0037.544] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106720\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0037.544] MoveFileA (lpExistingFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106720\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106720\\....\\temporaryfile")) returned 0 [0037.545] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106720\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106720\\temporaryfile")) returned 1 [0037.546] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106720\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6d1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6d1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6d1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.546] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6d1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6d1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6d1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.546] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6d1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6d1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6d1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.546] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106720\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6d1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6d1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6d1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0037.546] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6d1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6d1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6d1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.546] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6d1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6d1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6d1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.546] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.546] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106720\\temporaryfile")) returned 1 [0037.546] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b6d1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b6d1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6d1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.546] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.546] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106720" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106720")) returned 1 [0037.547] PathFileExistsA (pszPath="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 1 [0037.548] CreateFileA (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.548] WriteFile (in: hFile=0xd4, lpBuffer=0x2b66c8*, nNumberOfBytesToWrite=0x15c48, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b66c8*, lpNumberOfBytesWritten=0x18fe18*=0x15c48, lpOverlapped=0x0) returned 1 [0037.550] CloseHandle (hObject=0xd4) returned 1 [0037.552] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.552] FindFirstFileA (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1b6d1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b6d1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0037.552] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0037.552] FindFirstFileA (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0037.552] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0037.552] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0037.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561e0 [0037.552] CreateFileA (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.553] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x385e00 [0037.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x385e08) returned 0x2650020 [0037.553] ReadFile (in: hFile=0xd4, lpBuffer=0x2650028, nNumberOfBytesToRead=0x385e00, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe30*=0x385e00, lpOverlapped=0x0) returned 1 [0037.642] CloseHandle (hObject=0xd4) returned 1 [0037.642] DeleteFileA (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0037.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0037.642] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0037.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0037.642] GetTickCount () returned 0x1a13d [0037.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0037.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0037.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0037.643] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106813\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106813\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0037.644] MoveFileA (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106813\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106813\\....\\temporaryfile")) returned 0 [0037.644] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106813\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106813\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106813\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106813\\temporaryfile")) returned 1 [0037.645] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106813\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b7b6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b7b6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b7b6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0037.645] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b7b6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b7b6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b7b6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.645] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b7b6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b7b6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b7b6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0037.645] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106813\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b7b6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b7b6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b7b6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0037.645] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b7b6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b7b6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b7b6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.645] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b7b6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b7b6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b7b6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.645] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0037.646] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106813\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106813\\temporaryfile")) returned 1 [0037.646] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1b7b6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1b7b6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1b7b6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0037.646] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0037.646] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18106813" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18106813")) returned 1 [0037.646] PathFileExistsA (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned 1 [0037.774] CreateFileA (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.SKYSTARS" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0037.776] WriteFile (in: hFile=0xd4, lpBuffer=0x2d70028*, nNumberOfBytesToWrite=0x385e08, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2d70028*, lpNumberOfBytesWritten=0x18fe18*=0x385e08, lpOverlapped=0x0) returned 1 [0037.947] CloseHandle (hObject=0xd4) returned 1 [0038.053] CreateFileA (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.054] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x3b27a4 [0038.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3b27ac) returned 0x2650020 [0038.055] ReadFile (in: hFile=0xd4, lpBuffer=0x2650028, nNumberOfBytesToRead=0x3b27a4, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe30*=0x3b27a4, lpOverlapped=0x0) returned 1 [0038.145] CloseHandle (hObject=0xd4) returned 1 [0038.145] DeleteFileA (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0038.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0038.145] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0038.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0038.145] GetTickCount () returned 0x1a340 [0038.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0038.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0038.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0038.146] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107328\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107328\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0038.146] MoveFileA (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107328\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107328\\....\\temporaryfile")) returned 0 [0038.147] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107328\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107328\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107328\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107328\\temporaryfile")) returned 1 [0038.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107328\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bc9f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bc9f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bc9f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0038.148] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bc9f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bc9f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bc9f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.148] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bc9f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bc9f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bc9f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0038.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107328\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bc9f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bc9f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bc9f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0038.148] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bc9f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bc9f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bc9f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.148] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bc9f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bc9f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bc9f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.148] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0038.148] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107328\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107328\\temporaryfile")) returned 1 [0038.149] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bc9f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bc9f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bc9f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0038.149] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0038.149] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107328" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107328")) returned 1 [0038.149] PathFileExistsA (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned 1 [0038.285] CreateFileA (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.SKYSTARS" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.285] WriteFile (in: hFile=0xd4, lpBuffer=0x2dd0028*, nNumberOfBytesToWrite=0x3b27a8, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2dd0028*, lpNumberOfBytesWritten=0x18fe18*=0x3b27a8, lpOverlapped=0x0) returned 1 [0038.351] CloseHandle (hObject=0xd4) returned 1 [0038.453] CreateFileA (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.454] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x1e46e4 [0038.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e46ec) returned 0x2650020 [0038.454] ReadFile (in: hFile=0xd4, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1e46e4, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe30*=0x1e46e4, lpOverlapped=0x0) returned 1 [0038.497] CloseHandle (hObject=0xd4) returned 1 [0038.497] DeleteFileA (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0038.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0038.497] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0038.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0038.497] GetTickCount () returned 0x1a497 [0038.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0038.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0038.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0038.498] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107671\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107671\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0038.498] MoveFileA (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107671\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107671\\....\\temporaryfile")) returned 0 [0038.498] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107671\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107671\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107671\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107671\\temporaryfile")) returned 1 [0038.500] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107671\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bfe52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bfe52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bfe52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0038.500] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bfe52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bfe52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bfe52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.500] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bfe52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bfe52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bfe52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0038.500] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107671\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bfe52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bfe52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bfe52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0038.500] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bfe52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bfe52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bfe52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.500] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bfe52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bfe52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bfe52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.500] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0038.500] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107671\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107671\\temporaryfile")) returned 1 [0038.501] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1bfe52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1bfe52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1bfe52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0038.501] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0038.501] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107671" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107671")) returned 1 [0038.501] PathFileExistsA (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 1 [0038.570] CreateFileA (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.SKYSTARS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.571] WriteFile (in: hFile=0xd4, lpBuffer=0x2a30028*, nNumberOfBytesToWrite=0x1e46e8, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2a30028*, lpNumberOfBytesWritten=0x18fe18*=0x1e46e8, lpOverlapped=0x0) returned 1 [0038.611] CloseHandle (hObject=0xd4) returned 1 [0038.647] CreateFileA (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.647] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x242f20 [0038.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x242f28) returned 0x2650020 [0038.648] ReadFile (in: hFile=0xd4, lpBuffer=0x2650028, nNumberOfBytesToRead=0x242f20, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe30*=0x242f20, lpOverlapped=0x0) returned 1 [0038.705] CloseHandle (hObject=0xd4) returned 1 [0038.705] DeleteFileA (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0038.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0038.705] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0038.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0038.705] GetTickCount () returned 0x1a562 [0038.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0038.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0038.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0038.706] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107874\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107874\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0038.706] MoveFileA (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107874\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107874\\....\\temporaryfile")) returned 0 [0038.706] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107874\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107874\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107874\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107874\\temporaryfile")) returned 1 [0038.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107874\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1d44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c1fa600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c1fa600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0038.708] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1d44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c1fa600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c1fa600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.708] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1d44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c1d44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c1d44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0038.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107874\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1d44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c1d44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c1d44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0038.708] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1d44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c1d44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c1d44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.708] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1d44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c1d44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c1d44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.708] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0038.708] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107874\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107874\\temporaryfile")) returned 1 [0038.709] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1d44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c1d44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c1d44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0038.709] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0038.709] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18107874" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18107874")) returned 1 [0038.709] PathFileExistsA (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned 1 [0038.792] CreateFileA (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.SKYSTARS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.792] WriteFile (in: hFile=0xd4, lpBuffer=0x2af0028*, nNumberOfBytesToWrite=0x242f28, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2af0028*, lpNumberOfBytesWritten=0x18fe18*=0x242f28, lpOverlapped=0x0) returned 1 [0038.841] CloseHandle (hObject=0xd4) returned 1 [0038.900] CreateFileA (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.900] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xb95c [0038.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb964) returned 0x2a0a70 [0038.900] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xb95c, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0xb95c, lpOverlapped=0x0) returned 1 [0038.902] CloseHandle (hObject=0xd4) returned 1 [0038.902] DeleteFileA (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0 [0038.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0038.903] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0038.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0038.903] GetTickCount () returned 0x1a62d [0038.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0038.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0038.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0038.903] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108077\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108077\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0038.904] MoveFileA (lpExistingFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108077\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108077\\....\\temporaryfile")) returned 0 [0038.904] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108077\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108077\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108077\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108077\\temporaryfile")) returned 1 [0038.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108077\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3c3680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3c3680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3c3680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0038.905] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3c3680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3c3680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3c3680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.905] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3c3680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3c3680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3c3680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0038.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108077\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3c3680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3c3680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3c3680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0038.905] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3c3680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3c3680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3c3680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.906] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3c3680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3c3680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3c3680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.906] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0038.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108077\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108077\\temporaryfile")) returned 1 [0038.906] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3c3680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3c3680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3c3680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0038.906] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0038.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108077" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108077")) returned 1 [0038.906] PathFileExistsA (pszPath="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 1 [0038.907] CreateFileA (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.SKYSTARS" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.907] WriteFile (in: hFile=0xd4, lpBuffer=0x2ac3e8*, nNumberOfBytesToWrite=0xb960, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2ac3e8*, lpNumberOfBytesWritten=0x18fe18*=0xb960, lpOverlapped=0x0) returned 1 [0038.909] CloseHandle (hObject=0xd4) returned 1 [0038.910] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.910] FindFirstFileA (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c3c3680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3c3680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0038.910] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.910] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.911] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0038.911] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0038.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0038.911] CreateFileA (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.911] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x16c40 [0038.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16c48) returned 0x2a0a70 [0038.912] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x16c40, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x16c40, lpOverlapped=0x0) returned 1 [0038.915] CloseHandle (hObject=0xd4) returned 1 [0038.915] DeleteFileA (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0 [0038.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0038.915] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0038.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0038.915] GetTickCount () returned 0x1a63d [0038.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0038.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0038.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0038.916] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108093\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108093\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0038.916] MoveFileA (lpExistingFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108093\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108093\\....\\temporaryfile")) returned 0 [0038.916] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108093\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108093\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108093\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108093\\temporaryfile")) returned 1 [0038.917] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108093\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3e97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3e97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3e97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0038.917] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3e97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3e97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3e97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.917] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3e97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3e97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3e97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0038.917] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108093\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3e97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3e97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3e97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0038.918] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3e97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3e97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3e97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.918] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3e97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3e97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3e97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.918] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0038.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108093\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108093\\temporaryfile")) returned 1 [0038.918] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c3e97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c3e97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3e97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0038.918] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0038.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108093" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108093")) returned 1 [0038.918] PathFileExistsA (pszPath="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 1 [0038.920] CreateFileA (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.920] WriteFile (in: hFile=0xd4, lpBuffer=0x2b76c8*, nNumberOfBytesToWrite=0x16c48, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b76c8*, lpNumberOfBytesWritten=0x18fe18*=0x16c48, lpOverlapped=0x0) returned 1 [0038.922] CloseHandle (hObject=0xd4) returned 1 [0038.924] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.924] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c3e97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c3e97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0038.924] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.924] FindFirstFileA (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.924] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0038.924] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0038.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0038.924] CreateFileA (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.925] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x16240 [0038.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16248) returned 0x2a0a70 [0038.925] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x16240, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x16240, lpOverlapped=0x0) returned 1 [0038.927] CloseHandle (hObject=0xd4) returned 1 [0038.927] DeleteFileA (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0 [0038.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0038.927] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0038.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0038.927] GetTickCount () returned 0x1a64c [0038.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0038.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0038.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0038.927] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0038.928] MoveFileA (lpExistingFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108\\....\\temporaryfile")) returned 0 [0038.928] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108\\temporaryfile")) returned 1 [0038.929] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0038.929] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.929] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0038.929] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0038.929] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.929] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.930] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0038.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108\\temporaryfile")) returned 1 [0038.930] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0038.930] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0038.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108")) returned 1 [0038.930] PathFileExistsA (pszPath="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 1 [0038.932] CreateFileA (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.932] WriteFile (in: hFile=0xd4, lpBuffer=0x2b6cc8*, nNumberOfBytesToWrite=0x16248, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b6cc8*, lpNumberOfBytesWritten=0x18fe18*=0x16248, lpOverlapped=0x0) returned 1 [0038.934] CloseHandle (hObject=0xd4) returned 1 [0038.935] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.935] FindFirstFileA (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0038.935] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.935] FindFirstFileA (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.936] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0038.936] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xac061300, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0038.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0038.936] CreateFileA (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.936] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x16250 [0038.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16258) returned 0x2a0a70 [0038.937] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x16250, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x16250, lpOverlapped=0x0) returned 1 [0038.938] CloseHandle (hObject=0xd4) returned 1 [0038.938] DeleteFileA (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0 [0038.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0038.938] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0038.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0038.938] GetTickCount () returned 0x1a64c [0038.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0038.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0038.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0038.939] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0038.939] MoveFileA (lpExistingFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108\\....\\temporaryfile")) returned 0 [0038.939] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108\\temporaryfile")) returned 1 [0038.947] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c435aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c435aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0038.947] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c435aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c435aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.947] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0038.947] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0038.947] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.947] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.947] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0038.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108\\temporaryfile")) returned 1 [0038.947] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c40f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c40f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c40f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0038.947] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0038.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108108" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108108")) returned 1 [0038.948] PathFileExistsA (pszPath="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 1 [0038.949] CreateFileA (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.949] WriteFile (in: hFile=0xd4, lpBuffer=0x2b6cd8*, nNumberOfBytesToWrite=0x16258, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b6cd8*, lpNumberOfBytesWritten=0x18fe18*=0x16258, lpOverlapped=0x0) returned 1 [0038.951] CloseHandle (hObject=0xd4) returned 1 [0038.952] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.952] FindFirstFileA (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c435aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c435aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0038.953] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.953] FindFirstFileA (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac087460, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.953] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac087460, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0038.953] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xac087460, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0038.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0038.953] CreateFileA (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.953] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x12a40 [0038.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12a48) returned 0x2a0a70 [0038.953] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x12a40, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x12a40, lpOverlapped=0x0) returned 1 [0038.955] CloseHandle (hObject=0xd4) returned 1 [0038.955] DeleteFileA (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0 [0038.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0038.955] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0038.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0038.955] GetTickCount () returned 0x1a65c [0038.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0038.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0038.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0038.956] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108124\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108124\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0038.956] MoveFileA (lpExistingFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108124\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108124\\....\\temporaryfile")) returned 0 [0038.956] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108124\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108124\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108124\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108124\\temporaryfile")) returned 1 [0038.957] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108124\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c435aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c45bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c45bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0038.958] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c435aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c45bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c45bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.958] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c435aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c435aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c435aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0038.958] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108124\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c435aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c435aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c435aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0038.958] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c435aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c435aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c435aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.958] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c435aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c435aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c435aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.958] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0038.958] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108124\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108124\\temporaryfile")) returned 1 [0038.958] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c435aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c435aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c435aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0038.958] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0038.958] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108124" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108124")) returned 1 [0038.958] PathFileExistsA (pszPath="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 1 [0038.960] CreateFileA (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.960] WriteFile (in: hFile=0xd4, lpBuffer=0x2b34c8*, nNumberOfBytesToWrite=0x12a48, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b34c8*, lpNumberOfBytesWritten=0x18fe18*=0x12a48, lpOverlapped=0x0) returned 1 [0038.962] CloseHandle (hObject=0xd4) returned 1 [0038.963] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.963] FindFirstFileA (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c45bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c45bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0038.963] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.963] FindFirstFileA (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac087460, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.963] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac087460, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0038.963] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xac087460, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0038.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0038.964] CreateFileA (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.964] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x12650 [0038.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12658) returned 0x2a0a70 [0038.964] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x12650, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x12650, lpOverlapped=0x0) returned 1 [0038.965] CloseHandle (hObject=0xd4) returned 1 [0038.965] DeleteFileA (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0 [0038.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0038.966] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0038.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0038.966] GetTickCount () returned 0x1a66b [0038.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0038.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0038.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0038.967] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108139\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108139\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0038.967] MoveFileA (lpExistingFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108139\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108139\\....\\temporaryfile")) returned 0 [0038.967] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108139\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108139\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108139\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108139\\temporaryfile")) returned 1 [0038.968] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108139\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c45bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c45bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c45bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0038.969] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c45bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c45bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c45bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.969] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c45bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c45bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c45bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0038.969] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108139\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c45bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c45bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c45bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0038.969] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c45bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c45bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c45bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.969] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c45bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c45bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c45bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.969] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0038.969] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108139\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108139\\temporaryfile")) returned 1 [0038.969] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c45bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c45bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c45bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0038.969] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0038.969] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108139" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108139")) returned 1 [0038.969] PathFileExistsA (pszPath="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 1 [0038.971] CreateFileA (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.971] WriteFile (in: hFile=0xd4, lpBuffer=0x2b30d8*, nNumberOfBytesToWrite=0x12658, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b30d8*, lpNumberOfBytesWritten=0x18fe18*=0x12658, lpOverlapped=0x0) returned 1 [0038.973] CloseHandle (hObject=0xd4) returned 1 [0038.974] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.974] FindFirstFileA (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c45bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c45bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0038.974] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.974] FindFirstFileA (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac087460, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.975] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac087460, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0038.975] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xac087460, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0038.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0038.975] CreateFileA (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.976] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x15850 [0038.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15858) returned 0x2a0a70 [0038.976] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x15850, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x15850, lpOverlapped=0x0) returned 1 [0038.980] CloseHandle (hObject=0xd4) returned 1 [0038.980] DeleteFileA (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0 [0038.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0038.980] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0038.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0038.980] GetTickCount () returned 0x1a67b [0038.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0038.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0038.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0038.980] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108155\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108155\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0038.981] MoveFileA (lpExistingFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108155\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108155\\....\\temporaryfile")) returned 0 [0038.981] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108155\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108155\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108155\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108155\\temporaryfile")) returned 1 [0038.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108155\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c481d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c481d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c481d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0038.982] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c481d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c481d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c481d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.982] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c481d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c481d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c481d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0038.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108155\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c481d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c481d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c481d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0038.982] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c481d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c481d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c481d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.982] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c481d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c481d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c481d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0038.982] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0038.982] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108155\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108155\\temporaryfile")) returned 1 [0038.983] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c481d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c481d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c481d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0038.983] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0038.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108155" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108155")) returned 1 [0038.983] PathFileExistsA (pszPath="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 1 [0038.984] CreateFileA (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.985] WriteFile (in: hFile=0xd4, lpBuffer=0x2b62d8*, nNumberOfBytesToWrite=0x15858, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b62d8*, lpNumberOfBytesWritten=0x18fe18*=0x15858, lpOverlapped=0x0) returned 1 [0038.997] CloseHandle (hObject=0xd4) returned 1 [0038.998] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.998] FindFirstFileA (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c481d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c481d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0038.998] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0038.999] FindFirstFileA (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0ad5c0, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0038.999] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0ad5c0, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0038.999] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xac0ad5c0, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0038.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0038.999] CreateFileA (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0038.999] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x16250 [0038.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16258) returned 0x2a0a70 [0038.999] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x16250, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x16250, lpOverlapped=0x0) returned 1 [0039.001] CloseHandle (hObject=0xd4) returned 1 [0039.001] DeleteFileA (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0 [0039.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0039.001] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0039.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0039.001] GetTickCount () returned 0x1a68b [0039.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0039.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0039.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0039.002] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108171\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108171\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0039.003] MoveFileA (lpExistingFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108171\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108171\\....\\temporaryfile")) returned 0 [0039.003] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108171\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108171\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108171\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108171\\temporaryfile")) returned 1 [0039.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108171\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4a7ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4ce020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4ce020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.004] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4a7ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4ce020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4ce020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.004] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4a7ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4a7ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4a7ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0039.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108171\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4a7ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4a7ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4a7ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0039.004] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4a7ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4a7ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4a7ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.004] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4a7ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4a7ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4a7ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.004] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0039.004] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108171\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108171\\temporaryfile")) returned 1 [0039.004] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4a7ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4a7ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4a7ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0039.005] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0039.005] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108171" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108171")) returned 1 [0039.005] PathFileExistsA (pszPath="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 1 [0039.006] CreateFileA (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.006] WriteFile (in: hFile=0xd4, lpBuffer=0x2b6cd8*, nNumberOfBytesToWrite=0x16258, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b6cd8*, lpNumberOfBytesWritten=0x18fe18*=0x16258, lpOverlapped=0x0) returned 1 [0039.008] CloseHandle (hObject=0xd4) returned 1 [0039.010] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.010] FindFirstFileA (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c4ce020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4ce020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0039.010] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.010] FindFirstFileA (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0ad5c0, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.010] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0ad5c0, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0039.010] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xac0ad5c0, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0039.010] CreateFileA (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.011] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x16250 [0039.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16258) returned 0x2a0a70 [0039.011] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x16250, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x16250, lpOverlapped=0x0) returned 1 [0039.013] CloseHandle (hObject=0xd4) returned 1 [0039.013] DeleteFileA (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0 [0039.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0039.013] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0039.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0039.013] GetTickCount () returned 0x1a69a [0039.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0039.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0039.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0039.014] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108186\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108186\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0039.014] MoveFileA (lpExistingFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108186\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108186\\....\\temporaryfile")) returned 0 [0039.014] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108186\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108186\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108186\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108186\\temporaryfile")) returned 1 [0039.015] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108186\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4ce020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4ce020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4ce020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.015] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4ce020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4ce020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4ce020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.015] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4ce020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4ce020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4ce020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0039.015] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108186\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4ce020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4ce020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4ce020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0039.016] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4ce020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4ce020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4ce020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.016] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4ce020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4ce020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4ce020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.016] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0039.016] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108186\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108186\\temporaryfile")) returned 1 [0039.016] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4ce020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4ce020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4ce020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0039.016] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0039.016] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108186" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108186")) returned 1 [0039.016] PathFileExistsA (pszPath="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 1 [0039.018] CreateFileA (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.018] WriteFile (in: hFile=0xd4, lpBuffer=0x2b6cd8*, nNumberOfBytesToWrite=0x16258, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b6cd8*, lpNumberOfBytesWritten=0x18fe18*=0x16258, lpOverlapped=0x0) returned 1 [0039.020] CloseHandle (hObject=0xd4) returned 1 [0039.022] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.022] FindFirstFileA (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c4ce020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4ce020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0039.022] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.022] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0ad5c0, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.022] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0ad5c0, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0039.022] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xac0ad5c0, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0039.022] CreateFileA (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.022] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x16040 [0039.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16048) returned 0x2a0a70 [0039.023] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x16040, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x16040, lpOverlapped=0x0) returned 1 [0039.024] CloseHandle (hObject=0xd4) returned 1 [0039.024] DeleteFileA (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0 [0039.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0039.024] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0039.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0039.024] GetTickCount () returned 0x1a6aa [0039.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0039.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0039.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0039.025] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108202\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108202\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0039.025] MoveFileA (lpExistingFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108202\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108202\\....\\temporaryfile")) returned 0 [0039.025] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108202\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108202\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108202\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108202\\temporaryfile")) returned 1 [0039.026] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108202\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4f4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4f4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4f4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.026] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4f4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4f4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4f4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.026] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4f4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4f4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4f4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0039.026] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108202\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4f4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4f4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4f4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0039.027] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4f4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4f4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4f4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.027] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4f4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4f4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4f4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.027] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0039.027] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108202\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108202\\temporaryfile")) returned 1 [0039.027] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c4f4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c4f4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4f4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0039.027] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0039.027] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108202" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108202")) returned 1 [0039.027] PathFileExistsA (pszPath="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 1 [0039.029] CreateFileA (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.029] WriteFile (in: hFile=0xd4, lpBuffer=0x2b6ac8*, nNumberOfBytesToWrite=0x16048, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b6ac8*, lpNumberOfBytesWritten=0x18fe18*=0x16048, lpOverlapped=0x0) returned 1 [0039.031] CloseHandle (hObject=0xd4) returned 1 [0039.032] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.032] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c4f4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c4f4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0039.032] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.032] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.033] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0039.033] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0039.033] CreateFileA (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.034] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x15e40 [0039.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15e48) returned 0x2a0a70 [0039.034] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x15e40, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x15e40, lpOverlapped=0x0) returned 1 [0039.035] CloseHandle (hObject=0xd4) returned 1 [0039.035] DeleteFileA (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0 [0039.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0039.036] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0039.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0039.036] GetTickCount () returned 0x1a6b9 [0039.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0039.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0039.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0039.036] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0039.037] MoveFileA (lpExistingFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217\\....\\temporaryfile")) returned 0 [0039.037] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217\\temporaryfile")) returned 1 [0039.038] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.038] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.038] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0039.038] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0039.038] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.038] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.038] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0039.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217\\temporaryfile")) returned 1 [0039.038] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0039.038] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0039.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217")) returned 1 [0039.039] PathFileExistsA (pszPath="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 1 [0039.040] CreateFileA (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.040] WriteFile (in: hFile=0xd4, lpBuffer=0x2b68c8*, nNumberOfBytesToWrite=0x15e48, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b68c8*, lpNumberOfBytesWritten=0x18fe18*=0x15e48, lpOverlapped=0x0) returned 1 [0039.042] CloseHandle (hObject=0xd4) returned 1 [0039.044] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.044] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0039.044] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.044] FindFirstFileA (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.044] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0039.044] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0039.044] CreateFileA (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.044] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x16050 [0039.045] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16058) returned 0x2a0a70 [0039.045] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x16050, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x16050, lpOverlapped=0x0) returned 1 [0039.046] CloseHandle (hObject=0xd4) returned 1 [0039.046] DeleteFileA (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0 [0039.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0039.046] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0039.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0039.046] GetTickCount () returned 0x1a6b9 [0039.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0039.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0039.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0039.047] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0039.048] MoveFileA (lpExistingFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217\\....\\temporaryfile")) returned 0 [0039.048] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217\\temporaryfile")) returned 1 [0039.049] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.049] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.049] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0039.049] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0039.049] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.049] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.049] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0039.049] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217\\temporaryfile")) returned 1 [0039.049] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c51a2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c51a2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c51a2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0039.049] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0039.049] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108217" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108217")) returned 1 [0039.050] PathFileExistsA (pszPath="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 1 [0039.051] CreateFileA (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.052] WriteFile (in: hFile=0xd4, lpBuffer=0x2b6ad8*, nNumberOfBytesToWrite=0x16058, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b6ad8*, lpNumberOfBytesWritten=0x18fe18*=0x16058, lpOverlapped=0x0) returned 1 [0039.054] CloseHandle (hObject=0xd4) returned 1 [0039.055] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.055] FindFirstFileA (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c540440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c540440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0039.055] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.055] FindFirstFileA (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.056] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0039.056] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0039.056] CreateFileA (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.057] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x15640 [0039.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15648) returned 0x2a0a70 [0039.057] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x15640, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x15640, lpOverlapped=0x0) returned 1 [0039.058] CloseHandle (hObject=0xd4) returned 1 [0039.058] DeleteFileA (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0 [0039.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0039.058] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0039.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0039.058] GetTickCount () returned 0x1a6c9 [0039.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0039.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0039.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0039.059] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108233\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108233\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0039.059] MoveFileA (lpExistingFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108233\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108233\\....\\temporaryfile")) returned 0 [0039.059] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108233\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108233\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108233\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108233\\temporaryfile")) returned 1 [0039.060] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108233\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c540440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c540440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c540440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.061] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c540440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c540440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c540440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.061] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c540440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c540440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c540440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0039.061] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108233\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c540440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c540440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c540440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0039.061] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c540440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c540440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c540440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.061] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c540440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c540440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c540440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.061] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0039.061] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108233\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108233\\temporaryfile")) returned 1 [0039.061] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c540440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c540440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c540440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0039.061] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0039.061] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108233" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108233")) returned 1 [0039.061] PathFileExistsA (pszPath="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 1 [0039.063] CreateFileA (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.063] WriteFile (in: hFile=0xd4, lpBuffer=0x2b60c8*, nNumberOfBytesToWrite=0x15648, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b60c8*, lpNumberOfBytesWritten=0x18fe18*=0x15648, lpOverlapped=0x0) returned 1 [0039.065] CloseHandle (hObject=0xd4) returned 1 [0039.067] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.067] FindFirstFileA (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c540440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c540440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0039.067] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.067] FindFirstFileA (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.067] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0039.067] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0039.067] CreateFileA (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.068] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x15440 [0039.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15448) returned 0x2a0a70 [0039.068] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x15440, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x15440, lpOverlapped=0x0) returned 1 [0039.069] CloseHandle (hObject=0xd4) returned 1 [0039.069] DeleteFileA (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0 [0039.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0039.069] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0039.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0039.070] GetTickCount () returned 0x1a6d9 [0039.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0039.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0039.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0039.070] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108249\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108249\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0039.070] MoveFileA (lpExistingFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108249\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108249\\....\\temporaryfile")) returned 0 [0039.070] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108249\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108249\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108249\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108249\\temporaryfile")) returned 1 [0039.071] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108249\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5665a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5665a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5665a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.072] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5665a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5665a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5665a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.072] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5665a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5665a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5665a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0039.072] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108249\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5665a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5665a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5665a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0039.072] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5665a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5665a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5665a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.072] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5665a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5665a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5665a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.072] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0039.072] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108249\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108249\\temporaryfile")) returned 1 [0039.072] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5665a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5665a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5665a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0039.072] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0039.072] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108249" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108249")) returned 1 [0039.072] PathFileExistsA (pszPath="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 1 [0039.074] CreateFileA (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.074] WriteFile (in: hFile=0xd4, lpBuffer=0x2b5ec8*, nNumberOfBytesToWrite=0x15448, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b5ec8*, lpNumberOfBytesWritten=0x18fe18*=0x15448, lpOverlapped=0x0) returned 1 [0039.076] CloseHandle (hObject=0xd4) returned 1 [0039.078] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.078] FindFirstFileA (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c5665a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5665a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0039.078] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.078] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.078] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0039.078] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xac0d3720, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0039.078] CreateFileA (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.079] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x11440 [0039.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11448) returned 0x2a0a70 [0039.079] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x11440, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x11440, lpOverlapped=0x0) returned 1 [0039.081] CloseHandle (hObject=0xd4) returned 1 [0039.081] DeleteFileA (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0 [0039.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0039.081] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0039.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0039.081] GetTickCount () returned 0x1a6e8 [0039.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0039.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0039.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0039.082] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0039.082] MoveFileA (lpExistingFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264\\....\\temporaryfile")) returned 0 [0039.082] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264\\temporaryfile")) returned 1 [0039.083] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.083] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.083] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0039.083] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0039.084] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.084] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.084] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0039.084] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264\\temporaryfile")) returned 1 [0039.084] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0039.084] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0039.084] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264")) returned 1 [0039.084] PathFileExistsA (pszPath="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 1 [0039.085] CreateFileA (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.086] WriteFile (in: hFile=0xd4, lpBuffer=0x2b1ec8*, nNumberOfBytesToWrite=0x11448, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b1ec8*, lpNumberOfBytesWritten=0x18fe18*=0x11448, lpOverlapped=0x0) returned 1 [0039.087] CloseHandle (hObject=0xd4) returned 1 [0039.089] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.089] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0039.089] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.089] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.089] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0039.089] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0039.089] CreateFileA (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.089] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x11250 [0039.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11258) returned 0x2a0a70 [0039.090] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x11250, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x11250, lpOverlapped=0x0) returned 1 [0039.091] CloseHandle (hObject=0xd4) returned 1 [0039.091] DeleteFileA (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0 [0039.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0039.091] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0039.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0039.091] GetTickCount () returned 0x1a6e8 [0039.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0039.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0039.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0039.092] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0039.093] MoveFileA (lpExistingFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264\\....\\temporaryfile")) returned 0 [0039.093] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264\\temporaryfile")) returned 1 [0039.095] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.095] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.095] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0039.095] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0039.095] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.095] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.095] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0039.095] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264\\temporaryfile")) returned 1 [0039.095] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c58c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c58c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c58c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0039.096] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0039.096] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108264" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108264")) returned 1 [0039.096] PathFileExistsA (pszPath="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 1 [0039.098] CreateFileA (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.098] WriteFile (in: hFile=0xd4, lpBuffer=0x2b1cd8*, nNumberOfBytesToWrite=0x11258, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b1cd8*, lpNumberOfBytesWritten=0x18fe18*=0x11258, lpOverlapped=0x0) returned 1 [0039.100] CloseHandle (hObject=0xd4) returned 1 [0039.101] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.101] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c5b2860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5b2860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0039.102] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.102] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.102] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName="..", cAlternateFileName="")) returned 1 [0039.102] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xac0f9880, dwReserved1=0x1d2de32, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0039.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561e0 [0039.102] CreateFileA (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.102] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x11240 [0039.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11248) returned 0x2a0a70 [0039.102] ReadFile (in: hFile=0xd4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x11240, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe30*=0x11240, lpOverlapped=0x0) returned 1 [0039.104] CloseHandle (hObject=0xd4) returned 1 [0039.104] DeleteFileA (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0 [0039.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0039.104] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0039.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0039.104] GetTickCount () returned 0x1a6f8 [0039.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0039.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0039.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0039.105] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108280\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108280\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0039.105] MoveFileA (lpExistingFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108280\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108280\\....\\temporaryfile")) returned 0 [0039.105] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108280\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108280\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108280\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108280\\temporaryfile")) returned 1 [0039.106] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108280\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5b2860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5b2860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5b2860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.106] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5b2860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5b2860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5b2860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.106] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5b2860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5b2860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5b2860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0039.106] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108280\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5b2860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5b2860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5b2860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0039.106] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5b2860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5b2860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5b2860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.106] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5b2860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5b2860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5b2860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.107] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0039.107] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108280\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108280\\temporaryfile")) returned 1 [0039.107] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c5b2860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1c5b2860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5b2860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0039.107] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0039.107] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108280" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108280")) returned 1 [0039.107] PathFileExistsA (pszPath="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 1 [0039.108] CreateFileA (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui.SKYSTARS" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0039.109] WriteFile (in: hFile=0xd4, lpBuffer=0x2b1cc8*, nNumberOfBytesToWrite=0x11248, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b1cc8*, lpNumberOfBytesWritten=0x18fe18*=0x11248, lpOverlapped=0x0) returned 1 [0039.110] CloseHandle (hObject=0xd4) returned 1 [0039.112] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.112] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x1c5b2860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1c5b2860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x42005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0039.112] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0039.112] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0039.112] FindFirstFileA (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd4f5c20, dwReserved1=0x1d305eb, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0039.112] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd4f5c20, dwReserved1=0x1d305eb, cFileName="..", cAlternateFileName="")) returned 1 [0039.112] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd4f5c20, dwReserved1=0x1d305eb, cFileName="..", cAlternateFileName="")) returned 0 [0039.112] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0039.113] FindFirstFileA (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcd4f5c20, dwReserved1=0x1d305eb, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0039.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0039.113] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0039.113] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x289a10, ftCreationTime.dwLowDateTime=0x402419, ftCreationTime.dwHighDateTime=0x17, ftLastAccessTime.dwLowDateTime=0x18fd74, ftLastAccessTime.dwHighDateTime=0x25cda1, ftLastWriteTime.dwLowDateTime=0x41c308, ftLastWriteTime.dwHighDateTime=0x7715e36c, nFileSizeHigh=0x773a5c3e, nFileSizeLow=0x18fe68, dwReserved0=0x2401ac, dwReserved1=0x240000, cFileName="\xf2\x90\x72\x30\x6c\xe3\x15\x77\x05", cAlternateFileName="\x1e")) returned 0xffffffff [0039.113] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x289a10, ftCreationTime.dwLowDateTime=0x402419, ftCreationTime.dwHighDateTime=0x17, ftLastAccessTime.dwLowDateTime=0x18fd74, ftLastAccessTime.dwHighDateTime=0x25cda1, ftLastWriteTime.dwLowDateTime=0x41c308, ftLastWriteTime.dwHighDateTime=0x7715e36c, nFileSizeHigh=0x773a5c3e, nFileSizeLow=0x18fe68, dwReserved0=0x2401ac, dwReserved1=0x240000, cFileName="\xf2\x90\x72\x30\x6c\xe3\x15\x77\x05", cAlternateFileName="\x1e")) returned 0xffffffff [0039.113] FindFirstFileA (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0039.113] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0039.113] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0039.113] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0039.113] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0039.114] FindFirstFileA (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0039.114] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0039.114] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.116] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0039.116] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0039.116] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0039.116] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0039.116] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0039.116] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0039.116] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0039.116] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0039.117] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0039.117] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0039.117] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0039.117] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0039.117] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0039.117] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0039.117] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0039.117] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0039.117] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0039.117] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0039.117] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0039.117] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0039.118] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b42810, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0039.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0039.119] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecdfa490, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0039.119] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xecdfa490, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0039.119] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0xecdfa490, dwReserved1=0x1d301be, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0039.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256198 [0039.119] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0039.120] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x102fcbb [0039.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x102fcc3) returned 0x2650020 [0039.121] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x102fcbb, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x102fcbb, lpOverlapped=0x0) returned 1 [0039.557] CloseHandle (hObject=0xd8) returned 1 [0039.557] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 1 [0039.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0039.560] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0039.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0039.560] GetTickCount () returned 0x1a8bc [0039.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0039.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0039.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0039.561] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108732\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108732\\...."), lpSecurityAttributes=0x256210) returned 1 [0039.561] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108732\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108732\\....\\temporaryfile")) returned 0 [0039.561] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108732\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108732\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108732\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108732\\temporaryfile")) returned 1 [0039.563] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108732\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ca03040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1ca03040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1ca03040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0039.563] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ca03040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1ca03040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1ca03040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0039.563] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ca03040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1ca03040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1ca03040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0039.563] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108732\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ca03040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1ca03040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1ca03040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0039.563] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ca03040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1ca03040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1ca03040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.563] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ca03040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1ca03040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1ca03040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0039.563] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0039.563] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108732\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108732\\temporaryfile")) returned 1 [0039.565] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ca03040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1ca03040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1ca03040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0039.565] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0039.565] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18108732" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18108732")) returned 1 [0039.566] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 0 [0040.239] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0040.241] WriteFile (in: hFile=0xd8, lpBuffer=0x46b0028*, nNumberOfBytesToWrite=0x102fcc0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x46b0028*, lpNumberOfBytesWritten=0x18fdf8*=0x102fcc0, lpOverlapped=0x0) returned 1 [0040.563] CloseHandle (hObject=0xd8) returned 1 [0040.958] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0040.958] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x263e00 [0040.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x263e08) returned 0x2650020 [0040.958] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x263e00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x263e00, lpOverlapped=0x0) returned 1 [0041.019] CloseHandle (hObject=0xd8) returned 1 [0041.019] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 1 [0041.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0041.023] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0041.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0041.023] GetTickCount () returned 0x1ae57 [0041.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0041.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0041.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0041.023] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110167\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110167\\...."), lpSecurityAttributes=0x256198) returned 1 [0041.026] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110167\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110167\\....\\temporaryfile")) returned 0 [0041.026] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110167\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110167\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110167\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110167\\temporaryfile")) returned 1 [0041.028] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110167\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d7b2ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d7b2ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d7b2ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0041.028] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d7b2ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d7b2ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d7b2ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.028] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d7b2ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d7b2ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d7b2ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0041.028] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110167\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d7b2ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d7b2ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d7b2ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0041.028] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d7b2ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d7b2ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d7b2ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.028] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d7b2ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d7b2ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d7b2ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0041.028] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0041.028] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110167\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110167\\temporaryfile")) returned 1 [0041.028] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d7b2ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d7b2ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d7b2ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0041.028] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0041.028] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110167" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110167")) returned 1 [0041.029] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 0 [0041.117] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0041.118] WriteFile (in: hFile=0xd8, lpBuffer=0x2b30028*, nNumberOfBytesToWrite=0x263e08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b30028*, lpNumberOfBytesWritten=0x18fdf8*=0x263e08, lpOverlapped=0x0) returned 1 [0041.160] CloseHandle (hObject=0xd8) returned 1 [0041.221] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0041.222] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x61d [0041.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x625) returned 0x259e70 [0041.222] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x61d, lpOverlapped=0x0) returned 1 [0041.223] CloseHandle (hObject=0xd8) returned 1 [0041.223] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0041.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0041.224] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0041.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0041.224] GetTickCount () returned 0x1af22 [0041.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0041.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0041.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0041.225] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370\\...."), lpSecurityAttributes=0x256210) returned 1 [0041.225] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370\\....\\temporaryfile")) returned 0 [0041.225] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370\\temporaryfile")) returned 1 [0041.227] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9a20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9a20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9a20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0041.227] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9a20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9a20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9a20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.227] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9a20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9a20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9a20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0041.227] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9a20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9a20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9a20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0041.227] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9a20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9a20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9a20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.227] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9a20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9a20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9a20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0041.227] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0041.227] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370\\temporaryfile")) returned 1 [0041.228] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9a20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9a20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9a20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0041.228] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0041.228] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370")) returned 1 [0041.228] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 0 [0041.228] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0041.228] WriteFile (in: hFile=0xd8, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x628, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdf8*=0x628, lpOverlapped=0x0) returned 1 [0041.229] CloseHandle (hObject=0xd8) returned 1 [0041.230] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0041.231] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x8f8 [0041.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x900) returned 0x2350048 [0041.231] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x8f8, lpOverlapped=0x0) returned 1 [0041.232] CloseHandle (hObject=0xd8) returned 1 [0041.232] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0041.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0041.233] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0041.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0041.233] GetTickCount () returned 0x1af22 [0041.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0041.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0041.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0041.234] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370\\...."), lpSecurityAttributes=0x256198) returned 1 [0041.234] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370\\....\\temporaryfile")) returned 0 [0041.235] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370\\temporaryfile")) returned 1 [0041.236] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9a20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9c8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9c8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0041.236] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9a20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9c8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9c8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.236] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9c8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9c8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9c8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0041.236] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9c8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9c8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9c8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0041.236] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9c8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9c8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9c8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.236] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9c8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9c8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9c8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0041.236] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0041.236] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370\\temporaryfile")) returned 1 [0041.236] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d9c8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1d9c8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9c8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0041.236] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0041.237] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110370" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110370")) returned 1 [0041.237] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0041.237] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0041.237] WriteFile (in: hFile=0xd8, lpBuffer=0x25d580*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25d580*, lpNumberOfBytesWritten=0x18fdf8*=0x900, lpOverlapped=0x0) returned 1 [0041.238] CloseHandle (hObject=0xd8) returned 1 [0041.239] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0041.239] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1d9c8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1d9c8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0041.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0041.239] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0041.239] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8729610, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0041.241] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8729610, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0041.241] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0xe8729610, dwReserved1=0x1d301be, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0041.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdf0 [0041.241] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0041.242] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x263400 [0041.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x263408) returned 0x2650020 [0041.242] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x263400, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x263400, lpOverlapped=0x0) returned 1 [0041.301] CloseHandle (hObject=0xd8) returned 1 [0041.301] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 1 [0041.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0041.305] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0041.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0041.305] GetTickCount () returned 0x1af70 [0041.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0041.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0041.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0041.306] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110448\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110448\\...."), lpSecurityAttributes=0x256210) returned 1 [0041.306] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110448\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110448\\....\\temporaryfile")) returned 0 [0041.306] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110448\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110448\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110448\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110448\\temporaryfile")) returned 1 [0041.307] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110448\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1da60780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1da60780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1da60780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0041.307] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1da60780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1da60780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1da60780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0041.307] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1da60780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1da60780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1da60780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0041.307] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110448\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1da60780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1da60780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1da60780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0041.308] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1da60780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1da60780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1da60780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.308] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1da60780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1da60780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1da60780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0041.308] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0041.308] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110448\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110448\\temporaryfile")) returned 1 [0041.308] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1da60780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1da60780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1da60780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0041.308] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0041.308] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110448" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110448")) returned 1 [0041.308] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 0 [0041.398] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0041.399] WriteFile (in: hFile=0xd8, lpBuffer=0x2b30028*, nNumberOfBytesToWrite=0x263408, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b30028*, lpNumberOfBytesWritten=0x18fdf8*=0x263408, lpOverlapped=0x0) returned 1 [0041.542] CloseHandle (hObject=0xd8) returned 1 [0041.603] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0041.603] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x5aa [0041.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b2) returned 0x259e70 [0041.603] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x5aa, lpOverlapped=0x0) returned 1 [0041.605] CloseHandle (hObject=0xd8) returned 1 [0041.605] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0041.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0041.606] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0041.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0041.606] GetTickCount () returned 0x1b099 [0041.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0041.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0041.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0041.607] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110745\\...."), lpSecurityAttributes=0x256210) returned 1 [0041.607] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110745\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110745\\....\\temporaryfile")) returned 0 [0041.607] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110745\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110745\\temporaryfile")) returned 1 [0041.609] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110745\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1dd341a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1dd341a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1dd341a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0041.609] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1dd341a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1dd341a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1dd341a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.609] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1dd341a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1dd341a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1dd341a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0041.609] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110745\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1dd341a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1dd341a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1dd341a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0041.609] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1dd341a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1dd341a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1dd341a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0041.609] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1dd341a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1dd341a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1dd341a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0041.609] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0041.609] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110745\\temporaryfile")) returned 1 [0041.609] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1dd341a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1dd341a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1dd341a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0041.609] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0041.610] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18110745" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18110745")) returned 1 [0041.610] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 0 [0041.610] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0041.610] WriteFile (in: hFile=0xd8, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdf8*=0x5b0, lpOverlapped=0x0) returned 1 [0041.611] CloseHandle (hObject=0xd8) returned 1 [0041.612] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0041.617] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x431a290 [0041.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x431a298) returned 0x2650020 [0041.619] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x431a290, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x431a290, lpOverlapped=0x0) returned 1 [0043.670] CloseHandle (hObject=0xd8) returned 1 [0043.671] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 1 [0043.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0043.677] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0043.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0043.677] GetTickCount () returned 0x1b8b3 [0043.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0043.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0043.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0043.678] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18112819\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18112819\\...."), lpSecurityAttributes=0x256198) returned 1 [0043.678] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18112819\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18112819\\....\\temporaryfile")) returned 0 [0043.678] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18112819\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18112819\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18112819\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18112819\\temporaryfile")) returned 1 [0043.680] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18112819\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1f0fd880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1f0fd880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1f0fd880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0043.680] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1f0fd880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1f0fd880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1f0fd880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.680] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1f0fd880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1f0fd880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1f0fd880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0043.680] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18112819\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1f0fd880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1f0fd880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1f0fd880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0043.680] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1f0fd880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1f0fd880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1f0fd880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.680] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1f0fd880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1f0fd880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1f0fd880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0043.680] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0043.680] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18112819\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18112819\\temporaryfile")) returned 1 [0043.680] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1f0fd880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x1f0fd880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1f0fd880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0043.681] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0043.681] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18112819" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18112819")) returned 1 [0043.681] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 0 [0046.221] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0046.221] WriteFile (in: hFile=0xd8, lpBuffer=0xac90028*, nNumberOfBytesToWrite=0x431a298, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0xac90028*, lpNumberOfBytesWritten=0x18fdf8*=0x431a298, lpOverlapped=0x0) returned 1 [0047.745] CloseHandle (hObject=0xd8) returned 1 [0048.628] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0048.630] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x75e [0048.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x766) returned 0x2350048 [0048.630] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x75e, lpOverlapped=0x0) returned 1 [0048.632] CloseHandle (hObject=0xd8) returned 1 [0048.632] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0048.633] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0048.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0048.633] GetTickCount () returned 0x1cbf5 [0048.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0048.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0048.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0048.637] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117749\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117749\\...."), lpSecurityAttributes=0x256210) returned 1 [0048.638] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117749\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117749\\....\\temporaryfile")) returned 0 [0048.638] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117749\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117749\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117749\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117749\\temporaryfile")) returned 1 [0048.639] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117749\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22000b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22000b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22000b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0048.640] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22000b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22000b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22000b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.640] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22000b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22000b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22000b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0048.640] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117749\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22000b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22000b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22000b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0048.640] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22000b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22000b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22000b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.640] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22000b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22000b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22000b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0048.640] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0048.640] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117749\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117749\\temporaryfile")) returned 1 [0048.640] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22000b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22000b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22000b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0048.640] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0048.640] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117749" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117749")) returned 1 [0048.641] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0048.641] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0048.641] WriteFile (in: hFile=0xd8, lpBuffer=0x23507c0*, nNumberOfBytesToWrite=0x768, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x23507c0*, lpNumberOfBytesWritten=0x18fdf8*=0x768, lpOverlapped=0x0) returned 1 [0048.642] CloseHandle (hObject=0xd8) returned 1 [0048.643] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0048.643] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22000b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22000b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0048.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0048.643] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0048.643] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfc3e6570, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0048.646] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfc3e6570, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0048.646] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0xfc3e6570, dwReserved1=0x1d301be, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0048.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11) returned 0x25cdd0 [0048.646] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0048.647] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x265c00 [0048.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x265c08) returned 0x2650020 [0048.647] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x265c00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x265c00, lpOverlapped=0x0) returned 1 [0048.706] CloseHandle (hObject=0xd8) returned 1 [0048.706] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 1 [0048.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0048.710] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0048.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0048.710] GetTickCount () returned 0x1cc43 [0048.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0048.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0048.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0048.711] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117827\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117827\\...."), lpSecurityAttributes=0x256198) returned 1 [0048.711] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117827\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117827\\....\\temporaryfile")) returned 0 [0048.711] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117827\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117827\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117827\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117827\\temporaryfile")) returned 1 [0048.713] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117827\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x220bf1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x220bf1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x220bf1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0048.713] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x220bf1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x220bf1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x220bf1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0048.713] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x220bf1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x220bf1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x220bf1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0048.713] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117827\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x220bf1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x220bf1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x220bf1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0048.713] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x220bf1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x220bf1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x220bf1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.713] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x220bf1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x220bf1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x220bf1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0048.713] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0048.713] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117827\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117827\\temporaryfile")) returned 1 [0048.713] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x220bf1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x220bf1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x220bf1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0048.713] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0048.713] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18117827" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18117827")) returned 1 [0048.714] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 0 [0048.798] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0048.798] WriteFile (in: hFile=0xd8, lpBuffer=0x2b30028*, nNumberOfBytesToWrite=0x265c08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b30028*, lpNumberOfBytesWritten=0x18fdf8*=0x265c08, lpOverlapped=0x0) returned 1 [0048.849] CloseHandle (hObject=0xd8) returned 1 [0048.910] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0048.910] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x5aa [0048.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b2) returned 0x259e70 [0048.910] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x5aa, lpOverlapped=0x0) returned 1 [0048.912] CloseHandle (hObject=0xd8) returned 1 [0048.912] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0048.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0048.913] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0048.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0048.913] GetTickCount () returned 0x1cd0e [0048.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0048.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0048.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0048.914] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118030\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118030\\...."), lpSecurityAttributes=0x256198) returned 1 [0048.914] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118030\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118030\\....\\temporaryfile")) returned 0 [0048.914] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118030\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118030\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118030\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118030\\temporaryfile")) returned 1 [0048.915] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118030\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x222ae3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x222ae3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x222ae3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0048.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x222ae3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x222ae3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x222ae3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x222ae3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x222ae3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x222ae3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0048.916] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118030\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x222ae3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x222ae3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x222ae3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0048.916] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x222ae3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x222ae3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x222ae3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.916] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x222ae3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x222ae3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x222ae3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0048.916] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0048.916] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118030\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118030\\temporaryfile")) returned 1 [0048.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x222ae3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x222ae3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x222ae3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0048.916] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0048.916] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118030" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118030")) returned 1 [0048.917] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 0 [0048.917] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0048.917] WriteFile (in: hFile=0xd8, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdf8*=0x5b0, lpOverlapped=0x0) returned 1 [0048.918] CloseHandle (hObject=0xd8) returned 1 [0048.919] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0048.919] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x97f3f4 [0048.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x97f3fc) returned 0x2650020 [0048.919] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x97f3f4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x97f3f4, lpOverlapped=0x0) returned 1 [0049.159] CloseHandle (hObject=0xd8) returned 1 [0049.160] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 1 [0049.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0049.165] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0049.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0049.165] GetTickCount () returned 0x1ce07 [0049.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0049.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0049.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0049.166] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118279\\...."), lpSecurityAttributes=0x256210) returned 1 [0049.166] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118279\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118279\\....\\temporaryfile")) returned 0 [0049.167] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118279\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118279\\temporaryfile")) returned 1 [0049.169] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118279\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2250f9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2250f9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2250f9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0049.169] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2250f9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2250f9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2250f9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.169] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2250f9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2250f9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2250f9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0049.169] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118279\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2250f9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2250f9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2250f9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0049.170] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2250f9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2250f9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2250f9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.170] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2250f9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2250f9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2250f9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.170] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0049.170] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118279\\temporaryfile")) returned 1 [0049.170] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2250f9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2250f9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2250f9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0049.170] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0049.170] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18118279" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18118279")) returned 1 [0049.170] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 0 [0049.545] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0049.545] WriteFile (in: hFile=0xd8, lpBuffer=0x3950028*, nNumberOfBytesToWrite=0x97f3f8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x3950028*, lpNumberOfBytesWritten=0x18fdf8*=0x97f3f8, lpOverlapped=0x0) returned 1 [0049.716] CloseHandle (hObject=0xd8) returned 1 [0050.020] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0050.020] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x648 [0050.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x650) returned 0x259e70 [0050.020] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x648, lpOverlapped=0x0) returned 1 [0050.022] CloseHandle (hObject=0xd8) returned 1 [0050.022] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0050.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0050.023] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0050.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0050.023] GetTickCount () returned 0x1d142 [0050.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0050.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0050.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0050.023] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119106\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119106\\...."), lpSecurityAttributes=0x256198) returned 1 [0050.024] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119106\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119106\\....\\temporaryfile")) returned 0 [0050.024] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119106\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119106\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119106\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119106\\temporaryfile")) returned 1 [0050.026] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119106\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22cf22a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22cf22a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22cf22a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0050.026] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22cf22a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22cf22a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22cf22a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.026] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22cf22a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22cf22a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22cf22a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0050.026] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119106\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22cf22a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22cf22a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22cf22a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0050.026] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22cf22a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22cf22a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22cf22a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.026] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22cf22a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22cf22a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22cf22a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.026] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0050.026] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119106\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119106\\temporaryfile")) returned 1 [0050.026] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x22cf22a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x22cf22a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22cf22a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0050.026] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0050.026] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119106" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119106")) returned 1 [0050.027] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0050.027] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0050.027] WriteFile (in: hFile=0xd8, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdf8*=0x650, lpOverlapped=0x0) returned 1 [0050.028] CloseHandle (hObject=0xd8) returned 1 [0050.029] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0050.029] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22cf22a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x22cf22a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0050.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0050.029] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0050.029] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee829690, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0050.031] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee829690, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0050.031] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0xee829690, dwReserved1=0x1d301be, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0050.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0050.031] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0050.032] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xe21fcc [0050.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe21fd4) returned 0x2650020 [0050.033] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0xe21fcc, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0xe21fcc, lpOverlapped=0x0) returned 1 [0050.448] CloseHandle (hObject=0xd8) returned 1 [0050.448] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 1 [0050.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0050.451] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0050.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0050.451] GetTickCount () returned 0x1d2e7 [0050.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0050.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0050.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0050.452] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119527\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119527\\...."), lpSecurityAttributes=0x256198) returned 1 [0050.455] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119527\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119527\\....\\temporaryfile")) returned 0 [0050.455] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119527\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119527\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119527\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119527\\temporaryfile")) returned 1 [0050.456] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119527\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x230f67c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2311c920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2311c920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0050.456] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x230f67c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2311c920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2311c920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0050.456] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x230f67c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x230f67c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x230f67c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0050.456] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119527\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x230f67c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x230f67c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x230f67c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0050.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x230f67c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x230f67c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x230f67c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x230f67c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x230f67c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x230f67c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.457] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0050.457] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119527\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119527\\temporaryfile")) returned 1 [0050.457] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x230f67c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x230f67c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x230f67c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0050.457] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0050.457] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18119527" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18119527")) returned 1 [0050.457] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 0 [0051.006] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0051.006] WriteFile (in: hFile=0xd8, lpBuffer=0x42b0028*, nNumberOfBytesToWrite=0xe21fd0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x42b0028*, lpNumberOfBytesWritten=0x18fdf8*=0xe21fd0, lpOverlapped=0x0) returned 1 [0051.461] CloseHandle (hObject=0xd8) returned 1 [0051.933] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0051.934] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2bba00 [0051.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2bba08) returned 0x2650020 [0051.934] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x2bba00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x2bba00, lpOverlapped=0x0) returned 1 [0052.017] CloseHandle (hObject=0xd8) returned 1 [0052.017] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 1 [0052.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0052.023] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0052.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0052.023] GetTickCount () returned 0x1d8f0 [0052.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0052.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0052.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0052.024] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121072\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121072\\...."), lpSecurityAttributes=0x256210) returned 1 [0052.024] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121072\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121072\\....\\temporaryfile")) returned 0 [0052.025] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121072\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121072\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121072\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121072\\temporaryfile")) returned 1 [0052.026] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121072\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23fb0fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x23fb0fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x23fb0fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0052.026] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23fb0fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x23fb0fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x23fb0fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.027] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23fb0fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x23fb0fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x23fb0fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0052.027] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121072\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23fb0fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x23fb0fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x23fb0fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0052.027] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23fb0fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x23fb0fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x23fb0fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.027] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23fb0fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x23fb0fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x23fb0fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.027] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0052.027] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121072\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121072\\temporaryfile")) returned 1 [0052.027] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23fb0fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x23fb0fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x23fb0fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0052.027] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0052.027] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121072" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121072")) returned 1 [0052.028] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 0 [0052.132] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0052.133] WriteFile (in: hFile=0xd8, lpBuffer=0x2bd0028*, nNumberOfBytesToWrite=0x2bba08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2bd0028*, lpNumberOfBytesWritten=0x18fdf8*=0x2bba08, lpOverlapped=0x0) returned 1 [0052.186] CloseHandle (hObject=0xd8) returned 1 [0052.259] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0052.259] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xc72 [0052.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc7a) returned 0x2350048 [0052.260] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0xc72, lpOverlapped=0x0) returned 1 [0052.261] CloseHandle (hObject=0xd8) returned 1 [0052.261] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0052.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0052.262] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0052.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0052.262] GetTickCount () returned 0x1d9da [0052.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0052.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0052.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0052.263] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121306\\...."), lpSecurityAttributes=0x256198) returned 1 [0052.264] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121306\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121306\\....\\temporaryfile")) returned 0 [0052.264] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121306\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121306\\temporaryfile")) returned 1 [0052.265] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121306\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x241ec480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0052.265] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x241ec480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.265] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0052.265] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121306\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0052.266] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.266] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.266] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0052.266] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121306\\temporaryfile")) returned 1 [0052.266] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0052.266] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0052.266] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121306" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121306")) returned 1 [0052.266] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 0 [0052.267] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0052.267] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xc78, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0xc78, lpOverlapped=0x0) returned 1 [0052.268] CloseHandle (hObject=0xd8) returned 1 [0052.269] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0052.270] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x106f [0052.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1077) returned 0x297460 [0052.270] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x106f, lpOverlapped=0x0) returned 1 [0052.272] CloseHandle (hObject=0xd8) returned 1 [0052.272] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0052.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0052.273] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0052.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0052.273] GetTickCount () returned 0x1d9e9 [0052.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0052.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0052.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0052.273] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121321\\...."), lpSecurityAttributes=0x256210) returned 1 [0052.274] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121321\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121321\\....\\temporaryfile")) returned 0 [0052.274] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121321\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121321\\temporaryfile")) returned 1 [0052.275] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121321\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0052.276] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.276] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0052.276] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121321\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0052.276] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.276] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.276] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0052.276] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121321\\temporaryfile")) returned 1 [0052.276] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x242125e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0052.276] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0052.276] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121321" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121321")) returned 1 [0052.276] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0052.277] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0052.277] WriteFile (in: hFile=0xd8, lpBuffer=0x2984e8*, nNumberOfBytesToWrite=0x1078, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2984e8*, lpNumberOfBytesWritten=0x18fdf8*=0x1078, lpOverlapped=0x0) returned 1 [0052.278] CloseHandle (hObject=0xd8) returned 1 [0052.282] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0052.282] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x242125e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x242125e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0052.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0052.283] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0052.283] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfc8a9170, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0052.284] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfc8a9170, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0052.284] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0xfc8a9170, dwReserved1=0x1d301be, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0052.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256198 [0052.284] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0052.284] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x978 [0052.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x980) returned 0x2350048 [0052.284] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x978, lpOverlapped=0x0) returned 1 [0052.285] CloseHandle (hObject=0xd8) returned 1 [0052.286] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0052.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0052.286] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0052.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0052.286] GetTickCount () returned 0x1d9f9 [0052.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0052.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0052.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0052.287] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121337\\...."), lpSecurityAttributes=0x256210) returned 1 [0052.287] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121337\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121337\\....\\temporaryfile")) returned 0 [0052.287] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121337\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121337\\temporaryfile")) returned 1 [0052.289] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121337\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24238740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24238740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24238740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0052.289] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24238740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24238740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24238740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0052.289] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24238740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24238740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24238740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0052.289] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121337\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24238740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24238740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24238740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0052.289] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24238740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24238740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24238740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.289] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24238740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24238740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24238740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.289] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0052.289] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121337\\temporaryfile")) returned 1 [0052.289] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24238740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24238740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24238740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0052.289] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0052.289] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18121337" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18121337")) returned 1 [0052.290] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0052.290] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0052.292] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0x980, lpOverlapped=0x0) returned 1 [0052.292] CloseHandle (hObject=0xd8) returned 1 [0052.293] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0052.293] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x29c6dbd [0052.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x29c6dc5) returned 0x2650020 [0052.295] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x29c6dbd, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x29c6dbd, lpOverlapped=0x0) returned 1 [0053.454] CloseHandle (hObject=0xd8) returned 1 [0053.455] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 1 [0053.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0053.464] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0053.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0053.465] GetTickCount () returned 0x1de9b [0053.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0053.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0053.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0053.465] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18122523\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18122523\\...."), lpSecurityAttributes=0x256198) returned 1 [0053.466] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18122523\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18122523\\....\\temporaryfile")) returned 0 [0053.466] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18122523\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18122523\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18122523\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18122523\\temporaryfile")) returned 1 [0053.467] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18122523\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24d86fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24d86fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24d86fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0053.467] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24d86fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24d86fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24d86fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.467] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24d86fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24d86fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24d86fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0053.467] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18122523\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24d86fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24d86fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24d86fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0053.468] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24d86fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24d86fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24d86fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.468] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24d86fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24d86fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24d86fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.468] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0053.468] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18122523\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18122523\\temporaryfile")) returned 1 [0053.468] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x24d86fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x24d86fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x24d86fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0053.468] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0053.468] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18122523" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18122523")) returned 1 [0053.468] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 0 [0055.036] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0055.037] WriteFile (in: hFile=0xd8, lpBuffer=0x79f0028*, nNumberOfBytesToWrite=0x29c6dc8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x79f0028*, lpNumberOfBytesWritten=0x18fdf8*=0x29c6dc8, lpOverlapped=0x0) returned 1 [0056.266] CloseHandle (hObject=0xd8) returned 1 [0056.961] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0056.961] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x267e00 [0056.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x267e08) returned 0x2650020 [0056.962] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x267e00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x267e00, lpOverlapped=0x0) returned 1 [0057.111] CloseHandle (hObject=0xd8) returned 1 [0057.111] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 1 [0057.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0057.116] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0057.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0057.116] GetTickCount () returned 0x1ecbe [0057.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0057.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0057.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0057.117] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126142\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126142\\...."), lpSecurityAttributes=0x256210) returned 1 [0057.117] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126142\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126142\\....\\temporaryfile")) returned 0 [0057.117] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126142\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126142\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126142\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126142\\temporaryfile")) returned 1 [0057.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126142\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2700aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2700aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2700aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0057.122] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2700aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2700aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2700aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.122] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2700aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2700aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2700aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0057.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126142\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2700aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2700aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2700aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0057.122] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2700aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2700aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2700aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.122] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2700aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2700aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2700aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0057.122] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0057.123] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126142\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126142\\temporaryfile")) returned 1 [0057.123] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2700aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2700aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2700aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0057.123] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0057.123] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126142" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126142")) returned 1 [0057.123] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 0 [0057.263] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0057.264] WriteFile (in: hFile=0xd8, lpBuffer=0x2b30028*, nNumberOfBytesToWrite=0x267e08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b30028*, lpNumberOfBytesWritten=0x18fdf8*=0x267e08, lpOverlapped=0x0) returned 1 [0057.308] CloseHandle (hObject=0xd8) returned 1 [0057.351] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0057.352] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x708 [0057.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x710) returned 0x2350048 [0057.352] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x708, lpOverlapped=0x0) returned 1 [0057.354] CloseHandle (hObject=0xd8) returned 1 [0057.354] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0057.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0057.355] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0057.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0057.355] GetTickCount () returned 0x1eda8 [0057.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0057.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0057.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0057.355] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126376\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126376\\...."), lpSecurityAttributes=0x256198) returned 1 [0057.356] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126376\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126376\\....\\temporaryfile")) returned 0 [0057.356] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126376\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126376\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126376\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126376\\temporaryfile")) returned 1 [0057.360] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126376\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27246360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27246360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27246360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0057.360] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27246360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27246360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27246360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.360] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27246360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27246360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27246360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0057.360] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126376\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27246360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27246360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27246360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0057.360] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27246360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27246360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27246360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.360] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27246360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27246360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27246360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0057.360] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0057.360] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126376\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126376\\temporaryfile")) returned 1 [0057.360] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27246360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27246360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27246360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0057.360] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0057.360] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126376" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126376")) returned 1 [0057.361] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 0 [0057.361] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0057.361] WriteFile (in: hFile=0xd8, lpBuffer=0x2350768*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2350768*, lpNumberOfBytesWritten=0x18fdf8*=0x710, lpOverlapped=0x0) returned 1 [0057.362] CloseHandle (hObject=0xd8) returned 1 [0057.362] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0057.362] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x27246360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27246360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0057.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0057.363] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0057.363] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf00dbad0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0057.365] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf00dbad0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0057.365] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf00dbad0, dwReserved1=0x1d301be, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0057.365] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf00dbad0, dwReserved1=0x1d301be, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0057.365] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf00dbad0, dwReserved1=0x1d301be, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0057.365] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0xf00dbad0, dwReserved1=0x1d301be, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0057.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0057.365] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0057.365] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xd4200 [0057.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd4208) returned 0x2650020 [0057.366] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0xd4200, lpOverlapped=0x0) returned 1 [0057.383] CloseHandle (hObject=0xd8) returned 1 [0057.383] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0057.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0057.390] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0057.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0057.390] GetTickCount () returned 0x1edc7 [0057.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0057.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0057.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0057.390] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126407\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126407\\...."), lpSecurityAttributes=0x256198) returned 1 [0057.391] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126407\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126407\\....\\temporaryfile")) returned 0 [0057.391] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126407\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126407\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126407\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126407\\temporaryfile")) returned 1 [0057.392] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126407\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27292620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27292620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27292620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0057.392] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27292620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27292620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27292620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0057.392] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27292620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27292620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27292620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0057.392] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126407\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27292620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27292620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27292620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0057.392] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27292620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27292620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27292620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.392] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27292620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27292620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27292620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0057.393] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0057.393] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126407\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126407\\temporaryfile")) returned 1 [0057.393] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27292620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27292620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27292620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0057.393] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0057.393] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126407" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126407")) returned 1 [0057.393] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 0 [0057.424] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0057.424] WriteFile (in: hFile=0xd8, lpBuffer=0x2810028*, nNumberOfBytesToWrite=0xd4208, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2810028*, lpNumberOfBytesWritten=0x18fdf8*=0xd4208, lpOverlapped=0x0) returned 1 [0057.437] CloseHandle (hObject=0xd8) returned 1 [0057.444] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0057.445] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x32b [0057.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x333) returned 0x259e70 [0057.445] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x32b, lpOverlapped=0x0) returned 1 [0057.446] CloseHandle (hObject=0xd8) returned 1 [0057.446] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0057.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0057.447] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0057.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0057.447] GetTickCount () returned 0x1ee06 [0057.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0057.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0057.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0057.448] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470\\...."), lpSecurityAttributes=0x256210) returned 1 [0057.448] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470\\....\\temporaryfile")) returned 0 [0057.448] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470\\temporaryfile")) returned 1 [0057.449] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0057.449] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.449] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0057.450] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0057.450] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.450] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0057.450] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0057.450] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470\\temporaryfile")) returned 1 [0057.450] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0057.450] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0057.450] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470")) returned 1 [0057.450] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 0 [0057.451] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0057.451] WriteFile (in: hFile=0xd8, lpBuffer=0x25a1b8*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25a1b8*, lpNumberOfBytesWritten=0x18fdf8*=0x330, lpOverlapped=0x0) returned 1 [0057.452] CloseHandle (hObject=0xd8) returned 1 [0057.452] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0057.452] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x16fc [0057.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1704) returned 0x297460 [0057.452] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x16fc, lpOverlapped=0x0) returned 1 [0057.454] CloseHandle (hObject=0xd8) returned 1 [0057.454] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0057.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0057.455] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0057.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0057.455] GetTickCount () returned 0x1ee06 [0057.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0057.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0057.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0057.455] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470\\...."), lpSecurityAttributes=0x256198) returned 1 [0057.456] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470\\....\\temporaryfile")) returned 0 [0057.456] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470\\temporaryfile")) returned 1 [0057.457] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0057.457] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.457] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0057.457] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0057.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.458] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0057.458] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0057.458] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470\\temporaryfile")) returned 1 [0057.458] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2732aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2732aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2732aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0057.458] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0057.458] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126470" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126470")) returned 1 [0057.458] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0057.459] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0057.459] WriteFile (in: hFile=0xd8, lpBuffer=0x298b78*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x298b78*, lpNumberOfBytesWritten=0x18fdf8*=0x1700, lpOverlapped=0x0) returned 1 [0057.460] CloseHandle (hObject=0xd8) returned 1 [0057.460] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0057.460] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x27350d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27350d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0057.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0057.460] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf01c0310, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0057.461] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf01c0310, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0057.461] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0xf01c0310, dwReserved1=0x1d301be, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0057.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256198 [0057.461] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0057.470] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaf35ed [0057.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaf35f5) returned 0x2650020 [0057.470] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0xaf35ed, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0xaf35ed, lpOverlapped=0x0) returned 1 [0057.760] CloseHandle (hObject=0xdc) returned 1 [0057.760] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 1 [0057.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0057.769] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0057.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0057.769] GetTickCount () returned 0x1ef3e [0057.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0057.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0057.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0057.770] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126782\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126782\\...."), lpSecurityAttributes=0x256228) returned 1 [0057.770] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126782\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126782\\....\\temporaryfile")) returned 0 [0057.770] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126782\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126782\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126782\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126782\\temporaryfile")) returned 1 [0057.772] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126782\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27624720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2764a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2764a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0057.772] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27624720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2764a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2764a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0057.772] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2764a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2764a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2764a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0057.772] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126782\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2764a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2764a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2764a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0057.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2764a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2764a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2764a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2764a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2764a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2764a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0057.772] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0057.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126782\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126782\\temporaryfile")) returned 1 [0057.773] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2764a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2764a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2764a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0057.773] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0057.773] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18126782" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18126782")) returned 1 [0057.773] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 0 [0058.199] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0058.200] WriteFile (in: hFile=0xdc, lpBuffer=0x3c50028*, nNumberOfBytesToWrite=0xaf35f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x3c50028*, lpNumberOfBytesWritten=0x18fdd8*=0xaf35f8, lpOverlapped=0x0) returned 1 [0058.432] CloseHandle (hObject=0xdc) returned 1 [0058.531] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0058.532] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd5c00 [0058.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd5c08) returned 0x2650020 [0058.532] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0xd5c00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0xd5c00, lpOverlapped=0x0) returned 1 [0058.550] CloseHandle (hObject=0xdc) returned 1 [0058.550] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0058.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0058.557] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0058.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0058.557] GetTickCount () returned 0x1f259 [0058.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0058.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0058.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0058.558] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127577\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127577\\...."), lpSecurityAttributes=0x256198) returned 1 [0058.559] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127577\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127577\\....\\temporaryfile")) returned 0 [0058.559] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127577\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127577\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127577\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127577\\temporaryfile")) returned 1 [0058.560] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127577\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27dbad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27dbad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27dbad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0058.560] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27dbad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27dbad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27dbad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.560] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27dbad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27dbad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27dbad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0058.560] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127577\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27dbad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27dbad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27dbad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0058.561] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27dbad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27dbad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27dbad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.561] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27dbad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27dbad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27dbad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0058.561] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0058.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127577\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127577\\temporaryfile")) returned 1 [0058.561] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27dbad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27dbad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27dbad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0058.561] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0058.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127577" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127577")) returned 1 [0058.561] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 0 [0058.597] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0058.598] WriteFile (in: hFile=0xdc, lpBuffer=0x2810028*, nNumberOfBytesToWrite=0xd5c08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2810028*, lpNumberOfBytesWritten=0x18fdd8*=0xd5c08, lpOverlapped=0x0) returned 1 [0058.612] CloseHandle (hObject=0xdc) returned 1 [0058.619] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0058.620] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x543 [0058.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54b) returned 0x259e70 [0058.620] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x543, lpOverlapped=0x0) returned 1 [0058.621] CloseHandle (hObject=0xdc) returned 1 [0058.621] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0058.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0058.622] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0058.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0058.622] GetTickCount () returned 0x1f298 [0058.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0058.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0058.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0058.622] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127640\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127640\\...."), lpSecurityAttributes=0x256228) returned 1 [0058.623] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127640\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127640\\....\\temporaryfile")) returned 0 [0058.623] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127640\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127640\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127640\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127640\\temporaryfile")) returned 1 [0058.624] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127640\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e532c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27e532c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27e532c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0058.624] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e532c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27e532c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27e532c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.625] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e532c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27e532c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27e532c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0058.625] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127640\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e532c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27e532c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27e532c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0058.625] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e532c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27e532c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27e532c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.625] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e532c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27e532c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27e532c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0058.625] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0058.625] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127640\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127640\\temporaryfile")) returned 1 [0058.625] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e532c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x27e532c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27e532c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0058.625] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0058.625] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127640" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127640")) returned 1 [0058.625] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 0 [0058.626] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0058.627] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x548, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x548, lpOverlapped=0x0) returned 1 [0058.628] CloseHandle (hObject=0xdc) returned 1 [0058.631] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0058.631] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x27e532c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x27e532c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0058.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0058.631] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0058.631] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf4d53d90, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0058.631] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf4d53d90, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0058.631] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0xf4d53d90, dwReserved1=0x1d301be, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0058.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256210 [0058.632] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0058.632] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd02aea [0058.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd02af2) returned 0x2650020 [0058.633] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0xd02aea, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0xd02aea, lpOverlapped=0x0) returned 1 [0058.981] CloseHandle (hObject=0xdc) returned 1 [0058.982] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 1 [0058.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0058.984] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0058.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0058.984] GetTickCount () returned 0x1f3fe [0058.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0058.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0058.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0058.984] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127998\\...."), lpSecurityAttributes=0x256228) returned 1 [0058.985] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127998\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127998\\....\\temporaryfile")) returned 0 [0058.985] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127998\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127998\\temporaryfile")) returned 1 [0058.986] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127998\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x281bf260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x281bf260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x281bf260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0058.987] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x281bf260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x281bf260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x281bf260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0058.987] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x281bf260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x281bf260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x281bf260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0058.987] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127998\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x281bf260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x281bf260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x281bf260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0058.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x281bf260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x281bf260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x281bf260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x281bf260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x281bf260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x281bf260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0058.987] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0058.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127998\\temporaryfile")) returned 1 [0058.987] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x281bf260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x281bf260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x281bf260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0058.987] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0058.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18127998" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18127998")) returned 1 [0058.988] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 0 [0059.466] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0059.466] WriteFile (in: hFile=0xdc, lpBuffer=0x4070028*, nNumberOfBytesToWrite=0xd02af0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x4070028*, lpNumberOfBytesWritten=0x18fdd8*=0xd02af0, lpOverlapped=0x0) returned 1 [0059.758] CloseHandle (hObject=0xdc) returned 1 [0059.867] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0059.868] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd7200 [0059.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd7208) returned 0x2650020 [0059.868] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0xd7200, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0xd7200, lpOverlapped=0x0) returned 1 [0059.884] CloseHandle (hObject=0xdc) returned 1 [0059.884] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0059.891] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0059.891] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0059.891] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0059.891] GetTickCount () returned 0x1f797 [0059.891] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0059.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0059.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0059.892] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128919\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128919\\...."), lpSecurityAttributes=0x256210) returned 1 [0059.892] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128919\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128919\\....\\temporaryfile")) returned 0 [0059.893] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128919\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128919\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128919\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128919\\temporaryfile")) returned 1 [0059.894] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128919\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28a86380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28a86380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28a86380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0059.894] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28a86380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28a86380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28a86380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.894] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28a86380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28a86380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28a86380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0059.894] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128919\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28a86380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28a86380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28a86380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0059.894] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28a86380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28a86380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28a86380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.894] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28a86380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28a86380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28a86380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0059.894] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0059.894] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128919\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128919\\temporaryfile")) returned 1 [0059.895] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28a86380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28a86380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28a86380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0059.895] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0059.895] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128919" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128919")) returned 1 [0059.895] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 0 [0059.928] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0059.928] WriteFile (in: hFile=0xdc, lpBuffer=0x2810028*, nNumberOfBytesToWrite=0xd7208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2810028*, lpNumberOfBytesWritten=0x18fdd8*=0xd7208, lpOverlapped=0x0) returned 1 [0059.940] CloseHandle (hObject=0xdc) returned 1 [0059.947] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0059.948] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5b1 [0059.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b9) returned 0x259e70 [0059.948] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5b1, lpOverlapped=0x0) returned 1 [0059.949] CloseHandle (hObject=0xdc) returned 1 [0059.949] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0059.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0059.950] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0059.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0059.950] GetTickCount () returned 0x1f7c6 [0059.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0059.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0059.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0059.951] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128966\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128966\\...."), lpSecurityAttributes=0x256228) returned 1 [0059.951] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128966\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128966\\....\\temporaryfile")) returned 0 [0059.951] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128966\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128966\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128966\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128966\\temporaryfile")) returned 1 [0059.952] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128966\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28af87a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28af87a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28af87a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0059.952] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28af87a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28af87a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28af87a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.952] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28af87a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28af87a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28af87a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0059.952] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128966\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28af87a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28af87a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28af87a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0059.953] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28af87a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28af87a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28af87a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.953] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28af87a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28af87a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28af87a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0059.953] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0059.953] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128966\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128966\\temporaryfile")) returned 1 [0059.953] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28af87a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x28af87a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28af87a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0059.953] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0059.953] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18128966" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18128966")) returned 1 [0059.953] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 0 [0059.953] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0059.956] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x5b8, lpOverlapped=0x0) returned 1 [0059.957] CloseHandle (hObject=0xdc) returned 1 [0059.957] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0059.957] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x28b1e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x28b1e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0059.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0059.957] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0059.957] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf2bda830, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0059.957] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf2bda830, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0059.957] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0xf2bda830, dwReserved1=0x1d301be, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0059.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256198 [0059.958] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0059.958] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1416b54 [0059.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1416b5c) returned 0x2650020 [0059.959] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1416b54, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x1416b54, lpOverlapped=0x0) returned 1 [0060.524] CloseHandle (hObject=0xdc) returned 1 [0060.524] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 1 [0060.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0060.526] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0060.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0060.527] GetTickCount () returned 0x1fa07 [0060.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0060.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0060.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0060.528] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18129543\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18129543\\...."), lpSecurityAttributes=0x256228) returned 1 [0060.528] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18129543\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18129543\\....\\temporaryfile")) returned 0 [0060.528] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18129543\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18129543\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18129543\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18129543\\temporaryfile")) returned 1 [0060.530] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18129543\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29079a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29079a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29079a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0060.530] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29079a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29079a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29079a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0060.530] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29079a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29079a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29079a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0060.530] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18129543\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29079a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29079a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29079a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0060.530] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29079a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29079a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29079a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.530] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29079a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29079a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29079a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0060.530] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0060.530] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18129543\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18129543\\temporaryfile")) returned 1 [0060.530] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29079a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29079a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29079a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0060.530] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0060.530] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18129543" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18129543")) returned 1 [0060.531] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 0 [0061.287] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0061.288] WriteFile (in: hFile=0xdc, lpBuffer=0x4e90028*, nNumberOfBytesToWrite=0x1416b58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x4e90028*, lpNumberOfBytesWritten=0x18fdd8*=0x1416b58, lpOverlapped=0x0) returned 1 [0061.751] CloseHandle (hObject=0xdc) returned 1 [0061.918] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0061.920] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd8400 [0061.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd8408) returned 0x2650020 [0061.920] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0xd8400, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0xd8400, lpOverlapped=0x0) returned 1 [0061.937] CloseHandle (hObject=0xdc) returned 1 [0061.937] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0061.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0061.944] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0061.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0061.944] GetTickCount () returned 0x1ff92 [0061.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0061.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0061.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0061.945] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18130962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18130962\\...."), lpSecurityAttributes=0x256198) returned 1 [0061.945] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18130962\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18130962\\....\\temporaryfile")) returned 0 [0061.945] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18130962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18130962\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18130962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18130962\\temporaryfile")) returned 1 [0061.947] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18130962\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29e037a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29e037a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29e037a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0061.947] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29e037a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29e037a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29e037a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.947] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29e037a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29e037a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29e037a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0061.947] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18130962\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29e037a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29e037a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29e037a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0061.947] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29e037a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29e037a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29e037a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.947] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29e037a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29e037a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29e037a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0061.947] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0061.948] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18130962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18130962\\temporaryfile")) returned 1 [0061.948] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29e037a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29e037a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29e037a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0061.948] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0061.948] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18130962" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18130962")) returned 1 [0061.948] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 0 [0061.979] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0061.980] WriteFile (in: hFile=0xdc, lpBuffer=0x2810028*, nNumberOfBytesToWrite=0xd8408, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2810028*, lpNumberOfBytesWritten=0x18fdd8*=0xd8408, lpOverlapped=0x0) returned 1 [0061.993] CloseHandle (hObject=0xdc) returned 1 [0062.030] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0062.030] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5b2 [0062.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5ba) returned 0x259e70 [0062.030] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5b2, lpOverlapped=0x0) returned 1 [0062.031] CloseHandle (hObject=0xdc) returned 1 [0062.031] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0062.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0062.032] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0062.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0062.032] GetTickCount () returned 0x1fff0 [0062.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0062.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0062.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0062.033] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131056\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131056\\...."), lpSecurityAttributes=0x256228) returned 1 [0062.033] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131056\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131056\\....\\temporaryfile")) returned 0 [0062.033] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131056\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131056\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131056\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131056\\temporaryfile")) returned 1 [0062.035] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131056\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29ee7fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29ee7fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29ee7fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0062.035] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29ee7fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29ee7fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29ee7fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.035] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29ee7fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29ee7fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29ee7fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0062.035] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131056\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29ee7fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29ee7fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29ee7fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0062.035] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29ee7fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29ee7fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29ee7fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.035] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29ee7fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29ee7fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29ee7fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0062.035] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0062.035] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131056\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131056\\temporaryfile")) returned 1 [0062.036] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29ee7fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29ee7fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29ee7fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0062.036] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0062.036] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131056" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131056")) returned 1 [0062.036] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 0 [0062.037] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0062.038] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x5b8, lpOverlapped=0x0) returned 1 [0062.039] CloseHandle (hObject=0xdc) returned 1 [0062.039] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0062.039] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x29ee7fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29ee7fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0062.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0062.040] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0062.040] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0062.040] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfc138cb0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0062.042] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfc138cb0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0062.042] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0xfc138cb0, dwReserved1=0x1d301be, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0062.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x256210 [0062.042] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0062.042] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xd5600 [0062.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd5608) returned 0x2650020 [0062.043] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0xd5600, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0xd5600, lpOverlapped=0x0) returned 1 [0062.059] CloseHandle (hObject=0xd8) returned 1 [0062.059] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0062.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0062.066] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0062.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0062.066] GetTickCount () returned 0x2000f [0062.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0062.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0062.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0062.068] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131087\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131087\\...."), lpSecurityAttributes=0x256198) returned 1 [0062.069] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131087\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131087\\....\\temporaryfile")) returned 0 [0062.069] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131087\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131087\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131087\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131087\\temporaryfile")) returned 1 [0062.070] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131087\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29f342a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29f342a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29f342a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0062.070] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29f342a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29f342a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29f342a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0062.070] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29f342a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29f342a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29f342a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0062.070] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131087\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29f342a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29f342a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29f342a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0062.070] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29f342a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29f342a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29f342a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.070] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29f342a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29f342a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29f342a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0062.070] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0062.070] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131087\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131087\\temporaryfile")) returned 1 [0062.071] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29f342a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29f342a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29f342a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0062.071] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0062.071] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131087" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131087")) returned 1 [0062.071] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 0 [0062.101] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0062.101] WriteFile (in: hFile=0xd8, lpBuffer=0x2810028*, nNumberOfBytesToWrite=0xd5608, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2810028*, lpNumberOfBytesWritten=0x18fdf8*=0xd5608, lpOverlapped=0x0) returned 1 [0062.114] CloseHandle (hObject=0xd8) returned 1 [0062.121] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0062.121] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x567 [0062.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x56f) returned 0x259e70 [0062.121] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x567, lpOverlapped=0x0) returned 1 [0062.123] CloseHandle (hObject=0xd8) returned 1 [0062.123] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0062.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0062.124] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0062.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0062.124] GetTickCount () returned 0x2004e [0062.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0062.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0062.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0062.125] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131150\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131150\\...."), lpSecurityAttributes=0x256210) returned 1 [0062.125] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131150\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131150\\....\\temporaryfile")) returned 0 [0062.125] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131150\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131150\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131150\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131150\\temporaryfile")) returned 1 [0062.126] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131150\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29fcc820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29fcc820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29fcc820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0062.126] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29fcc820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29fcc820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29fcc820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.126] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29fcc820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29fcc820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29fcc820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0062.126] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131150\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29fcc820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29fcc820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29fcc820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0062.126] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29fcc820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29fcc820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29fcc820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.126] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29fcc820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29fcc820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29fcc820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0062.127] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0062.127] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131150\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131150\\temporaryfile")) returned 1 [0062.127] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29fcc820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x29fcc820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x29fcc820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0062.127] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0062.127] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131150" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131150")) returned 1 [0062.127] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 0 [0062.127] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0062.128] WriteFile (in: hFile=0xd8, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdf8*=0x570, lpOverlapped=0x0) returned 1 [0062.129] CloseHandle (hObject=0xd8) returned 1 [0062.129] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0062.129] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2cb13b [0062.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2cb143) returned 0x2650020 [0062.129] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x2cb13b, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x2cb13b, lpOverlapped=0x0) returned 1 [0062.198] CloseHandle (hObject=0xd8) returned 1 [0062.198] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 1 [0062.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0062.206] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0062.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0062.206] GetTickCount () returned 0x2009c [0062.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0062.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0062.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0062.206] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131228\\...."), lpSecurityAttributes=0x256198) returned 1 [0062.207] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131228\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131228\\....\\temporaryfile")) returned 0 [0062.207] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131228\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131228\\temporaryfile")) returned 1 [0062.208] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131228\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a08af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a08af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a08af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0062.209] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a08af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a08af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a08af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.209] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a08af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a08af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a08af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0062.209] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131228\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a08af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a08af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a08af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0062.209] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a08af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a08af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a08af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.209] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a08af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a08af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a08af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0062.209] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0062.209] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131228\\temporaryfile")) returned 1 [0062.209] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a08af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a08af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a08af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0062.209] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0062.209] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131228" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131228")) returned 1 [0062.209] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 0 [0062.312] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0062.313] WriteFile (in: hFile=0xd8, lpBuffer=0x2bf0028*, nNumberOfBytesToWrite=0x2cb140, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2bf0028*, lpNumberOfBytesWritten=0x18fdf8*=0x2cb140, lpOverlapped=0x0) returned 1 [0062.375] CloseHandle (hObject=0xd8) returned 1 [0062.400] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0062.400] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x93a [0062.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x942) returned 0x2350048 [0062.400] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x93a, lpOverlapped=0x0) returned 1 [0062.402] CloseHandle (hObject=0xd8) returned 1 [0062.402] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0062.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0062.403] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0062.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0062.403] GetTickCount () returned 0x20157 [0062.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0062.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0062.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0062.403] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131415\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131415\\...."), lpSecurityAttributes=0x256210) returned 1 [0062.404] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131415\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131415\\....\\temporaryfile")) returned 0 [0062.404] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131415\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131415\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131415\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131415\\temporaryfile")) returned 1 [0062.405] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131415\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a27a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a27a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a27a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0062.405] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a27a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a27a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a27a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.405] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a27a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a27a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a27a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0062.405] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131415\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a27a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a27a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a27a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0062.405] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a27a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a27a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a27a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.405] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a27a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a27a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a27a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0062.405] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0062.406] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131415\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131415\\temporaryfile")) returned 1 [0062.406] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a27a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a27a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a27a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0062.406] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0062.406] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18131415" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18131415")) returned 1 [0062.406] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0062.406] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0062.407] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0x940, lpOverlapped=0x0) returned 1 [0062.408] CloseHandle (hObject=0xd8) returned 1 [0062.408] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0062.408] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2a27a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a27a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0062.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0062.408] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0062.408] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf6e34d70, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0062.410] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf6e34d70, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0062.410] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0xf6e34d70, dwReserved1=0x1d301be, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0062.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256198 [0062.410] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0062.410] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1200204 [0062.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x120020c) returned 0x2650020 [0062.411] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1200204, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x1200204, lpOverlapped=0x0) returned 1 [0063.117] CloseHandle (hObject=0xd8) returned 1 [0063.117] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 1 [0063.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0063.119] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0063.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0063.119] GetTickCount () returned 0x20424 [0063.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0063.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0063.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0063.120] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18132132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18132132\\...."), lpSecurityAttributes=0x256210) returned 1 [0063.121] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18132132\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18132132\\....\\temporaryfile")) returned 0 [0063.121] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18132132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18132132\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18132132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18132132\\temporaryfile")) returned 1 [0063.123] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18132132\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a92bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a952020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a952020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0063.123] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a92bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a952020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a952020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0063.123] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a92bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a92bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a92bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0063.123] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18132132\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a92bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a92bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a92bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0063.123] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a92bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a92bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a92bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.123] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a92bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a92bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a92bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0063.123] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0063.123] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18132132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18132132\\temporaryfile")) returned 1 [0063.124] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2a92bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2a92bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2a92bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0063.124] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0063.124] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18132132" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18132132")) returned 1 [0063.124] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 0 [0063.804] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0063.805] WriteFile (in: hFile=0xd8, lpBuffer=0x4a70028*, nNumberOfBytesToWrite=0x1200208, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x4a70028*, lpNumberOfBytesWritten=0x18fdf8*=0x1200208, lpOverlapped=0x0) returned 1 [0064.325] CloseHandle (hObject=0xd8) returned 1 [0064.490] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0064.491] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2fac00 [0064.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2fac08) returned 0x2650020 [0064.491] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x2fac00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x2fac00, lpOverlapped=0x0) returned 1 [0064.565] CloseHandle (hObject=0xd8) returned 1 [0064.565] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 1 [0064.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0064.581] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0064.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0064.581] GetTickCount () returned 0x209df [0064.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0064.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0064.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0064.582] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133599\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133599\\...."), lpSecurityAttributes=0x256198) returned 1 [0064.582] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133599\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133599\\....\\temporaryfile")) returned 0 [0064.582] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133599\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133599\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133599\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133599\\temporaryfile")) returned 1 [0064.584] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133599\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b728000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b728000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b728000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0064.584] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b728000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b728000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b728000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.584] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b728000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b728000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b728000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0064.584] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133599\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b728000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b728000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b728000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0064.584] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b728000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b728000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b728000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.584] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b728000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b728000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b728000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.584] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0064.584] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133599\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133599\\temporaryfile")) returned 1 [0064.584] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b728000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b728000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b728000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0064.584] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0064.585] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133599" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133599")) returned 1 [0064.585] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 0 [0064.703] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0064.703] WriteFile (in: hFile=0xd8, lpBuffer=0x2c50028*, nNumberOfBytesToWrite=0x2fac08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2c50028*, lpNumberOfBytesWritten=0x18fdf8*=0x2fac08, lpOverlapped=0x0) returned 1 [0064.757] CloseHandle (hObject=0xd8) returned 1 [0064.784] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0064.784] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x4cf [0064.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4d7) returned 0x259e70 [0064.784] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x4cf, lpOverlapped=0x0) returned 1 [0064.786] CloseHandle (hObject=0xd8) returned 1 [0064.786] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0064.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0064.787] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0064.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0064.787] GetTickCount () returned 0x20aaa [0064.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0064.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0064.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0064.787] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133802\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133802\\...."), lpSecurityAttributes=0x256210) returned 1 [0064.788] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133802\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133802\\....\\temporaryfile")) returned 0 [0064.788] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133802\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133802\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133802\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133802\\temporaryfile")) returned 1 [0064.789] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133802\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9171e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9171e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9171e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0064.789] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9171e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9171e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9171e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.789] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9171e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9171e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9171e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0064.789] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133802\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9171e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9171e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9171e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0064.789] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9171e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9171e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9171e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.789] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9171e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9171e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9171e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.789] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0064.790] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133802\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133802\\temporaryfile")) returned 1 [0064.790] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9171e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9171e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9171e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0064.790] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0064.790] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133802" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133802")) returned 1 [0064.790] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 0 [0064.791] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0064.791] WriteFile (in: hFile=0xd8, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x4d8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdf8*=0x4d8, lpOverlapped=0x0) returned 1 [0064.792] CloseHandle (hObject=0xd8) returned 1 [0064.792] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0064.792] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x73c [0064.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x744) returned 0x2350048 [0064.792] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x73c, lpOverlapped=0x0) returned 1 [0064.794] CloseHandle (hObject=0xd8) returned 1 [0064.794] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0064.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0064.795] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0064.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0064.795] GetTickCount () returned 0x20ab9 [0064.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0064.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0064.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0064.795] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133817\\...."), lpSecurityAttributes=0x256198) returned 1 [0064.795] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133817\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133817\\....\\temporaryfile")) returned 0 [0064.796] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133817\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133817\\temporaryfile")) returned 1 [0064.797] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133817\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b93d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b93d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b93d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0064.797] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b93d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b93d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b93d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.797] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b93d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b93d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b93d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0064.797] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133817\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b93d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b93d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b93d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0064.797] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b93d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b93d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b93d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.797] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b93d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b93d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b93d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.797] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0064.797] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133817\\temporaryfile")) returned 1 [0064.797] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b93d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b93d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b93d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0064.797] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0064.806] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133817" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133817")) returned 1 [0064.806] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0064.806] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0064.806] WriteFile (in: hFile=0xd8, lpBuffer=0x23507a0*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x23507a0*, lpNumberOfBytesWritten=0x18fdf8*=0x740, lpOverlapped=0x0) returned 1 [0064.807] CloseHandle (hObject=0xd8) returned 1 [0064.807] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0064.808] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2b9634a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9634a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0064.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0064.808] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0064.808] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x435769e0, dwReserved1=0x1d305eb, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0064.808] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x435769e0, dwReserved1=0x1d305eb, cFileName="..", cAlternateFileName="")) returned 1 [0064.808] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x435769e0, dwReserved1=0x1d305eb, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0064.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256210 [0064.808] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0064.809] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1861 [0064.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1869) returned 0x297460 [0064.809] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x1861, lpOverlapped=0x0) returned 1 [0064.810] CloseHandle (hObject=0xd8) returned 1 [0064.811] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0064.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0064.811] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0064.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0064.812] GetTickCount () returned 0x20ac9 [0064.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0064.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0064.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0064.812] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133833\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133833\\...."), lpSecurityAttributes=0x256198) returned 1 [0064.812] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133833\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133833\\....\\temporaryfile")) returned 0 [0064.812] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133833\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133833\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133833\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133833\\temporaryfile")) returned 1 [0064.814] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133833\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9634a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9634a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9634a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0064.814] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9634a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9634a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9634a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0064.814] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9634a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9634a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9634a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0064.814] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133833\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9634a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9634a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9634a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0064.814] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9634a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9634a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9634a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.814] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9634a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9634a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9634a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.814] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0064.814] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133833\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133833\\temporaryfile")) returned 1 [0064.814] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b9634a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2b9634a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2b9634a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0064.814] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0064.814] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18133833" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18133833")) returned 1 [0064.815] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0064.815] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0064.817] WriteFile (in: hFile=0xd8, lpBuffer=0x298ce0*, nNumberOfBytesToWrite=0x1868, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x298ce0*, lpNumberOfBytesWritten=0x18fdf8*=0x1868, lpOverlapped=0x0) returned 1 [0064.818] CloseHandle (hObject=0xd8) returned 1 [0064.818] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0064.818] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x30780dd [0064.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30780e5) returned 0x2650020 [0064.820] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x30780dd, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x30780dd, lpOverlapped=0x0) returned 1 [0066.150] CloseHandle (hObject=0xd8) returned 1 [0066.151] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 1 [0066.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0066.158] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0066.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0066.158] GetTickCount () returned 0x21006 [0066.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0066.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0066.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0066.159] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18135174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18135174\\...."), lpSecurityAttributes=0x256210) returned 1 [0066.159] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18135174\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18135174\\....\\temporaryfile")) returned 0 [0066.159] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18135174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18135174\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18135174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18135174\\temporaryfile")) returned 1 [0066.161] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18135174\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2c62eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2c62eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2c62eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0066.161] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2c62eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2c62eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2c62eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.161] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2c62eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2c62eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2c62eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0066.161] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18135174\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2c62eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2c62eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2c62eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0066.161] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2c62eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2c62eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2c62eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.161] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2c62eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2c62eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2c62eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0066.161] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0066.161] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18135174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18135174\\temporaryfile")) returned 1 [0066.162] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2c62eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2c62eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2c62eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0066.162] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0066.162] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18135174" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18135174")) returned 1 [0066.162] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 0 [0068.063] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0068.065] WriteFile (in: hFile=0xd8, lpBuffer=0x8750028*, nNumberOfBytesToWrite=0x30780e8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x8750028*, lpNumberOfBytesWritten=0x18fdf8*=0x30780e8, lpOverlapped=0x0) returned 1 [0069.208] CloseHandle (hObject=0xd8) returned 1 [0069.711] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0069.712] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2ab000 [0069.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ab008) returned 0x2650020 [0069.713] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x2ab000, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x2ab000, lpOverlapped=0x0) returned 1 [0069.793] CloseHandle (hObject=0xd8) returned 1 [0069.793] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 1 [0069.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0069.801] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0069.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0069.801] GetTickCount () returned 0x21e49 [0069.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0069.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0069.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0069.804] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18138825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18138825\\...."), lpSecurityAttributes=0x256198) returned 1 [0069.805] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18138825\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18138825\\....\\temporaryfile")) returned 0 [0069.805] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18138825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18138825\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18138825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18138825\\temporaryfile")) returned 1 [0069.807] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18138825\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2e8feca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2e8feca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2e8feca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0069.807] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2e8feca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2e8feca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2e8feca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.807] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2e8feca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2e8feca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2e8feca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0069.807] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18138825\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2e8feca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2e8feca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2e8feca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0069.807] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2e8feca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2e8feca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2e8feca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.807] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2e8feca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2e8feca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2e8feca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0069.807] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0069.807] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18138825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18138825\\temporaryfile")) returned 1 [0069.808] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2e8feca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2e8feca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2e8feca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0069.808] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0069.808] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18138825" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18138825")) returned 1 [0069.808] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 0 [0069.981] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0069.982] WriteFile (in: hFile=0xd8, lpBuffer=0x2bb0028*, nNumberOfBytesToWrite=0x2ab008, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2bb0028*, lpNumberOfBytesWritten=0x18fdf8*=0x2ab008, lpOverlapped=0x0) returned 1 [0070.081] CloseHandle (hObject=0xd8) returned 1 [0070.105] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0070.106] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x251f [0070.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2527) returned 0x297460 [0070.106] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x251f, lpOverlapped=0x0) returned 1 [0070.108] CloseHandle (hObject=0xd8) returned 1 [0070.109] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0070.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0070.110] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0070.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0070.110] GetTickCount () returned 0x21f81 [0070.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0070.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0070.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0070.110] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139137\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139137\\...."), lpSecurityAttributes=0x256210) returned 1 [0070.111] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139137\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139137\\....\\temporaryfile")) returned 0 [0070.111] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139137\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139137\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139137\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139137\\temporaryfile")) returned 1 [0070.112] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139137\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ebf8820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ebf8820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ebf8820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0070.112] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ebf8820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ebf8820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ebf8820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.112] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ebf8820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ebf8820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ebf8820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0070.112] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139137\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ebf8820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ebf8820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ebf8820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0070.112] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ebf8820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ebf8820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ebf8820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.113] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ebf8820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ebf8820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ebf8820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.113] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0070.113] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139137\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139137\\temporaryfile")) returned 1 [0070.113] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ebf8820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ebf8820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ebf8820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0070.113] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0070.113] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139137" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139137")) returned 1 [0070.113] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 0 [0070.114] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0070.114] WriteFile (in: hFile=0xd8, lpBuffer=0x299998*, nNumberOfBytesToWrite=0x2528, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x299998*, lpNumberOfBytesWritten=0x18fdf8*=0x2528, lpOverlapped=0x0) returned 1 [0070.115] CloseHandle (hObject=0xd8) returned 1 [0070.115] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0070.115] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x2ebf8820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ebf8820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0070.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0070.115] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0070.116] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf58ee8d0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0070.122] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf58ee8d0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0070.122] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0xf58ee8d0, dwReserved1=0x1d301be, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0070.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x256198 [0070.122] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0070.122] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x263400 [0070.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x263408) returned 0x2650020 [0070.123] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x263400, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x263400, lpOverlapped=0x0) returned 1 [0070.181] CloseHandle (hObject=0xd8) returned 1 [0070.181] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 1 [0070.187] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0070.187] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0070.187] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0070.187] GetTickCount () returned 0x21fbf [0070.187] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0070.187] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0070.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0070.188] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139199\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139199\\...."), lpSecurityAttributes=0x256210) returned 1 [0070.188] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139199\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139199\\....\\temporaryfile")) returned 0 [0070.188] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139199\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139199\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139199\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139199\\temporaryfile")) returned 1 [0070.190] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139199\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ec90da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ecb6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ecb6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0070.190] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ec90da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ecb6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ecb6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0070.190] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ecb6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ecb6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ecb6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0070.190] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139199\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ecb6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ecb6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ecb6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0070.190] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ecb6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ecb6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ecb6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.190] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ecb6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ecb6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ecb6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.190] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0070.190] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139199\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139199\\temporaryfile")) returned 1 [0070.190] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ecb6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ecb6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ecb6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0070.190] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0070.191] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139199" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139199")) returned 1 [0070.191] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 0 [0070.275] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0070.275] WriteFile (in: hFile=0xd8, lpBuffer=0x2b30028*, nNumberOfBytesToWrite=0x263408, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b30028*, lpNumberOfBytesWritten=0x18fdf8*=0x263408, lpOverlapped=0x0) returned 1 [0070.330] CloseHandle (hObject=0xd8) returned 1 [0070.351] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0070.351] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x646 [0070.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x64e) returned 0x259e70 [0070.352] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x646, lpOverlapped=0x0) returned 1 [0070.353] CloseHandle (hObject=0xd8) returned 1 [0070.353] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0070.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0070.354] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0070.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0070.354] GetTickCount () returned 0x2206b [0070.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0070.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0070.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0070.355] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139371\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139371\\...."), lpSecurityAttributes=0x256198) returned 1 [0070.355] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139371\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139371\\....\\temporaryfile")) returned 0 [0070.355] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139371\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139371\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139371\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139371\\temporaryfile")) returned 1 [0070.356] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139371\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ee33cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ee33cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ee33cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0070.357] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ee33cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ee33cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ee33cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.357] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ee33cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ee33cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ee33cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0070.357] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139371\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ee33cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ee33cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ee33cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0070.357] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ee33cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ee33cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ee33cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.357] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ee33cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ee33cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ee33cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.357] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0070.357] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139371\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139371\\temporaryfile")) returned 1 [0070.357] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ee33cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2ee33cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2ee33cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0070.357] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0070.357] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139371" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139371")) returned 1 [0070.358] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 0 [0070.358] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0070.358] WriteFile (in: hFile=0xd8, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdf8*=0x650, lpOverlapped=0x0) returned 1 [0070.359] CloseHandle (hObject=0xd8) returned 1 [0070.359] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0070.363] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x10a5df8 [0070.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10a5e00) returned 0x2650020 [0070.364] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x10a5df8, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x10a5df8, lpOverlapped=0x0) returned 1 [0070.754] CloseHandle (hObject=0xd8) returned 1 [0070.754] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 1 [0070.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0070.761] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0070.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0070.761] GetTickCount () returned 0x22200 [0070.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0070.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0070.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0070.762] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139776\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139776\\...."), lpSecurityAttributes=0x256210) returned 1 [0070.763] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139776\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139776\\....\\temporaryfile")) returned 0 [0070.763] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139776\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139776\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139776\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139776\\temporaryfile")) returned 1 [0070.764] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139776\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f212080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2f212080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2f212080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0070.764] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f212080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2f212080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2f212080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.764] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f212080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2f212080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2f212080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0070.764] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139776\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f212080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2f212080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2f212080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0070.764] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f212080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2f212080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2f212080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.765] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f212080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2f212080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2f212080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.765] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0070.765] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139776\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139776\\temporaryfile")) returned 1 [0070.765] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f212080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2f212080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2f212080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0070.765] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0070.765] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18139776" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18139776")) returned 1 [0070.765] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 0 [0071.336] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0071.336] WriteFile (in: hFile=0xd8, lpBuffer=0x47b0028*, nNumberOfBytesToWrite=0x10a5e00, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x47b0028*, lpNumberOfBytesWritten=0x18fdf8*=0x10a5e00, lpOverlapped=0x0) returned 1 [0071.678] CloseHandle (hObject=0xd8) returned 1 [0071.821] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0071.821] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x7c4 [0071.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7cc) returned 0x2350048 [0071.822] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x7c4, lpOverlapped=0x0) returned 1 [0071.823] CloseHandle (hObject=0xd8) returned 1 [0071.823] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0071.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0071.824] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0071.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0071.824] GetTickCount () returned 0x22625 [0071.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0071.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0071.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0071.825] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140837\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140837\\...."), lpSecurityAttributes=0x256198) returned 1 [0071.825] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140837\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140837\\....\\temporaryfile")) returned 0 [0071.825] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140837\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140837\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140837\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140837\\temporaryfile")) returned 1 [0071.827] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140837\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fc2fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fc55f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fc55f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0071.827] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fc2fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fc55f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fc55f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.827] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fc2fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fc2fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fc2fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0071.827] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140837\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fc2fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fc2fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fc2fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0071.827] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fc2fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fc2fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fc2fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.827] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fc2fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fc2fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fc2fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0071.827] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0071.827] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140837\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140837\\temporaryfile")) returned 1 [0071.828] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fc2fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fc2fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fc2fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0071.828] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0071.828] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140837" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140837")) returned 1 [0071.828] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0071.828] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0071.829] WriteFile (in: hFile=0xd8, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x7c8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdf8*=0x7c8, lpOverlapped=0x0) returned 1 [0071.829] CloseHandle (hObject=0xd8) returned 1 [0071.829] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0071.830] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2fc55f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fc55f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0071.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0071.830] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0071.830] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa5b30b20, dwReserved1=0x1d305f1, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0071.832] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa5b30b20, dwReserved1=0x1d305f1, cFileName="..", cAlternateFileName="")) returned 1 [0071.832] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0xa5b30b20, dwReserved1=0x1d305f1, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0071.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x256210 [0071.833] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0071.833] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x265400 [0071.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x265408) returned 0x2650020 [0071.834] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x265400, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x265400, lpOverlapped=0x0) returned 1 [0071.884] CloseHandle (hObject=0xd8) returned 1 [0071.884] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 1 [0071.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0071.888] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0071.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0071.888] GetTickCount () returned 0x22673 [0071.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0071.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0071.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0071.889] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140915\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140915\\...."), lpSecurityAttributes=0x256198) returned 1 [0071.889] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140915\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140915\\....\\temporaryfile")) returned 0 [0071.889] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140915\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140915\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140915\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140915\\temporaryfile")) returned 1 [0071.890] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140915\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fcee4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fcee4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fcee4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0071.890] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fcee4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fcee4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fcee4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0071.891] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fcee4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fcee4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fcee4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0071.891] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140915\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fcee4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fcee4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fcee4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0071.891] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fcee4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fcee4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fcee4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.891] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fcee4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fcee4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fcee4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0071.891] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0071.891] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140915\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140915\\temporaryfile")) returned 1 [0071.891] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2fcee4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2fcee4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2fcee4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0071.891] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0071.891] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18140915" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18140915")) returned 1 [0071.891] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 0 [0071.970] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0071.970] WriteFile (in: hFile=0xd8, lpBuffer=0x2b30028*, nNumberOfBytesToWrite=0x265408, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b30028*, lpNumberOfBytesWritten=0x18fdf8*=0x265408, lpOverlapped=0x0) returned 1 [0072.056] CloseHandle (hObject=0xd8) returned 1 [0072.076] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0072.077] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x5ac [0072.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b4) returned 0x259e70 [0072.077] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x5ac, lpOverlapped=0x0) returned 1 [0072.079] CloseHandle (hObject=0xd8) returned 1 [0072.079] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0072.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0072.080] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0072.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0072.080] GetTickCount () returned 0x2272e [0072.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0072.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0072.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0072.082] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141102\\...."), lpSecurityAttributes=0x256210) returned 1 [0072.082] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141102\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141102\\....\\temporaryfile")) returned 0 [0072.082] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141102\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141102\\temporaryfile")) returned 1 [0072.084] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141102\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2feb7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2feb7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2feb7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0072.084] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2feb7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2feb7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2feb7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.084] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2feb7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2feb7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2feb7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0072.084] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141102\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2feb7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2feb7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2feb7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0072.084] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2feb7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2feb7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2feb7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.084] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2feb7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2feb7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2feb7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.084] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0072.084] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141102\\temporaryfile")) returned 1 [0072.084] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2feb7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x2feb7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x2feb7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0072.084] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0072.084] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141102" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141102")) returned 1 [0072.084] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 0 [0072.085] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0072.085] WriteFile (in: hFile=0xd8, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdf8*=0x5b0, lpOverlapped=0x0) returned 1 [0072.094] CloseHandle (hObject=0xd8) returned 1 [0072.094] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0072.095] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x7e1dcd [0072.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7e1dd5) returned 0x2650020 [0072.095] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x7e1dcd, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x7e1dcd, lpOverlapped=0x0) returned 1 [0072.261] CloseHandle (hObject=0xd8) returned 1 [0072.261] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 1 [0072.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0072.269] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0072.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0072.269] GetTickCount () returned 0x227ea [0072.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0072.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0072.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0072.269] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141290\\...."), lpSecurityAttributes=0x256198) returned 1 [0072.270] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141290\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141290\\....\\temporaryfile")) returned 0 [0072.270] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141290\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141290\\temporaryfile")) returned 1 [0072.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141290\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300805e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x300805e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x300805e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0072.271] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300805e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x300805e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x300805e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.271] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300805e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x300805e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x300805e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0072.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141290\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300805e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x300805e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x300805e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0072.271] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300805e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x300805e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x300805e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.271] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300805e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x300805e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x300805e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.271] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0072.271] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141290\\temporaryfile")) returned 1 [0072.272] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300805e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x300805e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x300805e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0072.272] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0072.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141290" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141290")) returned 1 [0072.272] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 0 [0072.518] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0072.518] WriteFile (in: hFile=0xd8, lpBuffer=0x3630028*, nNumberOfBytesToWrite=0x7e1dd8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x3630028*, lpNumberOfBytesWritten=0x18fdf8*=0x7e1dd8, lpOverlapped=0x0) returned 1 [0072.730] CloseHandle (hObject=0xd8) returned 1 [0072.798] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0072.799] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x750 [0072.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x758) returned 0x2350048 [0072.799] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x750, lpOverlapped=0x0) returned 1 [0072.800] CloseHandle (hObject=0xd8) returned 1 [0072.800] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0072.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0072.801] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0072.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0072.801] GetTickCount () returned 0x229fc [0072.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0072.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0072.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0072.802] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141820\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141820\\...."), lpSecurityAttributes=0x256210) returned 1 [0072.802] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141820\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141820\\....\\temporaryfile")) returned 0 [0072.802] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141820\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141820\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141820\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141820\\temporaryfile")) returned 1 [0072.803] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141820\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3058f4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3058f4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3058f4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0072.804] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3058f4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3058f4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3058f4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.804] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3058f4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3058f4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3058f4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0072.804] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141820\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3058f4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3058f4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3058f4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0072.804] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3058f4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3058f4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3058f4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.804] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3058f4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3058f4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3058f4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.804] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0072.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141820\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141820\\temporaryfile")) returned 1 [0072.804] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3058f4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3058f4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3058f4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0072.804] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0072.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141820" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141820")) returned 1 [0072.804] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0072.805] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0072.805] WriteFile (in: hFile=0xd8, lpBuffer=0x23507b0*, nNumberOfBytesToWrite=0x758, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x23507b0*, lpNumberOfBytesWritten=0x18fdf8*=0x758, lpOverlapped=0x0) returned 1 [0072.806] CloseHandle (hObject=0xd8) returned 1 [0072.806] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0072.806] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x3058f4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3058f4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0072.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0072.806] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0072.806] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee38cbf0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0072.808] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee38cbf0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0072.808] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0xee38cbf0, dwReserved1=0x1d301be, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0072.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256198 [0072.808] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0072.809] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3e7e1f [0072.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3e7e27) returned 0x2650020 [0072.809] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x3e7e1f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x3e7e1f, lpOverlapped=0x0) returned 1 [0072.893] CloseHandle (hObject=0xd8) returned 1 [0072.893] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 1 [0072.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0072.901] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0072.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0072.901] GetTickCount () returned 0x22a5a [0072.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0072.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0072.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0072.901] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141914\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141914\\...."), lpSecurityAttributes=0x256210) returned 1 [0072.902] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141914\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141914\\....\\temporaryfile")) returned 0 [0072.902] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141914\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141914\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141914\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141914\\temporaryfile")) returned 1 [0072.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141914\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30673ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30673ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30673ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0072.903] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30673ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30673ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30673ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0072.904] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30673ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30673ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30673ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0072.904] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141914\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30673ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30673ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30673ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0072.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30673ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30673ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30673ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30673ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30673ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30673ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.904] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0072.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141914\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141914\\temporaryfile")) returned 1 [0072.904] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30673ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30673ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30673ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0072.904] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0072.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18141914" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18141914")) returned 1 [0072.904] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 0 [0073.036] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.038] WriteFile (in: hFile=0xd8, lpBuffer=0x2e30028*, nNumberOfBytesToWrite=0x3e7e28, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2e30028*, lpNumberOfBytesWritten=0x18fdf8*=0x3e7e28, lpOverlapped=0x0) returned 1 [0073.110] CloseHandle (hObject=0xd8) returned 1 [0073.143] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.143] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x264400 [0073.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x264408) returned 0x2650020 [0073.144] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x264400, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x264400, lpOverlapped=0x0) returned 1 [0073.197] CloseHandle (hObject=0xd8) returned 1 [0073.197] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 1 [0073.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0073.201] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0073.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0073.201] GetTickCount () returned 0x22b92 [0073.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0073.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0073.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0073.201] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142226\\...."), lpSecurityAttributes=0x256198) returned 1 [0073.202] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142226\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142226\\....\\temporaryfile")) returned 0 [0073.202] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142226\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142226\\temporaryfile")) returned 1 [0073.203] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142226\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3096d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3096d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3096d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0073.203] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3096d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3096d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3096d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.203] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3096d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3096d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3096d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0073.203] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142226\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3096d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3096d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3096d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0073.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3096d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3096d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3096d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3096d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3096d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3096d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.204] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0073.204] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142226\\temporaryfile")) returned 1 [0073.204] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3096d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3096d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3096d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0073.204] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0073.204] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142226" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142226")) returned 1 [0073.204] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 0 [0073.281] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.282] WriteFile (in: hFile=0xd8, lpBuffer=0x2b30028*, nNumberOfBytesToWrite=0x264408, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b30028*, lpNumberOfBytesWritten=0x18fdf8*=0x264408, lpOverlapped=0x0) returned 1 [0073.331] CloseHandle (hObject=0xd8) returned 1 [0073.351] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.351] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x391 [0073.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x399) returned 0x259e70 [0073.351] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x391, lpOverlapped=0x0) returned 1 [0073.352] CloseHandle (hObject=0xd8) returned 1 [0073.352] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0073.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0073.353] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0073.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0073.353] GetTickCount () returned 0x22c1e [0073.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0073.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0073.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0073.354] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142366\\...."), lpSecurityAttributes=0x256210) returned 1 [0073.354] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142366\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142366\\....\\temporaryfile")) returned 0 [0073.354] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142366\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142366\\temporaryfile")) returned 1 [0073.356] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142366\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30ac44c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0073.356] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30ac44c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.356] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0073.356] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142366\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0073.356] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.356] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.356] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0073.356] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142366\\temporaryfile")) returned 1 [0073.356] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0073.356] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0073.356] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142366" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142366")) returned 1 [0073.357] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 0 [0073.357] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.357] WriteFile (in: hFile=0xd8, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x398, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdf8*=0x398, lpOverlapped=0x0) returned 1 [0073.358] CloseHandle (hObject=0xd8) returned 1 [0073.358] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.358] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x5ac [0073.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b4) returned 0x259e70 [0073.358] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x5ac, lpOverlapped=0x0) returned 1 [0073.360] CloseHandle (hObject=0xd8) returned 1 [0073.360] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0073.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0073.361] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0073.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0073.361] GetTickCount () returned 0x22c2e [0073.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0073.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0073.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0073.361] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142382\\...."), lpSecurityAttributes=0x256198) returned 1 [0073.362] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142382\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142382\\....\\temporaryfile")) returned 0 [0073.362] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142382\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142382\\temporaryfile")) returned 1 [0073.363] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142382\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0073.363] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.363] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0073.363] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142382\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0073.363] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.363] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.363] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0073.363] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142382\\temporaryfile")) returned 1 [0073.364] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30aea620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0073.364] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0073.364] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142382" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142382")) returned 1 [0073.364] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0073.364] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.364] WriteFile (in: hFile=0xd8, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdf8*=0x5b0, lpOverlapped=0x0) returned 1 [0073.365] CloseHandle (hObject=0xd8) returned 1 [0073.365] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0073.365] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x30aea620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30aea620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0073.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0073.365] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0073.366] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b68970, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0073.367] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b68970, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0073.367] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7b68970, dwReserved1=0x1d301be, cFileName="1033", cAlternateFileName="")) returned 1 [0073.367] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0xe7b68970, dwReserved1=0x1d301be, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0073.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0073.367] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.368] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x91975 [0073.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9197d) returned 0x1d70020 [0073.368] ReadFile (in: hFile=0xd8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe10*=0x91975, lpOverlapped=0x0) returned 1 [0073.378] CloseHandle (hObject=0xd8) returned 1 [0073.378] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0073.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0073.383] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0073.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0073.383] GetTickCount () returned 0x22c3d [0073.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0073.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0073.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0073.383] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142397\\...."), lpSecurityAttributes=0x256198) returned 1 [0073.383] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142397\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142397\\....\\temporaryfile")) returned 0 [0073.384] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142397\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142397\\temporaryfile")) returned 1 [0073.385] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142397\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30b10780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30b10780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30b10780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0073.385] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30b10780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30b10780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30b10780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0073.385] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30b10780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30b10780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30b10780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0073.385] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142397\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30b10780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30b10780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30b10780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0073.385] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30b10780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30b10780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30b10780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.385] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30b10780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30b10780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30b10780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.385] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0073.385] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142397\\temporaryfile")) returned 1 [0073.385] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30b10780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30b10780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30b10780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0073.385] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0073.385] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142397" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142397")) returned 1 [0073.386] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 0 [0073.404] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.404] WriteFile (in: hFile=0xd8, lpBuffer=0x26f0028*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x26f0028*, lpNumberOfBytesWritten=0x18fdf8*=0x91980, lpOverlapped=0x0) returned 1 [0073.412] CloseHandle (hObject=0xd8) returned 1 [0073.417] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.418] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xccb88 [0073.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xccb90) returned 0x1d70020 [0073.418] ReadFile (in: hFile=0xd8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xccb88, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe10*=0xccb88, lpOverlapped=0x0) returned 1 [0073.430] CloseHandle (hObject=0xd8) returned 1 [0073.430] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0073.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0073.436] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0073.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0073.436] GetTickCount () returned 0x22c7c [0073.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0073.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0073.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0073.437] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142460\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142460\\...."), lpSecurityAttributes=0x256210) returned 1 [0073.437] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142460\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142460\\....\\temporaryfile")) returned 0 [0073.437] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142460\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142460\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142460\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142460\\temporaryfile")) returned 1 [0073.438] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142460\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30ba8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30ba8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30ba8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0073.438] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30ba8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30ba8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30ba8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.438] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30ba8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30ba8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30ba8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0073.439] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142460\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30ba8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30ba8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30ba8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0073.439] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30ba8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30ba8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30ba8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.439] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30ba8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30ba8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30ba8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.439] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0073.439] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142460\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142460\\temporaryfile")) returned 1 [0073.439] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30ba8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30ba8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30ba8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0073.439] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0073.439] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142460" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142460")) returned 1 [0073.439] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 0 [0073.465] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.465] WriteFile (in: hFile=0xd8, lpBuffer=0x2720028*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2720028*, lpNumberOfBytesWritten=0x18fdf8*=0xccb90, lpOverlapped=0x0) returned 1 [0073.476] CloseHandle (hObject=0xd8) returned 1 [0073.483] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.483] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x80760 [0073.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80768) returned 0x1d70020 [0073.483] ReadFile (in: hFile=0xd8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x80760, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe10*=0x80760, lpOverlapped=0x0) returned 1 [0073.492] CloseHandle (hObject=0xd8) returned 1 [0073.492] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0073.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0073.497] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0073.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0073.497] GetTickCount () returned 0x22cba [0073.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0073.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0073.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0073.497] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142522\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142522\\...."), lpSecurityAttributes=0x256198) returned 1 [0073.497] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142522\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142522\\....\\temporaryfile")) returned 0 [0073.497] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142522\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142522\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142522\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142522\\temporaryfile")) returned 1 [0073.498] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142522\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c41280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c41280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c41280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0073.499] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c41280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c41280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c41280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.499] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c41280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c41280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c41280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0073.499] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142522\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c41280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c41280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c41280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0073.499] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c41280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c41280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c41280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.499] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c41280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c41280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c41280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.499] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0073.499] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142522\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142522\\temporaryfile")) returned 1 [0073.499] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c41280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c41280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c41280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0073.499] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0073.499] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142522" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142522")) returned 1 [0073.499] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 0 [0073.515] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.516] WriteFile (in: hFile=0xd8, lpBuffer=0x26e0028*, nNumberOfBytesToWrite=0x80768, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x26e0028*, lpNumberOfBytesWritten=0x18fdf8*=0x80768, lpOverlapped=0x0) returned 1 [0073.523] CloseHandle (hObject=0xd8) returned 1 [0073.528] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.528] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x7eda0 [0073.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7eda8) returned 0x2350048 [0073.529] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7eda0, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x7eda0, lpOverlapped=0x0) returned 1 [0073.535] CloseHandle (hObject=0xd8) returned 1 [0073.535] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0073.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0073.539] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0073.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0073.539] GetTickCount () returned 0x22cd9 [0073.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0073.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0073.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0073.539] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142553\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142553\\...."), lpSecurityAttributes=0x256210) returned 1 [0073.540] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142553\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142553\\....\\temporaryfile")) returned 0 [0073.540] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142553\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142553\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142553\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142553\\temporaryfile")) returned 1 [0073.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142553\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c8d540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c8d540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c8d540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0073.541] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c8d540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c8d540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c8d540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.541] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c8d540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c8d540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c8d540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0073.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142553\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c8d540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c8d540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c8d540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0073.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c8d540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c8d540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c8d540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c8d540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c8d540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c8d540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.541] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0073.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142553\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142553\\temporaryfile")) returned 1 [0073.541] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30c8d540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30c8d540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30c8d540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0073.541] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0073.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142553" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142553")) returned 1 [0073.542] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 0 [0073.558] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.558] WriteFile (in: hFile=0xd8, lpBuffer=0x23cee00*, nNumberOfBytesToWrite=0x7eda8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x23cee00*, lpNumberOfBytesWritten=0x18fdf8*=0x7eda8, lpOverlapped=0x0) returned 1 [0073.565] CloseHandle (hObject=0xd8) returned 1 [0073.567] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.568] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x741 [0073.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x749) returned 0x2649f0 [0073.568] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x741, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0x741, lpOverlapped=0x0) returned 1 [0073.570] CloseHandle (hObject=0xd8) returned 1 [0073.570] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0073.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0073.570] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0073.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0073.571] GetTickCount () returned 0x22cf8 [0073.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0073.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0073.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0073.571] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142584\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142584\\...."), lpSecurityAttributes=0x256198) returned 1 [0073.571] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142584\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142584\\....\\temporaryfile")) returned 0 [0073.571] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142584\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142584\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142584\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142584\\temporaryfile")) returned 1 [0073.586] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142584\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30cd9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30cd9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30cd9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0073.586] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30cd9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30cd9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30cd9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.586] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30cd9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30cd9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30cd9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0073.586] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142584\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30cd9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30cd9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30cd9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0073.586] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30cd9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30cd9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30cd9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.586] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30cd9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30cd9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30cd9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.586] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0073.586] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142584\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142584\\temporaryfile")) returned 1 [0073.586] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30cd9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30cd9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30cd9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0073.586] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0073.586] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142584" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142584")) returned 1 [0073.586] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 0 [0073.587] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.587] WriteFile (in: hFile=0xd8, lpBuffer=0x265150*, nNumberOfBytesToWrite=0x748, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x265150*, lpNumberOfBytesWritten=0x18fdf8*=0x748, lpOverlapped=0x0) returned 1 [0073.588] CloseHandle (hObject=0xd8) returned 1 [0073.588] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.589] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa0200 [0073.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa0208) returned 0x1d70020 [0073.589] ReadFile (in: hFile=0xd8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xa0200, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe10*=0xa0200, lpOverlapped=0x0) returned 1 [0073.598] CloseHandle (hObject=0xd8) returned 1 [0073.598] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0073.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0073.603] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0073.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0073.603] GetTickCount () returned 0x22d18 [0073.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0073.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0073.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0073.603] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142616\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142616\\...."), lpSecurityAttributes=0x256210) returned 1 [0073.604] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142616\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142616\\....\\temporaryfile")) returned 0 [0073.604] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142616\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142616\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142616\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142616\\temporaryfile")) returned 1 [0073.605] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142616\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30d25ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30d4bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30d4bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0073.605] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30d25ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30d4bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30d4bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.605] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30d25ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30d25ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30d25ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0073.605] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142616\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30d25ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30d25ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30d25ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0073.605] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30d25ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30d25ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30d25ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.605] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30d25ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30d25ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30d25ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.605] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0073.605] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142616\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142616\\temporaryfile")) returned 1 [0073.605] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x30d25ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x30d25ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x30d25ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0073.605] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0073.606] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142616" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142616")) returned 1 [0073.606] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 0 [0073.626] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.626] WriteFile (in: hFile=0xd8, lpBuffer=0x2700028*, nNumberOfBytesToWrite=0xa0208, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2700028*, lpNumberOfBytesWritten=0x18fdf8*=0xa0208, lpOverlapped=0x0) returned 1 [0073.635] CloseHandle (hObject=0xd8) returned 1 [0073.640] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0073.640] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xd79282 [0073.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd7928a) returned 0x2650020 [0073.641] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0xd79282, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0xd79282, lpOverlapped=0x0) returned 1 [0073.932] CloseHandle (hObject=0xd8) returned 1 [0073.932] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 1 [0073.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0073.937] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0073.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0073.937] GetTickCount () returned 0x22e6f [0073.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0073.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0073.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0073.938] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142959\\...."), lpSecurityAttributes=0x256198) returned 1 [0073.938] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142959\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142959\\....\\temporaryfile")) returned 0 [0073.938] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142959\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142959\\temporaryfile")) returned 1 [0073.940] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142959\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3106b900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3106b900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3106b900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0073.940] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3106b900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3106b900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3106b900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.940] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3106b900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3106b900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3106b900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0073.940] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142959\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3106b900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3106b900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3106b900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0073.940] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3106b900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3106b900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3106b900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.940] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3106b900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3106b900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3106b900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0073.940] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0073.940] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142959\\temporaryfile")) returned 1 [0073.940] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3106b900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3106b900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3106b900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0073.940] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0073.940] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18142959" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18142959")) returned 1 [0073.940] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 0 [0074.440] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0074.441] WriteFile (in: hFile=0xd8, lpBuffer=0x4150028*, nNumberOfBytesToWrite=0xd79288, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x4150028*, lpNumberOfBytesWritten=0x18fdf8*=0xd79288, lpOverlapped=0x0) returned 1 [0074.715] CloseHandle (hObject=0xd8) returned 1 [0074.831] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0074.831] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x387e00 [0074.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x387e08) returned 0x2650020 [0074.832] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x387e00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x387e00, lpOverlapped=0x0) returned 1 [0074.906] CloseHandle (hObject=0xd8) returned 1 [0074.906] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 1 [0074.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0074.911] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0074.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0074.911] GetTickCount () returned 0x23236 [0074.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0074.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0074.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0074.912] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18143926\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18143926\\...."), lpSecurityAttributes=0x256210) returned 1 [0074.912] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18143926\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18143926\\....\\temporaryfile")) returned 0 [0074.912] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18143926\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18143926\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18143926\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18143926\\temporaryfile")) returned 1 [0074.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18143926\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a4e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x319a4e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x319a4e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0074.914] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a4e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x319a4e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x319a4e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.914] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a4e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x319a4e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x319a4e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0074.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18143926\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a4e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x319a4e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x319a4e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0074.915] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a4e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x319a4e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x319a4e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.915] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a4e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x319a4e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x319a4e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.915] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0074.915] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18143926\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18143926\\temporaryfile")) returned 1 [0074.915] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x319a4e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x319a4e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x319a4e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0074.915] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0074.915] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18143926" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18143926")) returned 1 [0074.915] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 0 [0075.031] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.031] WriteFile (in: hFile=0xd8, lpBuffer=0x2d70028*, nNumberOfBytesToWrite=0x387e08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2d70028*, lpNumberOfBytesWritten=0x18fdf8*=0x387e08, lpOverlapped=0x0) returned 1 [0075.102] CloseHandle (hObject=0xd8) returned 1 [0075.131] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.131] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x15b5 [0075.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15bd) returned 0x297460 [0075.131] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x15b5, lpOverlapped=0x0) returned 1 [0075.133] CloseHandle (hObject=0xd8) returned 1 [0075.133] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0075.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0075.134] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.134] GetTickCount () returned 0x23320 [0075.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0075.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0075.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0075.134] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144160\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144160\\...."), lpSecurityAttributes=0x256198) returned 1 [0075.135] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144160\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144160\\....\\temporaryfile")) returned 0 [0075.135] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144160\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144160\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144160\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144160\\temporaryfile")) returned 1 [0075.136] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144160\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31be02e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31be02e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31be02e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.136] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31be02e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31be02e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31be02e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.136] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31be02e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31be02e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31be02e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.136] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144160\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31be02e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31be02e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31be02e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.136] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31be02e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31be02e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31be02e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.137] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31be02e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31be02e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31be02e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.137] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.137] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144160\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144160\\temporaryfile")) returned 1 [0075.137] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31be02e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31be02e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31be02e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.137] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.137] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144160" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144160")) returned 1 [0075.137] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 0 [0075.137] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.138] WriteFile (in: hFile=0xd8, lpBuffer=0x298a30*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x298a30*, lpNumberOfBytesWritten=0x18fdf8*=0x15c0, lpOverlapped=0x0) returned 1 [0075.139] CloseHandle (hObject=0xd8) returned 1 [0075.141] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.141] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xd4200 [0075.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd4208) returned 0x2650020 [0075.142] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0xd4200, lpOverlapped=0x0) returned 1 [0075.154] CloseHandle (hObject=0xd8) returned 1 [0075.155] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0075.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0075.161] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.161] GetTickCount () returned 0x23330 [0075.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0075.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0075.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0075.162] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144176\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144176\\...."), lpSecurityAttributes=0x256210) returned 1 [0075.162] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144176\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144176\\....\\temporaryfile")) returned 0 [0075.162] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144176\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144176\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144176\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144176\\temporaryfile")) returned 1 [0075.163] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144176\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c06440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c06440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c06440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.164] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c06440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c06440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c06440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.164] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c06440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c06440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c06440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.164] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144176\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c06440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c06440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c06440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c06440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c06440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c06440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c06440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c06440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c06440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.164] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.164] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144176\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144176\\temporaryfile")) returned 1 [0075.164] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c06440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c06440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c06440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.164] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.164] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144176" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144176")) returned 1 [0075.164] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 0 [0075.191] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.192] WriteFile (in: hFile=0xd8, lpBuffer=0x2810028*, nNumberOfBytesToWrite=0xd4208, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2810028*, lpNumberOfBytesWritten=0x18fdf8*=0xd4208, lpOverlapped=0x0) returned 1 [0075.204] CloseHandle (hObject=0xd8) returned 1 [0075.211] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.212] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x333 [0075.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x33b) returned 0x259e70 [0075.212] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x333, lpOverlapped=0x0) returned 1 [0075.213] CloseHandle (hObject=0xd8) returned 1 [0075.213] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0075.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0075.214] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.214] GetTickCount () returned 0x2336e [0075.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0075.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0075.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0075.214] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144238\\...."), lpSecurityAttributes=0x256210) returned 1 [0075.215] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144238\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144238\\....\\temporaryfile")) returned 0 [0075.215] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144238\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144238\\temporaryfile")) returned 1 [0075.216] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144238\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c9e9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c9e9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c9e9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.216] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c9e9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c9e9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c9e9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.216] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c9e9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c9e9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c9e9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.216] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144238\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c9e9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c9e9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c9e9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.216] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c9e9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c9e9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c9e9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.216] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c9e9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c9e9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c9e9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.216] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.217] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144238\\temporaryfile")) returned 1 [0075.217] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31c9e9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31c9e9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31c9e9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.217] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.217] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144238" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144238")) returned 1 [0075.217] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 0 [0075.217] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.217] WriteFile (in: hFile=0xd8, lpBuffer=0x25a1c0*, nNumberOfBytesToWrite=0x338, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25a1c0*, lpNumberOfBytesWritten=0x18fdf8*=0x338, lpOverlapped=0x0) returned 1 [0075.218] CloseHandle (hObject=0xd8) returned 1 [0075.220] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.220] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2ed80 [0075.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ed88) returned 0x2a0a70 [0075.221] ReadFile (in: hFile=0xd8, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x2ed80, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe10*=0x2ed80, lpOverlapped=0x0) returned 1 [0075.224] CloseHandle (hObject=0xd8) returned 1 [0075.224] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0075.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0075.226] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.226] GetTickCount () returned 0x2337e [0075.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0075.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0075.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0075.227] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254\\...."), lpSecurityAttributes=0x256198) returned 1 [0075.227] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254\\....\\temporaryfile")) returned 0 [0075.227] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254\\temporaryfile")) returned 1 [0075.228] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.228] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.228] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.229] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.229] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.229] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254\\temporaryfile")) returned 1 [0075.229] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.229] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254")) returned 1 [0075.229] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 0 [0075.234] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.234] WriteFile (in: hFile=0xd8, lpBuffer=0x2cf808*, nNumberOfBytesToWrite=0x2ed88, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2cf808*, lpNumberOfBytesWritten=0x18fdf8*=0x2ed88, lpOverlapped=0x0) returned 1 [0075.237] CloseHandle (hObject=0xd8) returned 1 [0075.238] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.238] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x6a3b [0075.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6a43) returned 0x297460 [0075.238] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x6a3b, lpOverlapped=0x0) returned 1 [0075.239] CloseHandle (hObject=0xd8) returned 1 [0075.239] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0075.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0075.240] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.240] GetTickCount () returned 0x2337e [0075.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0075.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0075.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0075.241] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254\\...."), lpSecurityAttributes=0x256210) returned 1 [0075.241] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254\\....\\temporaryfile")) returned 0 [0075.241] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254\\temporaryfile")) returned 1 [0075.243] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31ceac80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31ceac80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.243] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31ceac80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31ceac80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.243] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.243] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.243] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.243] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.243] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254\\temporaryfile")) returned 1 [0075.243] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31cc4b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31cc4b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31cc4b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.243] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144254" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144254")) returned 1 [0075.244] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 0 [0075.244] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.245] WriteFile (in: hFile=0xd8, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdf8*=0x6a40, lpOverlapped=0x0) returned 1 [0075.246] CloseHandle (hObject=0xd8) returned 1 [0075.248] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.248] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x10676 [0075.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1067e) returned 0x2a0a70 [0075.249] ReadFile (in: hFile=0xd8, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe10*=0x10676, lpOverlapped=0x0) returned 1 [0075.251] CloseHandle (hObject=0xd8) returned 1 [0075.251] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0075.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0075.252] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.252] GetTickCount () returned 0x2338d [0075.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0075.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0075.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0075.253] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144269\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144269\\...."), lpSecurityAttributes=0x256198) returned 1 [0075.253] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144269\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144269\\....\\temporaryfile")) returned 0 [0075.253] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144269\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144269\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144269\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144269\\temporaryfile")) returned 1 [0075.254] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144269\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31ceac80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31ceac80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31ceac80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.254] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31ceac80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31ceac80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31ceac80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.254] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31ceac80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31ceac80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31ceac80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144269\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31ceac80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31ceac80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31ceac80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.255] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31ceac80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31ceac80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31ceac80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.255] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31ceac80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31ceac80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31ceac80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.255] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.255] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144269\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144269\\temporaryfile")) returned 1 [0075.255] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31ceac80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31ceac80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31ceac80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.255] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.255] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144269" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144269")) returned 1 [0075.255] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 0 [0075.257] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.257] WriteFile (in: hFile=0xd8, lpBuffer=0x2b1100*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b1100*, lpNumberOfBytesWritten=0x18fdf8*=0x10680, lpOverlapped=0x0) returned 1 [0075.259] CloseHandle (hObject=0xd8) returned 1 [0075.259] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.259] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2488 [0075.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2490) returned 0x297460 [0075.259] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x2488, lpOverlapped=0x0) returned 1 [0075.261] CloseHandle (hObject=0xd8) returned 1 [0075.261] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0075.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0075.262] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.262] GetTickCount () returned 0x2339d [0075.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0075.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0075.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0075.262] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285\\...."), lpSecurityAttributes=0x256210) returned 1 [0075.262] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285\\....\\temporaryfile")) returned 0 [0075.262] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285\\temporaryfile")) returned 1 [0075.264] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.264] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.264] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.264] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.264] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.264] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.264] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.264] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285\\temporaryfile")) returned 1 [0075.264] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.264] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.264] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285")) returned 1 [0075.264] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0075.265] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.265] WriteFile (in: hFile=0xd8, lpBuffer=0x299900*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x299900*, lpNumberOfBytesWritten=0x18fdf8*=0x2490, lpOverlapped=0x0) returned 1 [0075.266] CloseHandle (hObject=0xd8) returned 1 [0075.267] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.268] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xe00 [0075.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2649f0 [0075.268] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xe00, lpOverlapped=0x0) returned 1 [0075.269] CloseHandle (hObject=0xd8) returned 1 [0075.269] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0075.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0075.270] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.270] GetTickCount () returned 0x2339d [0075.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0075.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0075.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0075.271] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285\\...."), lpSecurityAttributes=0x256198) returned 1 [0075.271] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285\\....\\temporaryfile")) returned 0 [0075.271] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285\\temporaryfile")) returned 1 [0075.272] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.272] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.272] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.273] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.273] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.273] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.273] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.273] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285\\temporaryfile")) returned 1 [0075.273] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d10de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d10de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d10de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.273] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.273] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144285" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144285")) returned 1 [0075.273] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 0 [0075.274] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.274] WriteFile (in: hFile=0xd8, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdf8*=0xe08, lpOverlapped=0x0) returned 1 [0075.275] CloseHandle (hObject=0xd8) returned 1 [0075.275] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0075.275] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x31d36f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d36f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0075.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0075.275] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8691090, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.275] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8691090, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0075.276] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0xe8691090, dwReserved1=0x1d301be, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0075.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0075.276] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0075.276] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a588 [0075.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a590) returned 0x2a0a70 [0075.277] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x1a588, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a588, lpOverlapped=0x0) returned 1 [0075.279] CloseHandle (hObject=0xdc) returned 1 [0075.279] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0075.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0075.281] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.281] GetTickCount () returned 0x233ac [0075.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0075.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0075.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0075.281] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144300\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144300\\...."), lpSecurityAttributes=0x256198) returned 1 [0075.281] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144300\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144300\\....\\temporaryfile")) returned 0 [0075.281] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144300\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144300\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144300\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144300\\temporaryfile")) returned 1 [0075.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144300\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d36f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d36f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d36f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d36f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d36f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d36f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d36f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d36f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d36f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.283] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144300\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d36f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d36f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d36f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0075.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d36f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d36f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d36f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d36f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d36f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d36f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.283] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0075.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144300\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144300\\temporaryfile")) returned 1 [0075.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d36f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d36f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d36f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.283] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144300" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144300")) returned 1 [0075.283] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 0 [0075.285] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0075.286] WriteFile (in: hFile=0xdc, lpBuffer=0x2bb010*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bb010*, lpNumberOfBytesWritten=0x18fdd8*=0x1a590, lpOverlapped=0x0) returned 1 [0075.288] CloseHandle (hObject=0xdc) returned 1 [0075.288] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.288] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x31d36f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d36f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0075.288] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.288] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0075.288] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa13c510, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0075.290] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa13c510, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0075.290] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa13c510, dwReserved1=0x1d301be, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0075.290] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0xfa13c510, dwReserved1=0x1d301be, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0075.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11) returned 0x25cdd0 [0075.290] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.291] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xd4200 [0075.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd4208) returned 0x2650020 [0075.291] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0xd4200, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0xd4200, lpOverlapped=0x0) returned 1 [0075.303] CloseHandle (hObject=0xd8) returned 1 [0075.303] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0075.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0075.310] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.310] GetTickCount () returned 0x233cc [0075.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0075.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0075.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0075.311] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144332\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144332\\...."), lpSecurityAttributes=0x256210) returned 1 [0075.311] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144332\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144332\\....\\temporaryfile")) returned 0 [0075.311] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144332\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144332\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144332\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144332\\temporaryfile")) returned 1 [0075.312] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144332\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d83200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d83200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d83200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.312] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d83200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d83200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d83200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0075.312] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d83200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d83200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d83200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.312] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144332\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d83200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d83200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d83200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.312] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d83200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d83200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d83200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.312] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d83200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d83200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d83200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.312] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.312] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144332\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144332\\temporaryfile")) returned 1 [0075.313] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d83200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31d83200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31d83200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.313] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.313] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144332" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144332")) returned 1 [0075.313] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 0 [0075.339] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.340] WriteFile (in: hFile=0xd8, lpBuffer=0x2810028*, nNumberOfBytesToWrite=0xd4208, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2810028*, lpNumberOfBytesWritten=0x18fdf8*=0xd4208, lpOverlapped=0x0) returned 1 [0075.352] CloseHandle (hObject=0xd8) returned 1 [0075.359] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.360] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x333 [0075.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x33b) returned 0x259e70 [0075.360] ReadFile (in: hFile=0xd8, lpBuffer=0x259e78, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fe10*=0x333, lpOverlapped=0x0) returned 1 [0075.361] CloseHandle (hObject=0xd8) returned 1 [0075.361] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0075.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0075.362] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.362] GetTickCount () returned 0x233fa [0075.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0075.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0075.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0075.362] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144378\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144378\\...."), lpSecurityAttributes=0x256210) returned 1 [0075.363] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144378\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144378\\....\\temporaryfile")) returned 0 [0075.363] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144378\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144378\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144378\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144378\\temporaryfile")) returned 1 [0075.364] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144378\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31df5620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31df5620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31df5620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.364] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31df5620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31df5620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31df5620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.364] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31df5620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31df5620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31df5620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.364] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144378\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31df5620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31df5620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31df5620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.364] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31df5620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31df5620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31df5620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.364] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31df5620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31df5620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31df5620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.364] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.364] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144378\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144378\\temporaryfile")) returned 1 [0075.364] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31df5620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31df5620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31df5620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.364] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.365] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144378" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144378")) returned 1 [0075.365] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 0 [0075.365] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.365] WriteFile (in: hFile=0xd8, lpBuffer=0x25a1c0*, nNumberOfBytesToWrite=0x338, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25a1c0*, lpNumberOfBytesWritten=0x18fdf8*=0x338, lpOverlapped=0x0) returned 1 [0075.367] CloseHandle (hObject=0xd8) returned 1 [0075.367] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.367] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa40 [0075.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa48) returned 0x2649f0 [0075.367] ReadFile (in: hFile=0xd8, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fe10*=0xa40, lpOverlapped=0x0) returned 1 [0075.368] CloseHandle (hObject=0xd8) returned 1 [0075.369] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0075.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0075.369] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.369] GetTickCount () returned 0x2340a [0075.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0075.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0075.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0075.371] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144394\\...."), lpSecurityAttributes=0x256198) returned 1 [0075.371] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144394\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144394\\....\\temporaryfile")) returned 0 [0075.371] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144394\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144394\\temporaryfile")) returned 1 [0075.372] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144394\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31e1b780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31e1b780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31e1b780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.372] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31e1b780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31e1b780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31e1b780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.372] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31e1b780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31e1b780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31e1b780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.373] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144394\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31e1b780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31e1b780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31e1b780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.373] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31e1b780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31e1b780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31e1b780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.373] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31e1b780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31e1b780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31e1b780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.373] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.373] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144394\\temporaryfile")) returned 1 [0075.373] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31e1b780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31e1b780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31e1b780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.373] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0075.373] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144394" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144394")) returned 1 [0075.373] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0075.373] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0075.374] WriteFile (in: hFile=0xd8, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa48, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdf8*=0xa48, lpOverlapped=0x0) returned 1 [0075.374] CloseHandle (hObject=0xd8) returned 1 [0075.375] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0075.375] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x31e1b780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31e1b780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0075.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0075.375] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa2b92d0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0075.379] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa2b92d0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0075.379] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0xfa2b92d0, dwReserved1=0x1d301be, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0075.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x256198 [0075.379] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0075.380] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x266a00 [0075.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x266a08) returned 0x2650020 [0075.380] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x266a00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x266a00, lpOverlapped=0x0) returned 1 [0075.432] CloseHandle (hObject=0xdc) returned 1 [0075.432] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 1 [0075.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0075.436] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.436] GetTickCount () returned 0x23448 [0075.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0075.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0075.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0075.436] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144456\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144456\\...."), lpSecurityAttributes=0x256228) returned 1 [0075.436] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144456\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144456\\....\\temporaryfile")) returned 0 [0075.436] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144456\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144456\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144456\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144456\\temporaryfile")) returned 1 [0075.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144456\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31eb3d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31eb3d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31eb3d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.437] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31eb3d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31eb3d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31eb3d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0075.438] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31eb3d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31eb3d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31eb3d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.438] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144456\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31eb3d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31eb3d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31eb3d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0075.438] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31eb3d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31eb3d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31eb3d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.438] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31eb3d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31eb3d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31eb3d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.438] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0075.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144456\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144456\\temporaryfile")) returned 1 [0075.438] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31eb3d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x31eb3d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x31eb3d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.438] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144456" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144456")) returned 1 [0075.438] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 0 [0075.515] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0075.515] WriteFile (in: hFile=0xdc, lpBuffer=0x2b30028*, nNumberOfBytesToWrite=0x266a08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b30028*, lpNumberOfBytesWritten=0x18fdd8*=0x266a08, lpOverlapped=0x0) returned 1 [0075.566] CloseHandle (hObject=0xdc) returned 1 [0075.597] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0075.598] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x545 [0075.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54d) returned 0x259e70 [0075.598] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x545, lpOverlapped=0x0) returned 1 [0075.600] CloseHandle (hObject=0xdc) returned 1 [0075.600] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0075.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0075.601] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0075.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0075.601] GetTickCount () returned 0x234f4 [0075.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0075.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0075.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0075.602] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144628\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144628\\...."), lpSecurityAttributes=0x256198) returned 1 [0075.602] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144628\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144628\\....\\temporaryfile")) returned 0 [0075.602] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144628\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144628\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144628\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144628\\temporaryfile")) returned 1 [0075.603] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144628\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32056c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x32056c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x32056c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0075.603] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32056c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x32056c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x32056c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.603] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32056c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x32056c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x32056c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0075.603] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144628\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32056c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x32056c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x32056c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0075.603] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32056c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x32056c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x32056c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.603] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32056c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x32056c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x32056c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.603] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0075.603] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144628\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144628\\temporaryfile")) returned 1 [0075.604] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32056c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x32056c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x32056c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0075.604] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0075.604] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18144628" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18144628")) returned 1 [0075.604] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 0 [0075.604] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0075.604] WriteFile (in: hFile=0xdc, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdd8*=0x550, lpOverlapped=0x0) returned 1 [0075.605] CloseHandle (hObject=0xdc) returned 1 [0075.605] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0075.606] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ab7e94 [0075.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ab7e9c) returned 0x2650020 [0075.607] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1ab7e94, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x1ab7e94, lpOverlapped=0x0) returned 1 [0076.315] CloseHandle (hObject=0xdc) returned 1 [0076.315] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 1 [0076.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0076.322] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0076.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0076.322] GetTickCount () returned 0x237c2 [0076.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0076.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0076.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0076.323] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18145346\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18145346\\...."), lpSecurityAttributes=0x256228) returned 1 [0076.323] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18145346\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18145346\\....\\temporaryfile")) returned 0 [0076.323] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18145346\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18145346\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18145346\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18145346\\temporaryfile")) returned 1 [0076.325] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18145346\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3272eb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3272eb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3272eb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0076.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3272eb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3272eb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3272eb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3272eb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3272eb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3272eb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0076.325] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18145346\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3272eb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3272eb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3272eb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0076.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3272eb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3272eb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3272eb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3272eb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3272eb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3272eb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.325] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0076.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18145346\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18145346\\temporaryfile")) returned 1 [0076.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3272eb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3272eb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3272eb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0076.325] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0076.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18145346" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18145346")) returned 1 [0076.326] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 0 [0077.210] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0077.212] WriteFile (in: hFile=0xdc, lpBuffer=0x5bd0028*, nNumberOfBytesToWrite=0x1ab7e98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x5bd0028*, lpNumberOfBytesWritten=0x18fdd8*=0x1ab7e98, lpOverlapped=0x0) returned 1 [0077.882] CloseHandle (hObject=0xdc) returned 1 [0078.145] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0078.146] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x91975 [0078.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9197d) returned 0x1d70020 [0078.146] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0x91975, lpOverlapped=0x0) returned 1 [0078.156] CloseHandle (hObject=0xdc) returned 1 [0078.156] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0078.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0078.161] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0078.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0078.161] GetTickCount () returned 0x23ef2 [0078.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0078.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0078.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0078.162] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147186\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147186\\...."), lpSecurityAttributes=0x256198) returned 1 [0078.162] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147186\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147186\\....\\temporaryfile")) returned 0 [0078.162] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147186\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147186\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147186\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147186\\temporaryfile")) returned 1 [0078.164] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147186\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x338bcda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x338bcda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x338bcda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0078.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x338bcda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x338bcda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x338bcda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x338bcda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x338bcda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x338bcda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0078.164] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147186\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x338bcda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x338bcda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x338bcda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0078.164] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x338bcda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x338bcda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x338bcda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.164] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x338bcda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x338bcda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x338bcda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.164] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0078.164] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147186\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147186\\temporaryfile")) returned 1 [0078.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x338bcda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x338bcda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x338bcda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0078.164] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0078.164] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147186" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147186")) returned 1 [0078.164] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 0 [0078.184] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0078.184] WriteFile (in: hFile=0xdc, lpBuffer=0x26f0028*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x26f0028*, lpNumberOfBytesWritten=0x18fdd8*=0x91980, lpOverlapped=0x0) returned 1 [0078.193] CloseHandle (hObject=0xdc) returned 1 [0078.198] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0078.198] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x338e2f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x338e2f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0078.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0078.198] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0078.199] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0078.199] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe09ced0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0078.200] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe09ced0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0078.200] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0xfe09ced0, dwReserved1=0x1d301be, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0078.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x256210 [0078.200] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0078.201] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1e6600 [0078.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e6608) returned 0x2650020 [0078.201] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1e6600, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x1e6600, lpOverlapped=0x0) returned 1 [0078.240] CloseHandle (hObject=0xd8) returned 1 [0078.240] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 1 [0078.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0078.248] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0078.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0078.248] GetTickCount () returned 0x23f40 [0078.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0078.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0078.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0078.248] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147264\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147264\\...."), lpSecurityAttributes=0x256228) returned 1 [0078.249] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147264\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147264\\....\\temporaryfile")) returned 0 [0078.249] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147264\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147264\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147264\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147264\\temporaryfile")) returned 1 [0078.250] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147264\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3397b480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3397b480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3397b480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0078.250] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3397b480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3397b480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3397b480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0078.250] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3397b480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3397b480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3397b480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0078.250] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147264\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3397b480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3397b480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3397b480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0078.250] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3397b480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3397b480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3397b480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.250] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3397b480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3397b480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3397b480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.250] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0078.250] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147264\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147264\\temporaryfile")) returned 1 [0078.250] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3397b480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3397b480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3397b480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0078.251] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0078.251] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147264" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147264")) returned 1 [0078.251] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 0 [0078.315] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0078.315] WriteFile (in: hFile=0xd8, lpBuffer=0x2a30028*, nNumberOfBytesToWrite=0x1e6608, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2a30028*, lpNumberOfBytesWritten=0x18fdf8*=0x1e6608, lpOverlapped=0x0) returned 1 [0078.350] CloseHandle (hObject=0xd8) returned 1 [0078.366] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0078.367] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x10b2 [0078.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10ba) returned 0x297460 [0078.367] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x10b2, lpOverlapped=0x0) returned 1 [0078.368] CloseHandle (hObject=0xd8) returned 1 [0078.368] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0078.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0078.369] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0078.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0078.369] GetTickCount () returned 0x23fbd [0078.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0078.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0078.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0078.370] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147389\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147389\\...."), lpSecurityAttributes=0x256210) returned 1 [0078.370] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147389\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147389\\....\\temporaryfile")) returned 0 [0078.370] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147389\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147389\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147389\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147389\\temporaryfile")) returned 1 [0078.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147389\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33aabf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33aabf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33aabf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0078.371] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33aabf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33aabf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33aabf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.371] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33aabf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33aabf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33aabf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0078.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147389\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33aabf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33aabf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33aabf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0078.372] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33aabf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33aabf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33aabf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.372] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33aabf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33aabf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33aabf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.372] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0078.372] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147389\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147389\\temporaryfile")) returned 1 [0078.372] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33aabf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33aabf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33aabf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0078.372] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0078.372] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147389" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147389")) returned 1 [0078.372] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 0 [0078.372] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0078.373] WriteFile (in: hFile=0xd8, lpBuffer=0x298530*, nNumberOfBytesToWrite=0x10b8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x298530*, lpNumberOfBytesWritten=0x18fdf8*=0x10b8, lpOverlapped=0x0) returned 1 [0078.374] CloseHandle (hObject=0xd8) returned 1 [0078.375] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0078.376] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2a968 [0078.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a970) returned 0x2a0a70 [0078.377] ReadFile (in: hFile=0xd8, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x2a968, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe10*=0x2a968, lpOverlapped=0x0) returned 1 [0078.380] CloseHandle (hObject=0xd8) returned 1 [0078.380] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0078.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0078.382] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0078.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0078.382] GetTickCount () returned 0x23fcd [0078.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0078.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0078.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0078.383] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147405\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147405\\...."), lpSecurityAttributes=0x256228) returned 1 [0078.383] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147405\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147405\\....\\temporaryfile")) returned 0 [0078.383] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147405\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147405\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147405\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147405\\temporaryfile")) returned 1 [0078.384] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147405\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33ad20e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33ad20e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33ad20e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0078.385] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33ad20e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33ad20e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33ad20e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.385] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33ad20e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33ad20e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33ad20e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0078.385] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147405\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33ad20e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33ad20e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33ad20e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0078.385] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33ad20e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33ad20e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33ad20e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.385] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33ad20e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33ad20e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33ad20e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.385] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0078.385] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147405\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147405\\temporaryfile")) returned 1 [0078.385] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33ad20e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33ad20e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33ad20e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0078.385] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0078.385] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147405" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147405")) returned 1 [0078.385] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 0 [0078.389] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0078.389] WriteFile (in: hFile=0xd8, lpBuffer=0x2cb3f0*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2cb3f0*, lpNumberOfBytesWritten=0x18fdf8*=0x2a970, lpOverlapped=0x0) returned 1 [0078.392] CloseHandle (hObject=0xd8) returned 1 [0078.392] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0078.395] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x709768 [0078.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x709770) returned 0x2650020 [0078.395] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x709768, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x709768, lpOverlapped=0x0) returned 1 [0078.560] CloseHandle (hObject=0xd8) returned 1 [0078.560] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 1 [0078.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0078.561] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0078.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0078.562] GetTickCount () returned 0x24078 [0078.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0078.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0078.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0078.562] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147576\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147576\\...."), lpSecurityAttributes=0x256210) returned 1 [0078.562] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147576\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147576\\....\\temporaryfile")) returned 0 [0078.563] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147576\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147576\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147576\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147576\\temporaryfile")) returned 1 [0078.564] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147576\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c75000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33c75000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33c75000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0078.564] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c75000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33c75000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33c75000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.564] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c75000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33c75000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33c75000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0078.564] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147576\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c75000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33c75000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33c75000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0078.564] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c75000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33c75000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33c75000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.564] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c75000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33c75000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33c75000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.564] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0078.564] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147576\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147576\\temporaryfile")) returned 1 [0078.565] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c75000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x33c75000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x33c75000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0078.565] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0078.565] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18147576" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18147576")) returned 1 [0078.565] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 0 [0078.816] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0078.817] WriteFile (in: hFile=0xd8, lpBuffer=0x3470028*, nNumberOfBytesToWrite=0x709770, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x3470028*, lpNumberOfBytesWritten=0x18fdf8*=0x709770, lpOverlapped=0x0) returned 1 [0078.969] CloseHandle (hObject=0xd8) returned 1 [0079.030] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0079.031] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x228df5c [0079.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x228df64) returned 0x2650020 [0079.032] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x228df5c, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x228df5c, lpOverlapped=0x0) returned 1 [0079.850] CloseHandle (hObject=0xd8) returned 1 [0079.850] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 1 [0079.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0079.857] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0079.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0079.858] GetTickCount () returned 0x24587 [0079.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0079.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0079.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0079.858] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18148871\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18148871\\...."), lpSecurityAttributes=0x256228) returned 1 [0079.859] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18148871\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18148871\\....\\temporaryfile")) returned 0 [0079.859] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18148871\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18148871\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18148871\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18148871\\temporaryfile")) returned 1 [0079.860] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18148871\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x348ce220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x348ce220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x348ce220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0079.861] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x348ce220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x348ce220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x348ce220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.861] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x348ce220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x348ce220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x348ce220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0079.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18148871\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x348ce220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x348ce220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x348ce220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0079.861] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x348ce220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x348ce220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x348ce220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.861] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x348ce220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x348ce220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x348ce220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0079.861] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0079.861] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18148871\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18148871\\temporaryfile")) returned 1 [0079.861] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x348ce220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x348ce220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x348ce220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0079.861] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0079.861] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18148871" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18148871")) returned 1 [0079.861] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 0 [0081.589] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0081.590] WriteFile (in: hFile=0xd8, lpBuffer=0x6b70028*, nNumberOfBytesToWrite=0x228df60, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x6b70028*, lpNumberOfBytesWritten=0x18fdf8*=0x228df60, lpOverlapped=0x0) returned 1 [0082.446] CloseHandle (hObject=0xd8) returned 1 [0082.782] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0082.784] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x165510 [0082.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x165518) returned 0x2650020 [0082.784] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x165510, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x165510, lpOverlapped=0x0) returned 1 [0082.824] CloseHandle (hObject=0xd8) returned 1 [0082.824] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0082.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0082.828] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0082.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0082.828] GetTickCount () returned 0x2512b [0082.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0082.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0082.829] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0082.829] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151851\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151851\\...."), lpSecurityAttributes=0x256210) returned 1 [0082.829] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151851\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151851\\....\\temporaryfile")) returned 0 [0082.829] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151851\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151851\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151851\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151851\\temporaryfile")) returned 1 [0082.831] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151851\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x365388c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x365388c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x365388c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0082.831] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x365388c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x365388c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x365388c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.831] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x365388c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x365388c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x365388c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0082.831] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151851\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x365388c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x365388c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x365388c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0082.831] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x365388c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x365388c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x365388c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.831] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x365388c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x365388c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x365388c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.831] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0082.831] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151851\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151851\\temporaryfile")) returned 1 [0082.831] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x365388c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x365388c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x365388c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0082.831] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0082.832] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151851" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151851")) returned 1 [0082.832] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 0 [0082.914] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0082.915] WriteFile (in: hFile=0xd8, lpBuffer=0x2930028*, nNumberOfBytesToWrite=0x165518, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2930028*, lpNumberOfBytesWritten=0x18fdf8*=0x165518, lpOverlapped=0x0) returned 1 [0082.938] CloseHandle (hObject=0xd8) returned 1 [0082.950] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0082.951] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xaec3a [0082.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaec42) returned 0x1d70020 [0082.951] ReadFile (in: hFile=0xd8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe10*=0xaec3a, lpOverlapped=0x0) returned 1 [0082.966] CloseHandle (hObject=0xd8) returned 1 [0082.966] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0082.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0082.972] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0082.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0082.972] GetTickCount () returned 0x251b7 [0082.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0082.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0082.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0082.972] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151991\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151991\\...."), lpSecurityAttributes=0x256228) returned 1 [0082.973] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151991\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151991\\....\\temporaryfile")) returned 0 [0082.973] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151991\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151991\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151991\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151991\\temporaryfile")) returned 1 [0082.974] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151991\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3668f520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3668f520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3668f520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0082.974] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3668f520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3668f520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3668f520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.974] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3668f520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3668f520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3668f520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0082.974] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151991\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3668f520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3668f520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3668f520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0082.975] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3668f520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3668f520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3668f520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.975] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3668f520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3668f520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3668f520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0082.975] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0082.975] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151991\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151991\\temporaryfile")) returned 1 [0082.975] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3668f520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3668f520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3668f520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0082.975] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0082.975] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18151991" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18151991")) returned 1 [0082.975] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 0 [0083.007] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0083.008] WriteFile (in: hFile=0xd8, lpBuffer=0x2700028*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2700028*, lpNumberOfBytesWritten=0x18fdf8*=0xaec40, lpOverlapped=0x0) returned 1 [0083.029] CloseHandle (hObject=0xd8) returned 1 [0083.035] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0083.039] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1a41c00 [0083.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a41c08) returned 0x2650020 [0083.040] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1a41c00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x1a41c00, lpOverlapped=0x0) returned 1 [0083.909] CloseHandle (hObject=0xd8) returned 1 [0083.909] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 1 [0083.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0083.914] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0083.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0083.914] GetTickCount () returned 0x2555f [0083.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0083.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0083.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0083.914] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18152927\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18152927\\...."), lpSecurityAttributes=0x256210) returned 1 [0083.915] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18152927\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18152927\\....\\temporaryfile")) returned 0 [0083.915] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18152927\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18152927\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18152927\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18152927\\temporaryfile")) returned 1 [0083.916] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18152927\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x36f7c7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x36f7c7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x36f7c7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0083.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x36f7c7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x36f7c7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x36f7c7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x36f7c7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x36f7c7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x36f7c7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0083.916] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18152927\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x36f7c7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x36f7c7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x36f7c7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0083.916] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x36f7c7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x36f7c7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x36f7c7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.917] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x36f7c7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x36f7c7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x36f7c7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0083.917] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0083.917] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18152927\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18152927\\temporaryfile")) returned 1 [0083.917] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x36f7c7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x36f7c7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x36f7c7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0083.917] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0083.917] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18152927" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18152927")) returned 1 [0083.917] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 0 [0085.304] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0085.306] WriteFile (in: hFile=0xd8, lpBuffer=0x5af0028*, nNumberOfBytesToWrite=0x1a41c08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x5af0028*, lpNumberOfBytesWritten=0x18fdf8*=0x1a41c08, lpOverlapped=0x0) returned 1 [0086.182] CloseHandle (hObject=0xd8) returned 1 [0086.445] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0086.446] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x41d4 [0086.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x41dc) returned 0x297460 [0086.446] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x41d4, lpOverlapped=0x0) returned 1 [0086.448] CloseHandle (hObject=0xd8) returned 1 [0086.448] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0086.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0086.449] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0086.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0086.449] GetTickCount () returned 0x25f4e [0086.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0086.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0086.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0086.449] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18155470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18155470\\...."), lpSecurityAttributes=0x256228) returned 1 [0086.450] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18155470\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18155470\\....\\temporaryfile")) returned 0 [0086.450] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18155470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18155470\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18155470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18155470\\temporaryfile")) returned 1 [0086.451] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18155470\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x387bc7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x387bc7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x387bc7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0086.452] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x387bc7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x387bc7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x387bc7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.452] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x387bc7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x387bc7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x387bc7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0086.452] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18155470\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x387bc7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x387bc7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x387bc7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0086.452] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x387bc7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x387bc7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x387bc7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.452] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x387bc7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x387bc7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x387bc7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.452] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0086.452] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18155470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18155470\\temporaryfile")) returned 1 [0086.452] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x387bc7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x387bc7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x387bc7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0086.452] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0086.452] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18155470" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18155470")) returned 1 [0086.452] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 0 [0086.453] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0086.453] WriteFile (in: hFile=0xd8, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x41d8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdf8*=0x41d8, lpOverlapped=0x0) returned 1 [0086.454] CloseHandle (hObject=0xd8) returned 1 [0086.456] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0086.457] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa97cbdb [0086.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa97cbe3) returned 0x2650020 [0086.462] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0xa97cbdb, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0xa97cbdb, lpOverlapped=0x0) returned 1 [0092.206] CloseHandle (hObject=0xd8) returned 1 [0092.206] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 1 [0092.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0092.223] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0092.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0092.223] GetTickCount () returned 0x275da [0092.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0092.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0092.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0092.224] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18161242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18161242\\...."), lpSecurityAttributes=0x256210) returned 1 [0092.225] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18161242\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18161242\\....\\temporaryfile")) returned 0 [0092.225] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18161242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18161242\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18161242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18161242\\temporaryfile")) returned 1 [0092.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18161242\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3bec8480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3bec8480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3bec8480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0092.229] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3bec8480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3bec8480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3bec8480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.229] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3bec8480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3bec8480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3bec8480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0092.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18161242\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3bec8480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3bec8480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3bec8480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0092.229] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3bec8480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3bec8480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3bec8480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.229] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3bec8480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3bec8480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3bec8480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0092.229] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0092.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18161242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18161242\\temporaryfile")) returned 1 [0092.230] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3bec8480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x3bec8480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x3bec8480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0092.230] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0092.230] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18161242" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18161242")) returned 1 [0092.230] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 0 [0101.186] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0101.189] WriteFile (in: hFile=0xd8, lpBuffer=0x17950028*, nNumberOfBytesToWrite=0xa97cbe0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x17950028*, lpNumberOfBytesWritten=0x18fdf8*=0xa97cbe0, lpOverlapped=0x0) returned 1 [0105.485] CloseHandle (hObject=0xd8) returned 1 [0106.931] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0106.932] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xd49ee31 [0106.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd49ee39) returned 0x2650020 [0106.938] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0xd49ee31, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0xd49ee31, lpOverlapped=0x0) returned 1 [0113.445] CloseHandle (hObject=0xd8) returned 1 [0113.445] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 1 [0113.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0113.465] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0113.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0113.465] GetTickCount () returned 0x2c8ca [0113.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0113.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0113.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0113.469] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18182474\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18182474\\...."), lpSecurityAttributes=0x256228) returned 1 [0113.469] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18182474\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18182474\\....\\temporaryfile")) returned 0 [0113.470] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18182474\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18182474\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18182474\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18182474\\temporaryfile")) returned 1 [0113.472] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18182474\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x489433e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x489433e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x489433e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0113.472] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x489433e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x489433e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x489433e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.472] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x489433e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x489433e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x489433e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0113.472] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18182474\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x489433e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x489433e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x489433e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0113.472] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x489433e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x489433e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x489433e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.472] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x489433e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x489433e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x489433e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0113.472] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0113.472] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18182474\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18182474\\temporaryfile")) returned 1 [0113.472] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x489433e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x489433e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x489433e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0113.472] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0113.473] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18182474" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18182474")) returned 1 [0113.473] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 0 [0124.518] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0124.519] WriteFile (in: hFile=0xd8, lpBuffer=0x1cf90028*, nNumberOfBytesToWrite=0xd49ee38, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x1cf90028*, lpNumberOfBytesWritten=0x18fdf8*=0xd49ee38, lpOverlapped=0x0) returned 1 [0129.448] CloseHandle (hObject=0xd8) returned 1 [0131.465] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.466] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x150578 [0131.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x150580) returned 0x2650020 [0131.466] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x150578, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x150578, lpOverlapped=0x0) returned 1 [0131.498] CloseHandle (hObject=0xd8) returned 1 [0131.498] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0131.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0131.502] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0131.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0131.502] GetTickCount () returned 0x30f3c [0131.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0131.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0131.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0131.503] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200508\\...."), lpSecurityAttributes=0x256210) returned 1 [0131.503] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200508\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200508\\....\\temporaryfile")) returned 0 [0131.504] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200508\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200508\\temporaryfile")) returned 1 [0131.509] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200508\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5353e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5353e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5353e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0131.510] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5353e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5353e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5353e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.510] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5353e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5353e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5353e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0131.510] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200508\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5353e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5353e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5353e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0131.510] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5353e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5353e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5353e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.510] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5353e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5353e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5353e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0131.510] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0131.510] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200508\\temporaryfile")) returned 1 [0131.510] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5353e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5353e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5353e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0131.510] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0131.510] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200508" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200508")) returned 1 [0131.510] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 0 [0131.574] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.575] WriteFile (in: hFile=0xd8, lpBuffer=0x2910028*, nNumberOfBytesToWrite=0x150580, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2910028*, lpNumberOfBytesWritten=0x18fdf8*=0x150580, lpOverlapped=0x0) returned 1 [0131.613] CloseHandle (hObject=0xd8) returned 1 [0131.633] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.634] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x7976 [0131.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x797e) returned 0x2a0a70 [0131.635] ReadFile (in: hFile=0xd8, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe10*=0x7976, lpOverlapped=0x0) returned 1 [0131.637] CloseHandle (hObject=0xd8) returned 1 [0131.637] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0131.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0131.638] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0131.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0131.638] GetTickCount () returned 0x30fc8 [0131.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0131.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0131.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0131.639] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200648\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200648\\...."), lpSecurityAttributes=0x256228) returned 1 [0131.639] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200648\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200648\\....\\temporaryfile")) returned 0 [0131.639] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200648\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200648\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200648\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200648\\temporaryfile")) returned 1 [0131.640] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200648\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x536955c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x536955c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x536955c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0131.641] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x536955c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x536955c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x536955c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.641] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x536955c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x536955c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x536955c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0131.641] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200648\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x536955c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x536955c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x536955c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0131.641] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x536955c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x536955c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x536955c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.641] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x536955c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x536955c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x536955c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0131.641] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0131.641] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200648\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200648\\temporaryfile")) returned 1 [0131.641] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x536955c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x536955c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x536955c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0131.641] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0131.641] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200648" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200648")) returned 1 [0131.641] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0131.642] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.643] WriteFile (in: hFile=0xd8, lpBuffer=0x2a8400*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2a8400*, lpNumberOfBytesWritten=0x18fdf8*=0x7980, lpOverlapped=0x0) returned 1 [0131.644] CloseHandle (hObject=0xd8) returned 1 [0131.644] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0131.644] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x536955c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x536955c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0131.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0131.644] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0131.644] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa5cd3a40, dwReserved1=0x1d305f1, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0131.646] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa5cd3a40, dwReserved1=0x1d305f1, cFileName="..", cAlternateFileName="")) returned 1 [0131.646] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0xa5cd3a40, dwReserved1=0x1d305f1, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0131.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x256210 [0131.646] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.647] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1e6600 [0131.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e6608) returned 0x2650020 [0131.647] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1e6600, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x1e6600, lpOverlapped=0x0) returned 1 [0131.692] CloseHandle (hObject=0xd8) returned 1 [0131.692] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 1 [0131.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0131.700] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0131.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0131.700] GetTickCount () returned 0x31006 [0131.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0131.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0131.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0131.701] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200710\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200710\\...."), lpSecurityAttributes=0x256228) returned 1 [0131.701] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200710\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200710\\....\\temporaryfile")) returned 0 [0131.701] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200710\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200710\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200710\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200710\\temporaryfile")) returned 1 [0131.703] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200710\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5372db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5372db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5372db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0131.703] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5372db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5372db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5372db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0131.703] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5372db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5372db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5372db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0131.703] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200710\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5372db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5372db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5372db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0131.703] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5372db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5372db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5372db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.703] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5372db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5372db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5372db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0131.703] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0131.703] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200710\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200710\\temporaryfile")) returned 1 [0131.703] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5372db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5372db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5372db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0131.704] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0131.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200710" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200710")) returned 1 [0131.704] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 0 [0131.797] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.797] WriteFile (in: hFile=0xd8, lpBuffer=0x2a30028*, nNumberOfBytesToWrite=0x1e6608, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2a30028*, lpNumberOfBytesWritten=0x18fdf8*=0x1e6608, lpOverlapped=0x0) returned 1 [0131.828] CloseHandle (hObject=0xd8) returned 1 [0131.844] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.845] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x10b2 [0131.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10ba) returned 0x297460 [0131.845] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x10b2, lpOverlapped=0x0) returned 1 [0131.846] CloseHandle (hObject=0xd8) returned 1 [0131.846] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0131.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0131.847] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0131.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0131.847] GetTickCount () returned 0x31093 [0131.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0131.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0131.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0131.848] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200851\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200851\\...."), lpSecurityAttributes=0x256210) returned 1 [0131.848] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200851\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200851\\....\\temporaryfile")) returned 0 [0131.848] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200851\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200851\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200851\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200851\\temporaryfile")) returned 1 [0131.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200851\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538847a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538847a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538847a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0131.850] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538847a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538847a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538847a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.850] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538847a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538847a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538847a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0131.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200851\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538847a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538847a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538847a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0131.850] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538847a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538847a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538847a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.850] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538847a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538847a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538847a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0131.850] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0131.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200851\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200851\\temporaryfile")) returned 1 [0131.850] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538847a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538847a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538847a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0131.850] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0131.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200851" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200851")) returned 1 [0131.851] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 0 [0131.851] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.851] WriteFile (in: hFile=0xd8, lpBuffer=0x298530*, nNumberOfBytesToWrite=0x10b8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x298530*, lpNumberOfBytesWritten=0x18fdf8*=0x10b8, lpOverlapped=0x0) returned 1 [0131.852] CloseHandle (hObject=0xd8) returned 1 [0131.854] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.854] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2a968 [0131.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a970) returned 0x2a0a70 [0131.855] ReadFile (in: hFile=0xd8, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x2a968, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe10*=0x2a968, lpOverlapped=0x0) returned 1 [0131.859] CloseHandle (hObject=0xd8) returned 1 [0131.859] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0131.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0131.861] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0131.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0131.861] GetTickCount () returned 0x310a2 [0131.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0131.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0131.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0131.861] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200866\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200866\\...."), lpSecurityAttributes=0x256228) returned 1 [0131.862] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200866\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200866\\....\\temporaryfile")) returned 0 [0131.862] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200866\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200866\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200866\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200866\\temporaryfile")) returned 1 [0131.863] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200866\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538aa900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538aa900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538aa900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0131.863] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538aa900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538aa900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538aa900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.863] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538aa900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538aa900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538aa900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0131.863] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200866\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538aa900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538aa900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538aa900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0131.863] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538aa900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538aa900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538aa900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.863] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538aa900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538aa900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538aa900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0131.864] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0131.864] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200866\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200866\\temporaryfile")) returned 1 [0131.864] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x538aa900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x538aa900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x538aa900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0131.864] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0131.864] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18200866" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18200866")) returned 1 [0131.864] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 0 [0131.869] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.869] WriteFile (in: hFile=0xd8, lpBuffer=0x2cb3f0*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2cb3f0*, lpNumberOfBytesWritten=0x18fdf8*=0x2a970, lpOverlapped=0x0) returned 1 [0131.872] CloseHandle (hObject=0xd8) returned 1 [0131.872] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0131.873] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x709768 [0131.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x709770) returned 0x2650020 [0131.873] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x709768, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x709768, lpOverlapped=0x0) returned 1 [0132.099] CloseHandle (hObject=0xd8) returned 1 [0132.099] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 1 [0132.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0132.101] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0132.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0132.101] GetTickCount () returned 0x3118c [0132.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0132.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0132.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0132.101] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18201100\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18201100\\...."), lpSecurityAttributes=0x256210) returned 1 [0132.102] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18201100\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18201100\\....\\temporaryfile")) returned 0 [0132.102] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18201100\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18201100\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18201100\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18201100\\temporaryfile")) returned 1 [0132.103] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18201100\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53ae5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x53ae5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x53ae5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0132.103] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53ae5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x53ae5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x53ae5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.103] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53ae5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x53ae5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x53ae5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0132.103] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18201100\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53ae5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x53ae5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x53ae5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0132.104] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53ae5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x53ae5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x53ae5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.104] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53ae5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x53ae5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x53ae5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0132.104] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0132.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18201100\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18201100\\temporaryfile")) returned 1 [0132.104] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53ae5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x53ae5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x53ae5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0132.104] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0132.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18201100" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18201100")) returned 1 [0132.104] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 0 [0132.420] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.420] WriteFile (in: hFile=0xd8, lpBuffer=0x3470028*, nNumberOfBytesToWrite=0x709770, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x3470028*, lpNumberOfBytesWritten=0x18fdf8*=0x709770, lpOverlapped=0x0) returned 1 [0132.552] CloseHandle (hObject=0xd8) returned 1 [0132.649] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0132.651] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x228df5c [0132.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x228df64) returned 0x2650020 [0132.652] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x228df5c, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x228df5c, lpOverlapped=0x0) returned 1 [0133.607] CloseHandle (hObject=0xd8) returned 1 [0133.607] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 1 [0133.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0133.614] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0133.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0133.614] GetTickCount () returned 0x31776 [0133.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0133.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0133.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0133.615] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18202614\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18202614\\...."), lpSecurityAttributes=0x256228) returned 1 [0133.615] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18202614\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18202614\\....\\temporaryfile")) returned 0 [0133.616] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18202614\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18202614\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18202614\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18202614\\temporaryfile")) returned 1 [0133.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18202614\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x54954300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x54954300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x54954300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0133.617] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x54954300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x54954300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x54954300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.618] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x54954300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x54954300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x54954300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0133.618] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18202614\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x54954300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x54954300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x54954300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0133.618] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x54954300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x54954300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x54954300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.618] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x54954300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x54954300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x54954300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0133.618] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0133.618] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18202614\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18202614\\temporaryfile")) returned 1 [0133.618] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x54954300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x54954300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x54954300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0133.618] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0133.618] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18202614" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18202614")) returned 1 [0133.618] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 0 [0135.437] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0135.438] WriteFile (in: hFile=0xd8, lpBuffer=0x6b70028*, nNumberOfBytesToWrite=0x228df60, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x6b70028*, lpNumberOfBytesWritten=0x18fdf8*=0x228df60, lpOverlapped=0x0) returned 1 [0136.206] CloseHandle (hObject=0xd8) returned 1 [0136.492] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.493] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x165510 [0136.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x165518) returned 0x2650020 [0136.493] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x165510, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x165510, lpOverlapped=0x0) returned 1 [0136.527] CloseHandle (hObject=0xd8) returned 1 [0136.527] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0136.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0136.531] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0136.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0136.531] GetTickCount () returned 0x322db [0136.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0136.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0136.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0136.532] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205531\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205531\\...."), lpSecurityAttributes=0x256210) returned 1 [0136.532] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205531\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205531\\....\\temporaryfile")) returned 0 [0136.532] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205531\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205531\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205531\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205531\\temporaryfile")) returned 1 [0136.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205531\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56526420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56526420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56526420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0136.534] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56526420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56526420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56526420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.534] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56526420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56526420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56526420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0136.534] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205531\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56526420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56526420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56526420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0136.534] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56526420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56526420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56526420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.534] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56526420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56526420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56526420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0136.534] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0136.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205531\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205531\\temporaryfile")) returned 1 [0136.534] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56526420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56526420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56526420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0136.534] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0136.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205531" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205531")) returned 1 [0136.534] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 0 [0136.608] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.608] WriteFile (in: hFile=0xd8, lpBuffer=0x2930028*, nNumberOfBytesToWrite=0x165518, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2930028*, lpNumberOfBytesWritten=0x18fdf8*=0x165518, lpOverlapped=0x0) returned 1 [0136.637] CloseHandle (hObject=0xd8) returned 1 [0136.649] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.650] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xaec3a [0136.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaec42) returned 0x1d70020 [0136.650] ReadFile (in: hFile=0xd8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe10*=0xaec3a, lpOverlapped=0x0) returned 1 [0136.664] CloseHandle (hObject=0xd8) returned 1 [0136.664] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0136.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0136.669] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0136.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0136.669] GetTickCount () returned 0x32367 [0136.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0136.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0136.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0136.670] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205671\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205671\\...."), lpSecurityAttributes=0x256228) returned 1 [0136.670] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205671\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205671\\....\\temporaryfile")) returned 0 [0136.670] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205671\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205671\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205671\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205671\\temporaryfile")) returned 1 [0136.672] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205671\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5667d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5667d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5667d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0136.672] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5667d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5667d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5667d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.672] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5667d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5667d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5667d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0136.672] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205671\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5667d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5667d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5667d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0136.672] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5667d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5667d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5667d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0136.672] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5667d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5667d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5667d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0136.672] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0136.672] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205671\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205671\\temporaryfile")) returned 1 [0136.672] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5667d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5667d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5667d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0136.672] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0136.672] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18205671" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18205671")) returned 1 [0136.673] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 0 [0136.705] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.706] WriteFile (in: hFile=0xd8, lpBuffer=0x2700028*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2700028*, lpNumberOfBytesWritten=0x18fdf8*=0xaec40, lpOverlapped=0x0) returned 1 [0136.717] CloseHandle (hObject=0xd8) returned 1 [0136.723] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0136.724] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa4c400 [0136.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa4c408) returned 0x2650020 [0136.725] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0xa4c400, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0xa4c400, lpOverlapped=0x0) returned 1 [0137.043] CloseHandle (hObject=0xd8) returned 1 [0137.043] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 1 [0137.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0137.047] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0137.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0137.047] GetTickCount () returned 0x324de [0137.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0137.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0137.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0137.048] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206046\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206046\\...."), lpSecurityAttributes=0x256210) returned 1 [0137.048] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206046\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206046\\....\\temporaryfile")) returned 0 [0137.048] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206046\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206046\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206046\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206046\\temporaryfile")) returned 1 [0137.050] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206046\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56a0f180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56a0f180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56a0f180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0137.050] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56a0f180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56a0f180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56a0f180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.050] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56a0f180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56a0f180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56a0f180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0137.050] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206046\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56a0f180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56a0f180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56a0f180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0137.050] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56a0f180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56a0f180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56a0f180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.050] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56a0f180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56a0f180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56a0f180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0137.050] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0137.051] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206046\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206046\\temporaryfile")) returned 1 [0137.051] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56a0f180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x56a0f180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x56a0f180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0137.051] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0137.051] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206046" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206046")) returned 1 [0137.051] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 0 [0137.568] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.568] WriteFile (in: hFile=0xd8, lpBuffer=0x3af0028*, nNumberOfBytesToWrite=0xa4c408, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x3af0028*, lpNumberOfBytesWritten=0x18fdf8*=0xa4c408, lpOverlapped=0x0) returned 1 [0137.792] CloseHandle (hObject=0xd8) returned 1 [0137.882] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.884] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1915 [0137.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x191d) returned 0x297460 [0137.884] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x1915, lpOverlapped=0x0) returned 1 [0137.885] CloseHandle (hObject=0xd8) returned 1 [0137.885] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0137.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0137.886] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0137.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0137.886] GetTickCount () returned 0x32828 [0137.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0137.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0137.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0137.887] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206888\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206888\\...."), lpSecurityAttributes=0x256228) returned 1 [0137.887] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206888\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206888\\....\\temporaryfile")) returned 0 [0137.887] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206888\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206888\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206888\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206888\\temporaryfile")) returned 1 [0137.889] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206888\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57217bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x57217bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x57217bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0137.889] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57217bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x57217bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x57217bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.889] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57217bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x57217bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x57217bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0137.889] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206888\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57217bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x57217bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x57217bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0137.889] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57217bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x57217bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x57217bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.889] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57217bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x57217bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x57217bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0137.889] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0137.889] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206888\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206888\\temporaryfile")) returned 1 [0137.889] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57217bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x57217bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x57217bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0137.889] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0137.890] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18206888" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18206888")) returned 1 [0137.890] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 0 [0137.890] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.890] WriteFile (in: hFile=0xd8, lpBuffer=0x298d90*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x298d90*, lpNumberOfBytesWritten=0x18fdf8*=0x1920, lpOverlapped=0x0) returned 1 [0137.892] CloseHandle (hObject=0xd8) returned 1 [0137.894] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0137.894] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9b6ba9f [0137.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9b6baa7) returned 0x2650020 [0137.898] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x9b6ba9f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x9b6ba9f, lpOverlapped=0x0) returned 1 [0142.945] CloseHandle (hObject=0xd8) returned 1 [0142.945] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 1 [0142.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0142.961] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0142.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0142.961] GetTickCount () returned 0x33c06 [0142.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0142.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0142.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0142.964] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18211974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18211974\\...."), lpSecurityAttributes=0x256210) returned 1 [0142.968] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18211974\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18211974\\....\\temporaryfile")) returned 0 [0142.969] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18211974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18211974\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18211974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18211974\\temporaryfile")) returned 1 [0142.970] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18211974\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a297c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5a297c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5a297c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0142.970] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a297c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5a297c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5a297c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.970] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a297c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5a297c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5a297c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0142.970] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18211974\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a297c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5a297c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5a297c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0142.970] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a297c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5a297c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5a297c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.970] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a297c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5a297c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5a297c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.971] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0142.971] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18211974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18211974\\temporaryfile")) returned 1 [0142.971] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a297c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x5a297c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x5a297c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0142.971] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0142.971] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18211974" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18211974")) returned 1 [0142.971] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 0 [0147.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x9b6bab0) returned 0x15d30020 [0151.520] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0151.521] WriteFile (in: hFile=0xd8, lpBuffer=0x15d30028*, nNumberOfBytesToWrite=0x9b6baa8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x15d30028*, lpNumberOfBytesWritten=0x18fdf8*=0x9b6baa8, lpOverlapped=0x0) returned 1 [0155.156] CloseHandle (hObject=0xd8) returned 1 [0156.563] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.563] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x150578 [0156.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x150580) returned 0x2650020 [0156.564] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x150578, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x150578, lpOverlapped=0x0) returned 1 [0156.606] CloseHandle (hObject=0xd8) returned 1 [0156.606] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0156.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0156.610] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0156.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0156.610] GetTickCount () returned 0x37148 [0156.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0156.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0156.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0156.612] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225608\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225608\\...."), lpSecurityAttributes=0x256228) returned 1 [0156.613] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225608\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225608\\....\\temporaryfile")) returned 0 [0156.613] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225608\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225608\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225608\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225608\\temporaryfile")) returned 1 [0156.615] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225608\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6249edc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x624c4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x624c4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0156.615] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6249edc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x624c4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x624c4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.615] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x624c4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x624c4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x624c4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0156.615] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225608\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x624c4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x624c4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x624c4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0156.615] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x624c4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x624c4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x624c4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.615] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x624c4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x624c4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x624c4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0156.615] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0156.615] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225608\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225608\\temporaryfile")) returned 1 [0156.615] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x624c4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x624c4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x624c4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0156.615] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0156.616] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225608" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225608")) returned 1 [0156.616] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 0 [0156.673] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.674] WriteFile (in: hFile=0xd8, lpBuffer=0x2910028*, nNumberOfBytesToWrite=0x150580, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2910028*, lpNumberOfBytesWritten=0x18fdf8*=0x150580, lpOverlapped=0x0) returned 1 [0156.700] CloseHandle (hObject=0xd8) returned 1 [0156.712] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.713] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x412b [0156.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4133) returned 0x297460 [0156.713] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x412b, lpOverlapped=0x0) returned 1 [0156.715] CloseHandle (hObject=0xd8) returned 1 [0156.715] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0156.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0156.716] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0156.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0156.716] GetTickCount () returned 0x371b5 [0156.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0156.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0156.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0156.717] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225717\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225717\\...."), lpSecurityAttributes=0x256210) returned 1 [0156.717] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225717\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225717\\....\\temporaryfile")) returned 0 [0156.717] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225717\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225717\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225717\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225717\\temporaryfile")) returned 1 [0156.718] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225717\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x625a9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x625a9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x625a9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0156.718] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x625a9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x625a9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x625a9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.719] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x625a9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x625a9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x625a9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0156.719] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225717\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x625a9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x625a9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x625a9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0156.719] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x625a9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x625a9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x625a9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.719] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x625a9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x625a9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x625a9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0156.719] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0156.719] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225717\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225717\\temporaryfile")) returned 1 [0156.719] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x625a9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x625a9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x625a9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0156.719] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0156.719] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225717" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225717")) returned 1 [0156.719] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0156.721] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.721] WriteFile (in: hFile=0xd8, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdf8*=0x4130, lpOverlapped=0x0) returned 1 [0156.722] CloseHandle (hObject=0xd8) returned 1 [0156.723] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0156.724] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x625cf8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x625cf8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0156.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0156.724] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0156.724] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x46538340, dwReserved1=0x1d305eb, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0156.726] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x46538340, dwReserved1=0x1d305eb, cFileName="..", cAlternateFileName="")) returned 1 [0156.726] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x46538340, dwReserved1=0x1d305eb, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0156.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x256228 [0156.726] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.727] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1e6600 [0156.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e6608) returned 0x2650020 [0156.727] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1e6600, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x1e6600, lpOverlapped=0x0) returned 1 [0156.781] CloseHandle (hObject=0xd8) returned 1 [0156.781] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 1 [0156.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0156.789] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0156.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0156.789] GetTickCount () returned 0x37203 [0156.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0156.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0156.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0156.790] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225795\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225795\\...."), lpSecurityAttributes=0x256210) returned 1 [0156.790] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225795\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225795\\....\\temporaryfile")) returned 0 [0156.790] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225795\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225795\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225795\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225795\\temporaryfile")) returned 1 [0156.791] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225795\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62667e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62667e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62667e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0156.792] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62667e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62667e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62667e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0156.792] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62667e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62667e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62667e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0156.792] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225795\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62667e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62667e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62667e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0156.792] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62667e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62667e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62667e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.792] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62667e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62667e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62667e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0156.792] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0156.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225795\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225795\\temporaryfile")) returned 1 [0156.792] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62667e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62667e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62667e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0156.792] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0156.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225795" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225795")) returned 1 [0156.792] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 0 [0156.886] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.886] WriteFile (in: hFile=0xd8, lpBuffer=0x2a30028*, nNumberOfBytesToWrite=0x1e6608, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2a30028*, lpNumberOfBytesWritten=0x18fdf8*=0x1e6608, lpOverlapped=0x0) returned 1 [0156.924] CloseHandle (hObject=0xd8) returned 1 [0156.941] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.942] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x10b2 [0156.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10ba) returned 0x297460 [0156.942] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x10b2, lpOverlapped=0x0) returned 1 [0156.943] CloseHandle (hObject=0xd8) returned 1 [0156.943] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0156.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0156.944] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0156.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0156.944] GetTickCount () returned 0x3729f [0156.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0156.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0156.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0156.945] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225951\\...."), lpSecurityAttributes=0x256228) returned 1 [0156.945] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225951\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225951\\....\\temporaryfile")) returned 0 [0156.946] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225951\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225951\\temporaryfile")) returned 1 [0156.947] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225951\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x627e4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x627e4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x627e4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0156.947] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x627e4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x627e4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x627e4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.947] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x627e4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x627e4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x627e4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0156.947] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225951\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x627e4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x627e4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x627e4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0156.947] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x627e4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x627e4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x627e4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.947] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x627e4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x627e4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x627e4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0156.947] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0156.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225951\\temporaryfile")) returned 1 [0156.948] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x627e4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x627e4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x627e4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0156.948] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0156.948] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225951" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225951")) returned 1 [0156.948] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 0 [0156.948] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.949] WriteFile (in: hFile=0xd8, lpBuffer=0x298530*, nNumberOfBytesToWrite=0x10b8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x298530*, lpNumberOfBytesWritten=0x18fdf8*=0x10b8, lpOverlapped=0x0) returned 1 [0156.950] CloseHandle (hObject=0xd8) returned 1 [0156.950] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.951] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2a968 [0156.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a970) returned 0x2a0a70 [0156.952] ReadFile (in: hFile=0xd8, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x2a968, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe10*=0x2a968, lpOverlapped=0x0) returned 1 [0156.987] CloseHandle (hObject=0xd8) returned 1 [0156.987] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0156.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0156.989] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0156.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0156.989] GetTickCount () returned 0x372ce [0156.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0156.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0156.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0156.990] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225998\\...."), lpSecurityAttributes=0x256210) returned 1 [0156.990] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225998\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225998\\....\\temporaryfile")) returned 0 [0156.990] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225998\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225998\\temporaryfile")) returned 1 [0156.992] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225998\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62857020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62857020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62857020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0156.992] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62857020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62857020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62857020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.992] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62857020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62857020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62857020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0156.992] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225998\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62857020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62857020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62857020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0156.992] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62857020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62857020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62857020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.992] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62857020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62857020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62857020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0156.992] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0156.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225998\\temporaryfile")) returned 1 [0156.992] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62857020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62857020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62857020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0156.992] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0156.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18225998" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18225998")) returned 1 [0156.993] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 0 [0156.997] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0156.997] WriteFile (in: hFile=0xd8, lpBuffer=0x2cb3f0*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2cb3f0*, lpNumberOfBytesWritten=0x18fdf8*=0x2a970, lpOverlapped=0x0) returned 1 [0157.000] CloseHandle (hObject=0xd8) returned 1 [0157.000] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0157.001] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x709768 [0157.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x709770) returned 0x2650020 [0157.002] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x709768, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x709768, lpOverlapped=0x0) returned 1 [0157.212] CloseHandle (hObject=0xd8) returned 1 [0157.212] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 1 [0157.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0157.214] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0157.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0157.214] GetTickCount () returned 0x373a9 [0157.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0157.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0157.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0157.215] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18226217\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18226217\\...."), lpSecurityAttributes=0x256228) returned 1 [0157.215] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18226217\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18226217\\....\\temporaryfile")) returned 0 [0157.215] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18226217\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18226217\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18226217\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18226217\\temporaryfile")) returned 1 [0157.217] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18226217\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62a6c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62a6c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62a6c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0157.217] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62a6c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62a6c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62a6c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.217] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62a6c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62a6c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62a6c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0157.217] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18226217\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62a6c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62a6c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62a6c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0157.217] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62a6c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62a6c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62a6c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.217] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62a6c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62a6c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62a6c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0157.217] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0157.217] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18226217\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18226217\\temporaryfile")) returned 1 [0157.217] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62a6c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x62a6c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x62a6c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0157.218] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0157.218] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18226217" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18226217")) returned 1 [0157.218] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 0 [0157.560] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0157.561] WriteFile (in: hFile=0xd8, lpBuffer=0x3470028*, nNumberOfBytesToWrite=0x709770, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x3470028*, lpNumberOfBytesWritten=0x18fdf8*=0x709770, lpOverlapped=0x0) returned 1 [0157.706] CloseHandle (hObject=0xd8) returned 1 [0157.767] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0157.768] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x228df5c [0157.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x228df64) returned 0x2650020 [0157.769] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x228df5c, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x228df5c, lpOverlapped=0x0) returned 1 [0158.794] CloseHandle (hObject=0xd8) returned 1 [0158.794] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 1 [0158.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0158.802] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0158.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0158.802] GetTickCount () returned 0x379e0 [0158.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0158.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0158.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0158.803] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18227808\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18227808\\...."), lpSecurityAttributes=0x256210) returned 1 [0158.804] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18227808\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18227808\\....\\temporaryfile")) returned 0 [0158.804] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18227808\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18227808\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18227808\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18227808\\temporaryfile")) returned 1 [0158.805] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18227808\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x63998fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x63998fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x63998fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0158.805] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x63998fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x63998fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x63998fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.805] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x63998fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x63998fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x63998fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0158.805] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18227808\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x63998fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x63998fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x63998fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0158.805] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x63998fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x63998fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x63998fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.805] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x63998fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x63998fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x63998fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0158.805] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0158.806] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18227808\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18227808\\temporaryfile")) returned 1 [0158.806] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x63998fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x63998fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x63998fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0158.806] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0158.806] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18227808" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18227808")) returned 1 [0158.806] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 0 [0160.549] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0160.549] WriteFile (in: hFile=0xd8, lpBuffer=0x6b70028*, nNumberOfBytesToWrite=0x228df60, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x6b70028*, lpNumberOfBytesWritten=0x18fdf8*=0x228df60, lpOverlapped=0x0) returned 1 [0161.495] CloseHandle (hObject=0xd8) returned 1 [0161.807] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.807] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x165510 [0161.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x165518) returned 0x2650020 [0161.808] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x165510, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x165510, lpOverlapped=0x0) returned 1 [0161.843] CloseHandle (hObject=0xd8) returned 1 [0161.843] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0161.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0161.847] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0161.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0161.847] GetTickCount () returned 0x385c2 [0161.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0161.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0161.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0161.848] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230850\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230850\\...."), lpSecurityAttributes=0x256228) returned 1 [0161.848] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230850\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230850\\....\\temporaryfile")) returned 0 [0161.848] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230850\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230850\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230850\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230850\\temporaryfile")) returned 1 [0161.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230850\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6569bbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6569bbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6569bbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0161.850] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6569bbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6569bbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6569bbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.850] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6569bbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6569bbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6569bbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0161.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230850\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6569bbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6569bbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6569bbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0161.850] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6569bbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6569bbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6569bbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.850] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6569bbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6569bbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6569bbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0161.850] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0161.851] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230850\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230850\\temporaryfile")) returned 1 [0161.851] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6569bbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6569bbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6569bbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0161.851] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0161.851] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230850" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230850")) returned 1 [0161.851] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 0 [0161.913] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.913] WriteFile (in: hFile=0xd8, lpBuffer=0x2930028*, nNumberOfBytesToWrite=0x165518, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2930028*, lpNumberOfBytesWritten=0x18fdf8*=0x165518, lpOverlapped=0x0) returned 1 [0161.947] CloseHandle (hObject=0xd8) returned 1 [0161.959] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0161.959] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xaec3a [0161.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaec42) returned 0x1d70020 [0161.959] ReadFile (in: hFile=0xd8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe10*=0xaec3a, lpOverlapped=0x0) returned 1 [0161.981] CloseHandle (hObject=0xd8) returned 1 [0161.981] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0161.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0161.987] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0161.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0161.987] GetTickCount () returned 0x3864e [0161.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0161.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0161.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0161.987] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230990\\...."), lpSecurityAttributes=0x256210) returned 1 [0161.988] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230990\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230990\\....\\temporaryfile")) returned 0 [0161.988] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230990\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230990\\temporaryfile")) returned 1 [0161.989] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230990\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x657f2820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x657f2820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x657f2820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0161.989] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x657f2820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x657f2820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x657f2820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.990] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x657f2820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x657f2820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x657f2820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0161.990] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230990\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x657f2820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x657f2820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x657f2820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0161.990] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x657f2820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x657f2820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x657f2820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.990] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x657f2820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x657f2820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x657f2820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0161.990] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0161.990] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230990\\temporaryfile")) returned 1 [0161.990] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x657f2820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x657f2820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x657f2820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0161.990] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0161.990] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18230990" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18230990")) returned 1 [0161.990] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 0 [0162.038] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.039] WriteFile (in: hFile=0xd8, lpBuffer=0x2700028*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2700028*, lpNumberOfBytesWritten=0x18fdf8*=0xaec40, lpOverlapped=0x0) returned 1 [0162.051] CloseHandle (hObject=0xd8) returned 1 [0162.057] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.058] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x150578 [0162.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x150580) returned 0x2650020 [0162.058] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x150578, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x150578, lpOverlapped=0x0) returned 1 [0162.102] CloseHandle (hObject=0xd8) returned 1 [0162.102] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0162.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0162.105] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0162.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0162.105] GetTickCount () returned 0x386cb [0162.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0162.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0162.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0162.106] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231115\\...."), lpSecurityAttributes=0x256228) returned 1 [0162.107] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231115\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231115\\....\\temporaryfile")) returned 0 [0162.107] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231115\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231115\\temporaryfile")) returned 1 [0162.108] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231115\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65923320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65923320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65923320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0162.108] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65923320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65923320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65923320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.108] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65923320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65923320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65923320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0162.108] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231115\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65923320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65923320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65923320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0162.108] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65923320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65923320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65923320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.109] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65923320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65923320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65923320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.109] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0162.109] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231115\\temporaryfile")) returned 1 [0162.109] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65923320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65923320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65923320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0162.109] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0162.109] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231115" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231115")) returned 1 [0162.109] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 0 [0162.167] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.168] WriteFile (in: hFile=0xd8, lpBuffer=0x2910028*, nNumberOfBytesToWrite=0x150580, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2910028*, lpNumberOfBytesWritten=0x18fdf8*=0x150580, lpOverlapped=0x0) returned 1 [0162.191] CloseHandle (hObject=0xd8) returned 1 [0162.203] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.203] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x5061 [0162.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5069) returned 0x297460 [0162.203] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x5061, lpOverlapped=0x0) returned 1 [0162.205] CloseHandle (hObject=0xd8) returned 1 [0162.205] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0162.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0162.206] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0162.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0162.206] GetTickCount () returned 0x38729 [0162.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0162.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0162.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0162.206] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231209\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231209\\...."), lpSecurityAttributes=0x256210) returned 1 [0162.207] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231209\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231209\\....\\temporaryfile")) returned 0 [0162.207] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231209\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231209\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231209\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231209\\temporaryfile")) returned 1 [0162.208] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231209\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65a07b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65a07b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65a07b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0162.209] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65a07b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65a07b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65a07b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.209] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65a07b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65a07b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65a07b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0162.209] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231209\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65a07b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65a07b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65a07b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0162.209] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65a07b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65a07b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65a07b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.209] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65a07b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65a07b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65a07b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.209] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0162.209] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231209\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231209\\temporaryfile")) returned 1 [0162.209] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65a07b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x65a07b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x65a07b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0162.209] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0162.209] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18231209" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18231209")) returned 1 [0162.209] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 0 [0162.210] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.210] WriteFile (in: hFile=0xd8, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x5068, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdf8*=0x5068, lpOverlapped=0x0) returned 1 [0162.211] CloseHandle (hObject=0xd8) returned 1 [0162.213] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0162.214] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xb9fa2f7 [0162.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb9fa2ff) returned 0x2650020 [0162.218] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0xb9fa2f7, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0xb9fa2f7, lpOverlapped=0x0) returned 1 [0168.725] CloseHandle (hObject=0xd8) returned 1 [0168.725] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 1 [0168.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0168.746] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0168.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0168.746] GetTickCount () returned 0x3a0b1 [0168.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0168.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0168.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0168.747] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18237745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18237745\\...."), lpSecurityAttributes=0x256228) returned 1 [0168.747] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18237745\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18237745\\....\\temporaryfile")) returned 0 [0168.747] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18237745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18237745\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18237745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18237745\\temporaryfile")) returned 1 [0168.749] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18237745\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6985db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6985db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6985db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0168.749] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6985db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6985db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6985db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.749] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6985db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6985db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6985db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0168.749] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18237745\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6985db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6985db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6985db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0168.749] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6985db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6985db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6985db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.749] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6985db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6985db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6985db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.749] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0168.749] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18237745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18237745\\temporaryfile")) returned 1 [0168.750] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6985db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x6985db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x6985db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0168.750] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0168.750] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18237745" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18237745")) returned 1 [0168.750] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 0 [0180.109] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0180.110] WriteFile (in: hFile=0xd8, lpBuffer=0x19a50028*, nNumberOfBytesToWrite=0xb9fa300, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x19a50028*, lpNumberOfBytesWritten=0x18fdf8*=0xb9fa300, lpOverlapped=0x0) returned 1 [0185.398] CloseHandle (hObject=0xd8) returned 1 [0187.105] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0187.106] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xb80800 [0187.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb80808) returned 0x2650020 [0187.107] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0xb80800, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0xb80800, lpOverlapped=0x0) returned 1 [0187.450] CloseHandle (hObject=0xd8) returned 1 [0187.450] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 1 [0187.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0187.456] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0187.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0187.456] GetTickCount () returned 0x3e9d1 [0187.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0187.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0187.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0187.457] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18256465\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18256465\\...."), lpSecurityAttributes=0x256210) returned 1 [0187.457] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18256465\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18256465\\....\\temporaryfile")) returned 0 [0187.457] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18256465\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18256465\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18256465\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18256465\\temporaryfile")) returned 1 [0187.458] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18256465\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74ae4d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x74ae4d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x74ae4d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0187.458] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74ae4d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x74ae4d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x74ae4d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.459] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74ae4d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x74ae4d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x74ae4d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0187.459] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18256465\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74ae4d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x74ae4d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x74ae4d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0187.459] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74ae4d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x74ae4d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x74ae4d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0187.459] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74ae4d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x74ae4d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x74ae4d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0187.459] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0187.459] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18256465\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18256465\\temporaryfile")) returned 1 [0187.459] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74ae4d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x74ae4d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x74ae4d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0187.459] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0187.459] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18256465" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18256465")) returned 1 [0187.459] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 0 [0188.033] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0188.034] WriteFile (in: hFile=0xd8, lpBuffer=0x3d70028*, nNumberOfBytesToWrite=0xb80808, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x3d70028*, lpNumberOfBytesWritten=0x18fdf8*=0xb80808, lpOverlapped=0x0) returned 1 [0188.261] CloseHandle (hObject=0xd8) returned 1 [0188.365] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0188.366] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2213 [0188.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x221b) returned 0x297460 [0188.366] ReadFile (in: hFile=0xd8, lpBuffer=0x297468, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fe10*=0x2213, lpOverlapped=0x0) returned 1 [0188.368] CloseHandle (hObject=0xd8) returned 1 [0188.368] DeleteFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0188.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0188.369] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0188.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0188.369] GetTickCount () returned 0x3ed5a [0188.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0188.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0188.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0188.370] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257370\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257370\\...."), lpSecurityAttributes=0x256228) returned 1 [0188.370] MoveFileA (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257370\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257370\\....\\temporaryfile")) returned 0 [0188.370] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257370\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257370\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257370\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257370\\temporaryfile")) returned 1 [0188.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257370\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75385d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75385d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75385d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0188.371] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75385d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75385d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75385d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.371] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75385d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75385d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75385d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0188.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257370\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75385d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75385d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75385d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0188.371] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75385d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75385d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75385d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.371] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75385d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75385d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75385d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.371] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0188.372] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257370\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257370\\temporaryfile")) returned 1 [0188.372] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75385d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75385d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75385d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0188.372] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0188.372] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257370" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257370")) returned 1 [0188.372] PathFileExistsA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 0 [0188.372] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.SKYSTARS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0188.373] WriteFile (in: hFile=0xd8, lpBuffer=0x299690*, nNumberOfBytesToWrite=0x2218, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x299690*, lpNumberOfBytesWritten=0x18fdf8*=0x2218, lpOverlapped=0x0) returned 1 [0188.374] CloseHandle (hObject=0xd8) returned 1 [0188.374] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0188.374] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x75385d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75385d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x4d005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0188.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0188.374] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0188.374] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0188.375] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0188.375] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0188.375] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0188.375] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName="Admin", cAlternateFileName="")) returned 1 [0188.375] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName="Admin", cAlternateFileName="")) returned 0 [0188.375] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0188.375] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0188.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0188.375] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0188.375] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0188.375] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 0 [0188.376] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0188.376] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0188.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0188.376] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0188.376] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0188.376] FindFirstFileA (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1120dc10, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1120dc10, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0188.376] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1120dc10, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x1120dc10, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0188.376] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0188.376] FindNextFileA (in: hFindFile=0x289a50, lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xfd72e458, dwReserved1=0x1ca0431, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0188.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561e0 [0188.376] CreateFileA (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0188.376] GetFileSize (in: hFile=0xd0, lpFileSizeHigh=0x18fe50 | out: lpFileSizeHigh=0x18fe50*=0x0) returned 0xae [0188.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb6) returned 0x259580 [0188.377] ReadFile (in: hFile=0xd0, lpBuffer=0x259588, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18fe50, lpOverlapped=0x0 | out: lpBuffer=0x259588*, lpNumberOfBytesRead=0x18fe50*=0xae, lpOverlapped=0x0) returned 1 [0188.377] CloseHandle (hObject=0xd0) returned 1 [0188.377] DeleteFileA (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0188.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0188.378] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcfc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0188.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0188.378] GetTickCount () returned 0x3ed6a [0188.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0188.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0188.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289a90 [0188.379] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257386\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257386\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0188.379] MoveFileA (lpExistingFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257386\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257386\\....\\temporaryfile")) returned 0 [0188.379] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257386\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257386\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257386\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257386\\temporaryfile")) returned 1 [0188.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257386\\*", lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753abea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753abea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753abea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x773a58a2, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0188.380] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753abea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753abea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753abea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x773a58a2, cFileName="..", cAlternateFileName="")) returned 1 [0188.380] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753abea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753abea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753abea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x773a58a2, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0188.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257386\\TemporaryFile\\*", lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753abea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753abea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753abea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0188.380] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753abea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753abea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753abea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.380] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f874 | out: lpFindFileData=0x18f874*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753abea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753abea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753abea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.380] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0188.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257386\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257386\\temporaryfile")) returned 1 [0188.381] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fbd4 | out: lpFindFileData=0x18fbd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753abea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753abea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753abea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x773a58a2, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0188.381] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0188.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257386" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257386")) returned 1 [0188.381] PathFileExistsA (pszPath="C:\\Program Files\\desktop.ini") returned 0 [0188.381] CreateFileA (lpFileName="C:\\Program Files\\desktop.ini.SKYSTARS" (normalized: "c:\\program files\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd0 [0188.381] WriteFile (in: hFile=0xd0, lpBuffer=0x25c788*, nNumberOfBytesToWrite=0xb8, lpNumberOfBytesWritten=0x18fe38, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesWritten=0x18fe38*=0xb8, lpOverlapped=0x0) returned 1 [0188.382] CloseHandle (hObject=0xd0) returned 1 [0188.382] FindClose (in: hFindFile=0x289a50 | out: hFindFile=0x289a50) returned 1 [0188.382] FindFirstFileA (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x18fd28 | out: lpFindFileData=0x18fd28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x753abea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753abea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289a50 [0188.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0188.383] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0188.383] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0188.383] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0188.383] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0188.383] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Services", cAlternateFileName="")) returned 1 [0188.383] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0188.383] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="System", cAlternateFileName="")) returned 1 [0188.383] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="System", cAlternateFileName="")) returned 0 [0188.383] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0188.383] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0188.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0188.383] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69da35f0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0188.383] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69da35f0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0188.383] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x69da35f0, dwReserved1=0x1d301bf, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0188.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0188.384] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0188.384] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x18340 [0188.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18348) returned 0x2a0a70 [0188.386] ReadFile (in: hFile=0xd8, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x18340, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fe10*=0x18340, lpOverlapped=0x0) returned 1 [0188.388] CloseHandle (hObject=0xd8) returned 1 [0188.388] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0188.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0188.390] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0188.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0188.390] GetTickCount () returned 0x3ed79 [0188.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0188.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0188.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0188.390] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257401\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257401\\...."), lpSecurityAttributes=0x256228) returned 1 [0188.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257401\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257401\\....\\temporaryfile")) returned 0 [0188.391] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257401\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257401\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257401\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257401\\temporaryfile")) returned 1 [0188.392] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257401\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753d2000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753d2000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753d2000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0188.392] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753d2000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753d2000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753d2000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.392] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753d2000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753d2000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753d2000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0188.392] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257401\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753d2000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753d2000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753d2000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0188.392] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753d2000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753d2000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753d2000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.392] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753d2000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753d2000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753d2000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.392] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0188.392] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257401\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257401\\temporaryfile")) returned 1 [0188.392] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x753d2000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x753d2000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753d2000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0188.392] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0188.392] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257401" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257401")) returned 1 [0188.393] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 0 [0188.395] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0188.396] WriteFile (in: hFile=0xd8, lpBuffer=0x2b8dc8*, nNumberOfBytesToWrite=0x18348, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b8dc8*, lpNumberOfBytesWritten=0x18fdf8*=0x18348, lpOverlapped=0x0) returned 1 [0188.398] CloseHandle (hObject=0xd8) returned 1 [0188.398] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0188.398] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x753d2000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x753d2000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0188.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0188.398] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0188.398] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0188.398] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0188.398] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="DW", cAlternateFileName="")) returned 1 [0188.398] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0188.398] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="EURO", cAlternateFileName="")) returned 1 [0188.398] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Filters", cAlternateFileName="")) returned 1 [0188.398] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Help", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="ink", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="PROOF", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="TextConv", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Triedit", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="VBA", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="VC", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="VGX", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="VSTO", cAlternateFileName="")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0188.399] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0188.399] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0188.399] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0188.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0188.400] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51e19d30, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0188.400] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51e19d30, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0188.400] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x51e19d30, dwReserved1=0x1d301bf, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0188.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561c8 [0188.401] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0188.405] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14e760 [0188.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14e768) returned 0x2650020 [0188.406] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x14e760, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x14e760, lpOverlapped=0x0) returned 1 [0188.440] CloseHandle (hObject=0xdc) returned 1 [0188.440] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0188.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0188.444] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0188.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0188.444] GetTickCount () returned 0x3eda8 [0188.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0188.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0188.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0188.444] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257448\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257448\\...."), lpSecurityAttributes=0x256210) returned 1 [0188.444] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257448\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257448\\....\\temporaryfile")) returned 0 [0188.445] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257448\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257448\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257448\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257448\\temporaryfile")) returned 1 [0188.446] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257448\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75444420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75444420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75444420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0188.446] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75444420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75444420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75444420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.446] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75444420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75444420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75444420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0188.446] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257448\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75444420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75444420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75444420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0188.446] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75444420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75444420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75444420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.446] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75444420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75444420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75444420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.446] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0188.446] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257448\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257448\\temporaryfile")) returned 1 [0188.446] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75444420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75444420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75444420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0188.446] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0188.446] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257448" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257448")) returned 1 [0188.447] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 0 [0188.512] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0188.512] WriteFile (in: hFile=0xdc, lpBuffer=0x28f0028*, nNumberOfBytesToWrite=0x14e768, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28f0028*, lpNumberOfBytesWritten=0x18fdd8*=0x14e768, lpOverlapped=0x0) returned 1 [0188.534] CloseHandle (hObject=0xdc) returned 1 [0188.546] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0188.547] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf2b88 [0188.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf2b90) returned 0x2650020 [0188.547] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0xf2b88, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0xf2b88, lpOverlapped=0x0) returned 1 [0188.565] CloseHandle (hObject=0xdc) returned 1 [0188.565] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0188.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0188.572] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0188.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0188.572] GetTickCount () returned 0x3ee25 [0188.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0188.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0188.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0188.573] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257573\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257573\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0188.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257573\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257573\\....\\temporaryfile")) returned 0 [0188.573] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257573\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257573\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257573\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257573\\temporaryfile")) returned 1 [0188.574] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257573\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75574f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75574f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75574f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0188.574] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75574f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75574f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75574f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.574] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75574f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75574f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75574f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0188.574] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257573\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75574f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75574f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75574f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0188.575] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75574f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75574f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75574f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.575] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75574f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75574f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75574f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.575] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0188.575] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257573\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257573\\temporaryfile")) returned 1 [0188.575] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75574f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75574f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75574f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0188.575] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0188.575] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257573" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257573")) returned 1 [0188.575] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 0 [0188.630] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0188.630] WriteFile (in: hFile=0xdc, lpBuffer=0x2850028*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2850028*, lpNumberOfBytesWritten=0x18fdd8*=0xf2b90, lpOverlapped=0x0) returned 1 [0188.644] CloseHandle (hObject=0xdc) returned 1 [0188.653] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0188.653] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x99ba0 [0188.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x99ba8) returned 0x1d70020 [0188.654] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x99ba0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0x99ba0, lpOverlapped=0x0) returned 1 [0188.668] CloseHandle (hObject=0xdc) returned 1 [0188.668] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0188.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0188.673] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0188.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0188.673] GetTickCount () returned 0x3ee92 [0188.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0188.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0188.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0188.674] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257682\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257682\\...."), lpSecurityAttributes=0x256210) returned 1 [0188.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257682\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257682\\....\\temporaryfile")) returned 0 [0188.674] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257682\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257682\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257682\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257682\\temporaryfile")) returned 1 [0188.675] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257682\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7567f8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7567f8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7567f8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0188.675] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7567f8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7567f8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7567f8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.675] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7567f8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7567f8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7567f8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0188.675] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257682\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7567f8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7567f8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7567f8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0188.676] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7567f8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7567f8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7567f8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.676] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7567f8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7567f8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7567f8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.676] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0188.676] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257682\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257682\\temporaryfile")) returned 1 [0188.676] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7567f8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7567f8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7567f8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0188.676] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0188.676] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257682" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257682")) returned 1 [0188.676] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 0 [0188.703] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0188.705] WriteFile (in: hFile=0xdc, lpBuffer=0x26f0028*, nNumberOfBytesToWrite=0x99ba8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x26f0028*, lpNumberOfBytesWritten=0x18fdd8*=0x99ba8, lpOverlapped=0x0) returned 1 [0188.714] CloseHandle (hObject=0xdc) returned 1 [0188.720] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0188.720] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x756cbb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x756cbb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0188.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0188.720] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0188.720] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed38550, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0188.720] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed38550, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0188.720] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed38550, dwReserved1=0x1d301be, cFileName="1033", cAlternateFileName="")) returned 1 [0188.720] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0xeed38550, dwReserved1=0x1d301be, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0188.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0188.720] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0188.721] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9fd [0188.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa05) returned 0x2649f0 [0188.722] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9fd, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x9fd, lpOverlapped=0x0) returned 1 [0188.723] CloseHandle (hObject=0xdc) returned 1 [0188.723] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0188.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0188.724] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0188.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0188.724] GetTickCount () returned 0x3eec1 [0188.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0188.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0188.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0188.725] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257729\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257729\\...."), lpSecurityAttributes=0x256228) returned 1 [0188.725] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257729\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257729\\....\\temporaryfile")) returned 0 [0188.725] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257729\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257729\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257729\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257729\\temporaryfile")) returned 1 [0188.726] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257729\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x756f1ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x756f1ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x756f1ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0188.726] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x756f1ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x756f1ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x756f1ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.726] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x756f1ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x756f1ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x756f1ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0188.726] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257729\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x756f1ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x756f1ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x756f1ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0188.726] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x756f1ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x756f1ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x756f1ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.726] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x756f1ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x756f1ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x756f1ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.726] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0188.726] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257729\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257729\\temporaryfile")) returned 1 [0188.727] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x756f1ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x756f1ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x756f1ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0188.727] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0188.727] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257729" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257729")) returned 1 [0188.727] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 0 [0188.727] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0188.727] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa08, lpOverlapped=0x0) returned 1 [0188.728] CloseHandle (hObject=0xdc) returned 1 [0188.728] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0188.729] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x84a48 [0188.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x84a50) returned 0x1d70020 [0188.729] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x84a48, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0x84a48, lpOverlapped=0x0) returned 1 [0188.797] CloseHandle (hObject=0xdc) returned 1 [0188.797] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0188.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0188.802] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0188.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0188.802] GetTickCount () returned 0x3ef0f [0188.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0188.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0188.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0188.803] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257807\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257807\\...."), lpSecurityAttributes=0x256210) returned 1 [0188.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257807\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257807\\....\\temporaryfile")) returned 0 [0188.803] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257807\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257807\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257807\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257807\\temporaryfile")) returned 1 [0188.808] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257807\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x757b03c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x757b03c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x757b03c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0188.808] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x757b03c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x757b03c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x757b03c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.808] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x757b03c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x757b03c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x757b03c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0188.808] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257807\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x757b03c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x757b03c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x757b03c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0188.808] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x757b03c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x757b03c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x757b03c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.808] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x757b03c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x757b03c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x757b03c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0188.808] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0188.808] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257807\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257807\\temporaryfile")) returned 1 [0188.808] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x757b03c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x757b03c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x757b03c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0188.808] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0188.808] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18257807" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18257807")) returned 1 [0188.808] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 0 [0188.831] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0188.832] WriteFile (in: hFile=0xdc, lpBuffer=0x26e0028*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x26e0028*, lpNumberOfBytesWritten=0x18fdd8*=0x84a50, lpOverlapped=0x0) returned 1 [0188.840] CloseHandle (hObject=0xdc) returned 1 [0188.939] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0188.954] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x236 [0188.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23e) returned 0x28f1f8 [0188.954] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x236, lpOverlapped=0x0) returned 1 [0188.954] CloseHandle (hObject=0xdc) returned 1 [0188.955] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0189.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0189.010] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.010] GetTickCount () returned 0x3efda [0189.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0189.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0189.011] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258010\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258010\\...."), lpSecurityAttributes=0x256228) returned 1 [0189.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258010\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258010\\....\\temporaryfile")) returned 0 [0189.012] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258010\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258010\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258010\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258010\\temporaryfile")) returned 1 [0189.013] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258010\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7599f5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7599f5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7599f5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0189.013] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7599f5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7599f5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7599f5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.013] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7599f5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7599f5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7599f5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.013] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258010\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7599f5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7599f5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7599f5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.013] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7599f5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7599f5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7599f5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.014] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7599f5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7599f5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7599f5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.014] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.014] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258010\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258010\\temporaryfile")) returned 1 [0189.014] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7599f5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7599f5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7599f5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.014] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0189.014] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258010" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258010")) returned 1 [0189.014] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 0 [0189.014] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.015] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x240, lpOverlapped=0x0) returned 1 [0189.016] CloseHandle (hObject=0xdc) returned 1 [0189.016] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.016] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2b0b7 [0189.016] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b0bf) returned 0x2a0a70 [0189.016] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x2b0b7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x2b0b7, lpOverlapped=0x0) returned 1 [0189.018] CloseHandle (hObject=0xdc) returned 1 [0189.018] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0189.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0189.020] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.020] GetTickCount () returned 0x3efe9 [0189.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0189.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0189.020] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258025\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258025\\...."), lpSecurityAttributes=0x256210) returned 1 [0189.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258025\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258025\\....\\temporaryfile")) returned 0 [0189.021] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258025\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258025\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258025\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258025\\temporaryfile")) returned 1 [0189.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258025\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759c5700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759c5700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759c5700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0189.022] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759c5700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759c5700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759c5700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.022] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759c5700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759c5700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759c5700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258025\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759c5700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759c5700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759c5700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.022] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759c5700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759c5700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759c5700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.022] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759c5700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759c5700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759c5700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.023] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258025\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258025\\temporaryfile")) returned 1 [0189.023] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759c5700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759c5700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759c5700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.023] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0189.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258025" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258025")) returned 1 [0189.023] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 0 [0189.027] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.028] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbb40*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbb40*, lpNumberOfBytesWritten=0x18fdd8*=0x2b0c0, lpOverlapped=0x0) returned 1 [0189.031] CloseHandle (hObject=0xdc) returned 1 [0189.031] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.031] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1de8 [0189.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1df0) returned 0x297460 [0189.031] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x1de8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x1de8, lpOverlapped=0x0) returned 1 [0189.033] CloseHandle (hObject=0xdc) returned 1 [0189.033] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0189.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0189.034] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.034] GetTickCount () returned 0x3eff9 [0189.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0189.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0189.034] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258041\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258041\\...."), lpSecurityAttributes=0x256228) returned 1 [0189.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258041\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258041\\....\\temporaryfile")) returned 0 [0189.035] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258041\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258041\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258041\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258041\\temporaryfile")) returned 1 [0189.036] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258041\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759eb860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759eb860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759eb860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0189.036] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759eb860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759eb860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759eb860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.036] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759eb860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759eb860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759eb860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.036] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258041\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759eb860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759eb860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759eb860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.036] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759eb860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759eb860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759eb860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.036] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759eb860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759eb860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759eb860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.036] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.036] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258041\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258041\\temporaryfile")) returned 1 [0189.036] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x759eb860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x759eb860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759eb860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.036] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0189.037] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258041" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258041")) returned 1 [0189.037] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 0 [0189.037] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.037] WriteFile (in: hFile=0xdc, lpBuffer=0x299260*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299260*, lpNumberOfBytesWritten=0x18fdd8*=0x1df0, lpOverlapped=0x0) returned 1 [0189.038] CloseHandle (hObject=0xdc) returned 1 [0189.040] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.040] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x759eb860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x759eb860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0189.041] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed38550, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0189.075] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed38550, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0189.075] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0xeed38550, dwReserved1=0x1d301be, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0189.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256210 [0189.075] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0189.076] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xfa60 [0189.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfa68) returned 0x2a0a70 [0189.077] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xfa60, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0xfa60, lpOverlapped=0x0) returned 1 [0189.079] CloseHandle (hObject=0xe0) returned 1 [0189.079] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0189.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0189.080] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.080] GetTickCount () returned 0x3f028 [0189.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0189.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0189.081] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258088\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258088\\...."), lpSecurityAttributes=0x256228) returned 1 [0189.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258088\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258088\\....\\temporaryfile")) returned 0 [0189.081] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258088\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258088\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258088\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258088\\temporaryfile")) returned 1 [0189.082] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258088\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a5dc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a5dc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a5dc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.083] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a5dc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a5dc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a5dc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0189.083] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a5dc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a5dc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a5dc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.083] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258088\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a5dc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a5dc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a5dc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0189.083] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a5dc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a5dc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a5dc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.083] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a5dc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a5dc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a5dc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.083] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0189.083] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258088\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258088\\temporaryfile")) returned 1 [0189.083] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a5dc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a5dc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a5dc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.083] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.083] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258088" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258088")) returned 1 [0189.083] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 0 [0189.085] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0189.086] WriteFile (in: hFile=0xe0, lpBuffer=0x2b04e8*, nNumberOfBytesToWrite=0xfa68, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b04e8*, lpNumberOfBytesWritten=0x18fdb8*=0xfa68, lpOverlapped=0x0) returned 1 [0189.087] CloseHandle (hObject=0xe0) returned 1 [0189.087] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0189.087] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x75a5dc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a5dc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0189.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0189.087] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0189.088] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.088] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58c7d970, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0189.088] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58c7d970, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0189.089] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x58c7d970, dwReserved1=0x1d301bf, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0189.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561c8 [0189.089] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.089] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7980 [0189.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7988) returned 0x2a0a70 [0189.089] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x7980, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x7980, lpOverlapped=0x0) returned 1 [0189.091] CloseHandle (hObject=0xdc) returned 1 [0189.091] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0189.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0189.092] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.092] GetTickCount () returned 0x3f037 [0189.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0189.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.092] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103\\...."), lpSecurityAttributes=0x256210) returned 1 [0189.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103\\....\\temporaryfile")) returned 0 [0189.093] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103\\temporaryfile")) returned 1 [0189.094] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName="..", cAlternateFileName="")) returned 1 [0189.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.094] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.094] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.094] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.094] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103\\temporaryfile")) returned 1 [0189.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.094] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103")) returned 1 [0189.095] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 0 [0189.095] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.096] WriteFile (in: hFile=0xdc, lpBuffer=0x2a8408*, nNumberOfBytesToWrite=0x7988, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a8408*, lpNumberOfBytesWritten=0x18fdd8*=0x7988, lpOverlapped=0x0) returned 1 [0189.097] CloseHandle (hObject=0xdc) returned 1 [0189.097] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0189.097] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0189.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0189.097] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0189.097] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5969b6f0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0189.098] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5969b6f0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0189.098] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x5969b6f0, dwReserved1=0x1d301bf, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0189.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561c8 [0189.098] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.099] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9770 [0189.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9778) returned 0x2a0a70 [0189.099] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x9770, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x9770, lpOverlapped=0x0) returned 1 [0189.101] CloseHandle (hObject=0xdc) returned 1 [0189.101] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0189.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0189.102] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.102] GetTickCount () returned 0x3f037 [0189.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0189.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.102] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103\\...."), lpSecurityAttributes=0x256210) returned 1 [0189.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103\\....\\temporaryfile")) returned 0 [0189.103] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103\\temporaryfile")) returned 1 [0189.104] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.104] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.104] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.104] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.104] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.104] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.104] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103\\temporaryfile")) returned 1 [0189.104] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75a83de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75a83de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75a83de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.104] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258103" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258103")) returned 1 [0189.105] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 0 [0189.105] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.106] WriteFile (in: hFile=0xdc, lpBuffer=0x2aa1f8*, nNumberOfBytesToWrite=0x9778, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2aa1f8*, lpNumberOfBytesWritten=0x18fdd8*=0x9778, lpOverlapped=0x0) returned 1 [0189.107] CloseHandle (hObject=0xdc) returned 1 [0189.107] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.108] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x140790 [0189.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x140798) returned 0x2650020 [0189.108] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x140790, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x140790, lpOverlapped=0x0) returned 1 [0189.188] CloseHandle (hObject=0xdc) returned 1 [0189.188] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0189.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0189.191] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.191] GetTickCount () returned 0x3f095 [0189.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0189.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.191] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258197\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0189.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258197\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258197\\....\\temporaryfile")) returned 0 [0189.192] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258197\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258197\\temporaryfile")) returned 1 [0189.193] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258197\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75b68620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75b68620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75b68620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.193] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75b68620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75b68620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75b68620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.193] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75b68620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75b68620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75b68620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.193] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258197\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75b68620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75b68620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75b68620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.193] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75b68620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75b68620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75b68620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.194] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75b68620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75b68620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75b68620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.194] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258197\\temporaryfile")) returned 1 [0189.194] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75b68620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75b68620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75b68620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.194] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258197" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258197")) returned 1 [0189.194] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 0 [0189.269] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.273] WriteFile (in: hFile=0xdc, lpBuffer=0x28f0028*, nNumberOfBytesToWrite=0x140798, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28f0028*, lpNumberOfBytesWritten=0x18fdd8*=0x140798, lpOverlapped=0x0) returned 1 [0189.294] CloseHandle (hObject=0xdc) returned 1 [0189.305] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.306] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16af90 [0189.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16af98) returned 0x2650020 [0189.307] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x16af90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x16af90, lpOverlapped=0x0) returned 1 [0189.348] CloseHandle (hObject=0xdc) returned 1 [0189.348] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0189.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0189.352] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.352] GetTickCount () returned 0x3f131 [0189.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0189.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.353] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258353\\...."), lpSecurityAttributes=0x256210) returned 1 [0189.353] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258353\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258353\\....\\temporaryfile")) returned 0 [0189.354] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258353\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258353\\temporaryfile")) returned 1 [0189.355] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258353\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75ce53e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75ce53e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75ce53e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.355] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75ce53e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75ce53e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75ce53e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.355] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75ce53e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75ce53e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75ce53e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.355] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258353\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75ce53e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75ce53e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75ce53e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.355] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75ce53e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75ce53e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75ce53e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.355] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75ce53e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75ce53e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75ce53e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.355] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.355] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258353\\temporaryfile")) returned 1 [0189.355] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75ce53e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75ce53e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75ce53e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.355] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.355] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258353" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258353")) returned 1 [0189.356] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 0 [0189.428] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.428] WriteFile (in: hFile=0xdc, lpBuffer=0x2930028*, nNumberOfBytesToWrite=0x16af98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2930028*, lpNumberOfBytesWritten=0x18fdd8*=0x16af98, lpOverlapped=0x0) returned 1 [0189.452] CloseHandle (hObject=0xdc) returned 1 [0189.465] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.466] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x206b78 [0189.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x206b80) returned 0x2650020 [0189.466] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x206b78, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x206b78, lpOverlapped=0x0) returned 1 [0189.531] CloseHandle (hObject=0xdc) returned 1 [0189.531] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 1 [0189.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0189.533] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.533] GetTickCount () returned 0x3f1ec [0189.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0189.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.533] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258540\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258540\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0189.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258540\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258540\\....\\temporaryfile")) returned 0 [0189.534] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258540\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258540\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258540\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258540\\temporaryfile")) returned 1 [0189.535] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258540\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75eae460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75eae460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75eae460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.535] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75eae460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75eae460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75eae460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.535] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75eae460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75eae460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75eae460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.535] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258540\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75eae460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75eae460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75eae460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.535] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75eae460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75eae460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75eae460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.535] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75eae460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75eae460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75eae460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.535] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.535] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258540\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258540\\temporaryfile")) returned 1 [0189.535] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75eae460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x75eae460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x75eae460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.535] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.536] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258540" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258540")) returned 1 [0189.536] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 0 [0189.678] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.678] WriteFile (in: hFile=0xdc, lpBuffer=0x2a70028*, nNumberOfBytesToWrite=0x206b80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a70028*, lpNumberOfBytesWritten=0x18fdd8*=0x206b80, lpOverlapped=0x0) returned 1 [0189.714] CloseHandle (hObject=0xdc) returned 1 [0189.731] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0189.731] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x760050c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x760050c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0189.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0189.732] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0189.732] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeec79e70, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0189.734] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeec79e70, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0189.734] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0xeec79e70, dwReserved1=0x1d301be, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0189.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0189.734] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.734] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a9b [0189.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1aa3) returned 0x297460 [0189.734] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x1a9b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x1a9b, lpOverlapped=0x0) returned 1 [0189.736] CloseHandle (hObject=0xdc) returned 1 [0189.736] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0189.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0189.737] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.737] GetTickCount () returned 0x3f2b7 [0189.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0189.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.737] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258743\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258743\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0189.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258743\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258743\\....\\temporaryfile")) returned 0 [0189.738] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258743\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258743\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258743\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258743\\temporaryfile")) returned 1 [0189.739] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258743\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7609d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7609d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7609d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.739] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7609d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7609d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7609d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.739] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7609d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7609d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7609d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.739] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258743\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7609d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7609d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7609d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.739] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7609d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7609d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7609d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.739] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7609d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7609d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7609d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.739] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.739] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258743\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258743\\temporaryfile")) returned 1 [0189.739] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7609d640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7609d640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7609d640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.739] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.739] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258743" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258743")) returned 1 [0189.740] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 0 [0189.740] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.740] WriteFile (in: hFile=0xdc, lpBuffer=0x298f18*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x298f18*, lpNumberOfBytesWritten=0x18fdd8*=0x1aa0, lpOverlapped=0x0) returned 1 [0189.741] CloseHandle (hObject=0xdc) returned 1 [0189.743] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.743] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4f160 [0189.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f168) returned 0x2a0a70 [0189.745] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x4f160, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x4f160, lpOverlapped=0x0) returned 1 [0189.751] CloseHandle (hObject=0xdc) returned 1 [0189.751] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0189.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0189.754] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.754] GetTickCount () returned 0x3f2c6 [0189.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0189.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.755] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258758\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258758\\...."), lpSecurityAttributes=0x256210) returned 1 [0189.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258758\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258758\\....\\temporaryfile")) returned 0 [0189.755] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258758\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258758\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258758\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258758\\temporaryfile")) returned 1 [0189.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258758\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x760c37a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x760c37a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x760c37a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.756] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x760c37a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x760c37a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x760c37a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.756] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x760c37a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x760c37a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x760c37a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258758\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x760c37a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x760c37a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x760c37a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.756] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x760c37a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x760c37a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x760c37a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.756] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x760c37a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x760c37a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x760c37a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.756] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.756] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258758\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258758\\temporaryfile")) returned 1 [0189.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x760c37a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x760c37a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x760c37a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.757] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258758" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258758")) returned 1 [0189.757] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 0 [0189.769] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.770] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x4f168, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x4f168, lpOverlapped=0x0) returned 1 [0189.775] CloseHandle (hObject=0xdc) returned 1 [0189.775] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.775] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x93f6e [0189.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x93f76) returned 0x1d70020 [0189.775] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x93f6e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0x93f6e, lpOverlapped=0x0) returned 1 [0189.797] CloseHandle (hObject=0xdc) returned 1 [0189.797] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0189.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0189.802] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.802] GetTickCount () returned 0x3f2f5 [0189.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0189.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.802] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258805\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258805\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0189.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258805\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258805\\....\\temporaryfile")) returned 0 [0189.803] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258805\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258805\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258805\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258805\\temporaryfile")) returned 1 [0189.804] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258805\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76135bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76135bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76135bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.804] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76135bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76135bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76135bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.804] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76135bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76135bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76135bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.804] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258805\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76135bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76135bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76135bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.804] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76135bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76135bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76135bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.804] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76135bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76135bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76135bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.804] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258805\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258805\\temporaryfile")) returned 1 [0189.804] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76135bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76135bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76135bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.804] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258805" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258805")) returned 1 [0189.804] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 0 [0189.830] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.830] WriteFile (in: hFile=0xdc, lpBuffer=0x26f0028*, nNumberOfBytesToWrite=0x93f78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x26f0028*, lpNumberOfBytesWritten=0x18fdd8*=0x93f78, lpOverlapped=0x0) returned 1 [0189.839] CloseHandle (hObject=0xdc) returned 1 [0189.844] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.844] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xadf90 [0189.844] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xadf98) returned 0x1d70020 [0189.845] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xadf90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xadf90, lpOverlapped=0x0) returned 1 [0189.857] CloseHandle (hObject=0xdc) returned 1 [0189.857] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0189.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0189.863] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.863] GetTickCount () returned 0x3f334 [0189.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0189.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.864] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258868\\...."), lpSecurityAttributes=0x256210) returned 1 [0189.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258868\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258868\\....\\temporaryfile")) returned 0 [0189.864] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258868\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258868\\temporaryfile")) returned 1 [0189.865] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258868\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x761ce140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x761ce140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x761ce140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.865] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x761ce140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x761ce140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x761ce140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.865] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x761ce140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x761ce140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x761ce140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.865] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258868\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x761ce140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x761ce140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x761ce140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.865] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x761ce140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x761ce140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x761ce140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.865] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x761ce140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x761ce140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x761ce140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.865] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.865] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258868\\temporaryfile")) returned 1 [0189.866] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x761ce140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x761ce140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x761ce140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.866] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258868" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258868")) returned 1 [0189.866] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 0 [0189.894] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.895] WriteFile (in: hFile=0xdc, lpBuffer=0x2700028*, nNumberOfBytesToWrite=0xadf98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2700028*, lpNumberOfBytesWritten=0x18fdd8*=0xadf98, lpOverlapped=0x0) returned 1 [0189.905] CloseHandle (hObject=0xdc) returned 1 [0189.911] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.911] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4e380 [0189.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4e388) returned 0x2a0a70 [0189.912] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x4e380, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x4e380, lpOverlapped=0x0) returned 1 [0189.915] CloseHandle (hObject=0xdc) returned 1 [0189.915] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0189.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0189.918] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.918] GetTickCount () returned 0x3f372 [0189.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0189.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.919] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258930\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258930\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0189.921] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258930\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258930\\....\\temporaryfile")) returned 0 [0189.921] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258930\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258930\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258930\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258930\\temporaryfile")) returned 1 [0189.922] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258930\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762666c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762666c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762666c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.922] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762666c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762666c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762666c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.922] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762666c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762666c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762666c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.922] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258930\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762666c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762666c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762666c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.922] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762666c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762666c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762666c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.922] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762666c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762666c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762666c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.922] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258930\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258930\\temporaryfile")) returned 1 [0189.922] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762666c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762666c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762666c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.922] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258930" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258930")) returned 1 [0189.923] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 0 [0189.941] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.948] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x4e388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x4e388, lpOverlapped=0x0) returned 1 [0189.953] CloseHandle (hObject=0xdc) returned 1 [0189.954] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.955] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3ad80 [0189.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ad88) returned 0x2a0a70 [0189.955] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x3ad80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x3ad80, lpOverlapped=0x0) returned 1 [0189.957] CloseHandle (hObject=0xdc) returned 1 [0189.957] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0189.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0189.959] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.959] GetTickCount () returned 0x3f391 [0189.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0189.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.959] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258961\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258961\\...."), lpSecurityAttributes=0x256210) returned 1 [0189.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258961\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258961\\....\\temporaryfile")) returned 0 [0189.960] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258961\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258961\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258961\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258961\\temporaryfile")) returned 1 [0189.961] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258961\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762b2980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762b2980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762b2980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.961] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762b2980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762b2980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762b2980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.961] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762b2980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762b2980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762b2980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.961] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258961\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762b2980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762b2980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762b2980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.961] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762b2980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762b2980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762b2980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.961] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762b2980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762b2980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762b2980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.961] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.961] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258961\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258961\\temporaryfile")) returned 1 [0189.961] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762b2980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762b2980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762b2980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.961] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.961] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258961" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258961")) returned 1 [0189.962] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 0 [0189.965] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.966] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x3ad88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x3ad88, lpOverlapped=0x0) returned 1 [0189.969] CloseHandle (hObject=0xdc) returned 1 [0189.969] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.970] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x774 [0189.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x77c) returned 0x2649f0 [0189.970] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x774, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x774, lpOverlapped=0x0) returned 1 [0189.972] CloseHandle (hObject=0xdc) returned 1 [0189.972] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0189.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0189.973] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.973] GetTickCount () returned 0x3f3a1 [0189.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0189.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.973] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258977\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258977\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0189.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258977\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258977\\....\\temporaryfile")) returned 0 [0189.974] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258977\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258977\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258977\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258977\\temporaryfile")) returned 1 [0189.975] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258977\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762d8ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762d8ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762d8ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.975] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762d8ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762d8ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762d8ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.975] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762d8ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762d8ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762d8ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.975] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258977\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762d8ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762d8ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762d8ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.975] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762d8ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762d8ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762d8ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.975] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762d8ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762d8ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762d8ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.975] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.975] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258977\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258977\\temporaryfile")) returned 1 [0189.975] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762d8ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762d8ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762d8ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.975] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.975] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258977" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258977")) returned 1 [0189.975] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 0 [0189.976] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.976] WriteFile (in: hFile=0xdc, lpBuffer=0x265180*, nNumberOfBytesToWrite=0x778, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x265180*, lpNumberOfBytesWritten=0x18fdd8*=0x778, lpOverlapped=0x0) returned 1 [0189.977] CloseHandle (hObject=0xdc) returned 1 [0189.977] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.977] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3adb [0189.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ae3) returned 0x297460 [0189.977] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x3adb, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x3adb, lpOverlapped=0x0) returned 1 [0189.979] CloseHandle (hObject=0xdc) returned 1 [0189.979] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0189.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0189.980] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.980] GetTickCount () returned 0x3f3b0 [0189.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0189.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.980] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0189.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992\\....\\temporaryfile")) returned 0 [0189.981] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992\\temporaryfile")) returned 1 [0189.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.982] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.982] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.982] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.982] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.982] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.982] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992\\temporaryfile")) returned 1 [0189.982] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.982] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.982] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992")) returned 1 [0189.982] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 0 [0189.983] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.983] WriteFile (in: hFile=0xdc, lpBuffer=0x29af58*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29af58*, lpNumberOfBytesWritten=0x18fdd8*=0x3ae0, lpOverlapped=0x0) returned 1 [0189.984] CloseHandle (hObject=0xdc) returned 1 [0189.988] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.988] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x42d [0189.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x435) returned 0x259e70 [0189.988] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x42d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x42d, lpOverlapped=0x0) returned 1 [0189.990] CloseHandle (hObject=0xdc) returned 1 [0189.990] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0189.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0189.990] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0189.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0189.991] GetTickCount () returned 0x3f3b0 [0189.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0189.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0189.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0189.991] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0189.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992\\....\\temporaryfile")) returned 0 [0189.992] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992\\temporaryfile")) returned 1 [0189.993] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0189.993] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.993] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0189.993] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0189.993] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.993] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0189.993] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0189.993] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992\\temporaryfile")) returned 1 [0189.993] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x762fec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x762fec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x762fec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0189.993] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0189.993] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18258992" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18258992")) returned 1 [0189.994] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 0 [0189.994] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0189.994] WriteFile (in: hFile=0xdc, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x438, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdd8*=0x438, lpOverlapped=0x0) returned 1 [0189.995] CloseHandle (hObject=0xdc) returned 1 [0189.995] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.008] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x425 [0190.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x42d) returned 0x259e70 [0190.008] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x425, lpOverlapped=0x0) returned 1 [0190.009] CloseHandle (hObject=0xdc) returned 1 [0190.009] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0190.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0190.010] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.010] GetTickCount () returned 0x3f3c0 [0190.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0190.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.011] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259008\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259008\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0190.011] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259008\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259008\\....\\temporaryfile")) returned 0 [0190.011] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259008\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259008\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259008\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259008\\temporaryfile")) returned 1 [0190.012] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259008\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76324da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.012] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76324da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.012] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.012] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259008\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.012] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.013] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.013] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.013] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259008\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259008\\temporaryfile")) returned 1 [0190.013] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.013] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.013] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259008" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259008")) returned 1 [0190.013] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 0 [0190.013] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.014] WriteFile (in: hFile=0xdc, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdd8*=0x430, lpOverlapped=0x0) returned 1 [0190.014] CloseHandle (hObject=0xdc) returned 1 [0190.015] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.015] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x692 [0190.015] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x69a) returned 0x259e70 [0190.015] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x692, lpOverlapped=0x0) returned 1 [0190.016] CloseHandle (hObject=0xdc) returned 1 [0190.016] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0190.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0190.017] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.017] GetTickCount () returned 0x3f3d0 [0190.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0190.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.018] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0190.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024\\....\\temporaryfile")) returned 0 [0190.018] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024\\temporaryfile")) returned 1 [0190.019] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.019] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.019] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.019] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.019] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.019] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.020] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.020] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024\\temporaryfile")) returned 1 [0190.020] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.020] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.020] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024")) returned 1 [0190.020] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 0 [0190.020] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.021] WriteFile (in: hFile=0xdc, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x698, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdd8*=0x698, lpOverlapped=0x0) returned 1 [0190.021] CloseHandle (hObject=0xdc) returned 1 [0190.022] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.022] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x566 [0190.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x56e) returned 0x259e70 [0190.022] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x566, lpOverlapped=0x0) returned 1 [0190.023] CloseHandle (hObject=0xdc) returned 1 [0190.023] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0190.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0190.024] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.024] GetTickCount () returned 0x3f3d0 [0190.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0190.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.025] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0190.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024\\....\\temporaryfile")) returned 0 [0190.025] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024\\temporaryfile")) returned 1 [0190.026] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.026] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.026] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.026] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.027] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.027] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.027] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.027] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024\\temporaryfile")) returned 1 [0190.027] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7634af00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7634af00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7634af00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.027] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.027] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259024" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259024")) returned 1 [0190.027] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 0 [0190.027] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.028] WriteFile (in: hFile=0xdc, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdd8*=0x570, lpOverlapped=0x0) returned 1 [0190.028] CloseHandle (hObject=0xdc) returned 1 [0190.029] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.030] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x11d78 [0190.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11d80) returned 0x2a0a70 [0190.031] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x11d78, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x11d78, lpOverlapped=0x0) returned 1 [0190.034] CloseHandle (hObject=0xdc) returned 1 [0190.034] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0190.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0190.036] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.036] GetTickCount () returned 0x3f3df [0190.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0190.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.036] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259039\\...."), lpSecurityAttributes=0x256210) returned 1 [0190.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259039\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259039\\....\\temporaryfile")) returned 0 [0190.037] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259039\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259039\\temporaryfile")) returned 1 [0190.038] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259039\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76371060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76371060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76371060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.038] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76371060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76371060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76371060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.038] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76371060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76371060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76371060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.038] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259039\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76371060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76371060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76371060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.038] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76371060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76371060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76371060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.038] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76371060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76371060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76371060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.038] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259039\\temporaryfile")) returned 1 [0190.038] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76371060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76371060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76371060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.038] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.039] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259039" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259039")) returned 1 [0190.039] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 0 [0190.041] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.041] WriteFile (in: hFile=0xdc, lpBuffer=0x2b2800*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b2800*, lpNumberOfBytesWritten=0x18fdd8*=0x11d80, lpOverlapped=0x0) returned 1 [0190.043] CloseHandle (hObject=0xdc) returned 1 [0190.043] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.043] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x49f80 [0190.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x49f88) returned 0x2a0a70 [0190.043] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x49f80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x49f80, lpOverlapped=0x0) returned 1 [0190.047] CloseHandle (hObject=0xdc) returned 1 [0190.048] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0190.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0190.050] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.050] GetTickCount () returned 0x3f3ef [0190.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0190.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.051] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259055\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0190.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259055\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259055\\....\\temporaryfile")) returned 0 [0190.051] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259055\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259055\\temporaryfile")) returned 1 [0190.052] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259055\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763971c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763971c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763971c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.052] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763971c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763971c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763971c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.052] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763971c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763971c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763971c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.052] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259055\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763971c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763971c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763971c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.053] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763971c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763971c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763971c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.053] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763971c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763971c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763971c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.053] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.053] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259055\\temporaryfile")) returned 1 [0190.053] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763971c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763971c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763971c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.053] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.053] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259055" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259055")) returned 1 [0190.053] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 0 [0190.061] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.062] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x49f88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x49f88, lpOverlapped=0x0) returned 1 [0190.067] CloseHandle (hObject=0xdc) returned 1 [0190.067] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.068] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x44780 [0190.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x44788) returned 0x2a0a70 [0190.068] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x44780, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x44780, lpOverlapped=0x0) returned 1 [0190.071] CloseHandle (hObject=0xdc) returned 1 [0190.071] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0190.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0190.074] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.074] GetTickCount () returned 0x3f40e [0190.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0190.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.075] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259086\\...."), lpSecurityAttributes=0x256210) returned 1 [0190.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259086\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259086\\....\\temporaryfile")) returned 0 [0190.075] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259086\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259086\\temporaryfile")) returned 1 [0190.076] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259086\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763e3480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763e3480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763e3480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.076] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763e3480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763e3480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763e3480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.076] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763e3480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763e3480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763e3480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.076] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259086\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763e3480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763e3480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763e3480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.076] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763e3480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763e3480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763e3480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.076] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763e3480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763e3480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763e3480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.076] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.076] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259086\\temporaryfile")) returned 1 [0190.076] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x763e3480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x763e3480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763e3480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.077] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.077] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259086" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259086")) returned 1 [0190.077] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 0 [0190.081] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.081] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x44788, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x44788, lpOverlapped=0x0) returned 1 [0190.086] CloseHandle (hObject=0xdc) returned 1 [0190.086] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0190.086] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x763e3480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x763e3480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0190.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0190.086] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0190.086] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee282250, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.087] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee282250, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0190.087] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0xee282250, dwReserved1=0x1d301be, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0190.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0190.087] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.088] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x133200 [0190.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x133208) returned 0x2650020 [0190.088] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x133200, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x133200, lpOverlapped=0x0) returned 1 [0190.119] CloseHandle (hObject=0xdc) returned 1 [0190.119] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0190.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0190.121] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.121] GetTickCount () returned 0x3f43d [0190.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0190.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0190.121] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259133\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259133\\...."), lpSecurityAttributes=0x256210) returned 1 [0190.122] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259133\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259133\\....\\temporaryfile")) returned 0 [0190.122] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259133\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259133\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259133\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259133\\temporaryfile")) returned 1 [0190.123] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259133\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x764558a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x764558a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x764558a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0190.123] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x764558a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x764558a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x764558a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.123] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x764558a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x764558a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x764558a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.123] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259133\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x764558a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x764558a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x764558a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.123] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x764558a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x764558a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x764558a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.123] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x764558a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x764558a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x764558a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.123] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.123] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259133\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259133\\temporaryfile")) returned 1 [0190.123] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x764558a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x764558a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x764558a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.124] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0190.124] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259133" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259133")) returned 1 [0190.124] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 0 [0190.187] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.188] WriteFile (in: hFile=0xdc, lpBuffer=0x28d0028*, nNumberOfBytesToWrite=0x133208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28d0028*, lpNumberOfBytesWritten=0x18fdd8*=0x133208, lpOverlapped=0x0) returned 1 [0190.208] CloseHandle (hObject=0xdc) returned 1 [0190.219] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.220] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1bf200 [0190.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1bf208) returned 0x2650020 [0190.220] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1bf200, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x1bf200, lpOverlapped=0x0) returned 1 [0190.261] CloseHandle (hObject=0xdc) returned 1 [0190.261] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 1 [0190.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0190.268] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.268] GetTickCount () returned 0x3f4c9 [0190.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0190.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0190.269] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259273\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0190.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259273\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259273\\....\\temporaryfile")) returned 0 [0190.269] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259273\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259273\\temporaryfile")) returned 1 [0190.270] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259273\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x765ac500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x765ac500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x765ac500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0190.270] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x765ac500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x765ac500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x765ac500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.270] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x765ac500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x765ac500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x765ac500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.270] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259273\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x765ac500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x765ac500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x765ac500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.270] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x765ac500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x765ac500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x765ac500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.271] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x765ac500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x765ac500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x765ac500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.271] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.271] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259273\\temporaryfile")) returned 1 [0190.271] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x765ac500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x765ac500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x765ac500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.271] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0190.271] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259273" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259273")) returned 1 [0190.271] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 0 [0190.359] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.359] WriteFile (in: hFile=0xdc, lpBuffer=0x29d0028*, nNumberOfBytesToWrite=0x1bf208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29d0028*, lpNumberOfBytesWritten=0x18fdd8*=0x1bf208, lpOverlapped=0x0) returned 1 [0190.395] CloseHandle (hObject=0xdc) returned 1 [0190.411] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.412] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x69000 [0190.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x69008) returned 0x2a0a70 [0190.412] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x69000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x69000, lpOverlapped=0x0) returned 1 [0190.417] CloseHandle (hObject=0xdc) returned 1 [0190.417] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0190.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0190.420] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.421] GetTickCount () returned 0x3f565 [0190.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0190.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0190.421] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259429\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259429\\...."), lpSecurityAttributes=0x256210) returned 1 [0190.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259429\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259429\\....\\temporaryfile")) returned 0 [0190.422] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259429\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259429\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259429\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259429\\temporaryfile")) returned 1 [0190.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259429\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767292c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x767292c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x767292c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0190.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767292c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x767292c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x767292c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767292c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x767292c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x767292c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259429\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767292c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x767292c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x767292c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.423] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767292c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x767292c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x767292c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.423] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767292c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x767292c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x767292c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.423] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259429\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259429\\temporaryfile")) returned 1 [0190.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x767292c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x767292c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x767292c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.423] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0190.424] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259429" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259429")) returned 1 [0190.424] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 0 [0190.446] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.449] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x69008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x69008, lpOverlapped=0x0) returned 1 [0190.455] CloseHandle (hObject=0xdc) returned 1 [0190.455] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.455] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x76775580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76775580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0190.456] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.456] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0190.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0190.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0190.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561c8 [0190.457] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.458] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc1486 [0190.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc148e) returned 0x1d70020 [0190.458] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xc1486, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xc1486, lpOverlapped=0x0) returned 1 [0190.473] CloseHandle (hObject=0xdc) returned 1 [0190.473] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0 [0190.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0190.474] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.474] GetTickCount () returned 0x3f594 [0190.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0190.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.474] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259476\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259476\\...."), lpSecurityAttributes=0x256210) returned 1 [0190.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259476\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259476\\....\\temporaryfile")) returned 0 [0190.475] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259476\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259476\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259476\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259476\\temporaryfile")) returned 1 [0190.476] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259476\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7679b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7679b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7679b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.476] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7679b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7679b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7679b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.476] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7679b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7679b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7679b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.476] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259476\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7679b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7679b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7679b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.476] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7679b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7679b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7679b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.476] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7679b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7679b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7679b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.476] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.476] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259476\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259476\\temporaryfile")) returned 1 [0190.476] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7679b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7679b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7679b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.477] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.477] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259476" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259476")) returned 1 [0190.477] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 1 [0190.510] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.511] WriteFile (in: hFile=0xdc, lpBuffer=0x2720028*, nNumberOfBytesToWrite=0xc1490, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2720028*, lpNumberOfBytesWritten=0x18fdd8*=0xc1490, lpOverlapped=0x0) returned 1 [0190.523] CloseHandle (hObject=0xdc) returned 1 [0190.529] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.530] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x69a5 [0190.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x69ad) returned 0x297460 [0190.530] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x69a5, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x69a5, lpOverlapped=0x0) returned 1 [0190.532] CloseHandle (hObject=0xdc) returned 1 [0190.532] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0 [0190.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0190.532] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.532] GetTickCount () returned 0x3f5d2 [0190.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0190.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.533] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259538\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259538\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0190.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259538\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259538\\....\\temporaryfile")) returned 0 [0190.536] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259538\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259538\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259538\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259538\\temporaryfile")) returned 1 [0190.537] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259538\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76833c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76833c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76833c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.537] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76833c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76833c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76833c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.537] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76833c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76833c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76833c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.538] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259538\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76833c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76833c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76833c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.538] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76833c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76833c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76833c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.538] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76833c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76833c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76833c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.538] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.538] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259538\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259538\\temporaryfile")) returned 1 [0190.538] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76833c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76833c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76833c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.538] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.538] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259538" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259538")) returned 1 [0190.538] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 1 [0190.539] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.540] WriteFile (in: hFile=0xdc, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdd8*=0x69b0, lpOverlapped=0x0) returned 1 [0190.541] CloseHandle (hObject=0xdc) returned 1 [0190.545] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.545] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2f200 [0190.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2f208) returned 0x2a0a70 [0190.546] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x2f200, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x2f200, lpOverlapped=0x0) returned 1 [0190.550] CloseHandle (hObject=0xdc) returned 1 [0190.550] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0 [0190.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0190.550] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.550] GetTickCount () returned 0x3f5e2 [0190.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0190.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.551] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259554\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259554\\...."), lpSecurityAttributes=0x256210) returned 1 [0190.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259554\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259554\\....\\temporaryfile")) returned 0 [0190.551] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259554\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259554\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259554\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259554\\temporaryfile")) returned 1 [0190.552] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259554\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76859dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76859dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76859dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76859dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76859dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76859dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76859dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76859dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76859dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.552] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259554\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76859dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76859dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76859dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.553] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76859dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76859dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76859dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.553] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76859dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76859dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76859dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.553] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.553] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259554\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259554\\temporaryfile")) returned 1 [0190.553] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76859dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76859dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76859dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.553] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.553] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259554" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259554")) returned 1 [0190.553] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 1 [0190.560] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.560] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfc88*, nNumberOfBytesToWrite=0x2f208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfc88*, lpNumberOfBytesWritten=0x18fdd8*=0x2f208, lpOverlapped=0x0) returned 1 [0190.564] CloseHandle (hObject=0xdc) returned 1 [0190.564] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.564] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x186b84 [0190.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x186b8c) returned 0x2650020 [0190.564] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x186b84, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x186b84, lpOverlapped=0x0) returned 1 [0190.618] CloseHandle (hObject=0xdc) returned 1 [0190.618] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0190.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0190.618] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.618] GetTickCount () returned 0x3f620 [0190.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0190.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.619] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259616\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259616\\...."), lpSecurityAttributes=0x256210) returned 1 [0190.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259616\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259616\\....\\temporaryfile")) returned 0 [0190.620] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259616\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259616\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259616\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259616\\temporaryfile")) returned 1 [0190.621] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259616\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768f2340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x769184a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x769184a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.621] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768f2340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x769184a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x769184a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.622] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769184a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x769184a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x769184a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.622] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259616\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769184a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x769184a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x769184a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.622] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769184a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x769184a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x769184a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.622] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769184a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x769184a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x769184a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.622] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259616\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259616\\temporaryfile")) returned 1 [0190.622] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769184a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x769184a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x769184a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.622] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259616" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259616")) returned 1 [0190.622] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 1 [0190.692] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.692] WriteFile (in: hFile=0xdc, lpBuffer=0x2970028*, nNumberOfBytesToWrite=0x186b88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2970028*, lpNumberOfBytesWritten=0x18fdd8*=0x186b88, lpOverlapped=0x0) returned 1 [0190.732] CloseHandle (hObject=0xdc) returned 1 [0190.747] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.747] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe2800 [0190.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe2808) returned 0x2650020 [0190.748] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0xe2800, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0xe2800, lpOverlapped=0x0) returned 1 [0190.766] CloseHandle (hObject=0xdc) returned 1 [0190.766] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0 [0190.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0190.766] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.766] GetTickCount () returned 0x3f6bc [0190.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0190.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.767] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259772\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259772\\...."), lpSecurityAttributes=0x256210) returned 1 [0190.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259772\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259772\\....\\temporaryfile")) returned 0 [0190.767] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259772\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259772\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259772\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259772\\temporaryfile")) returned 1 [0190.768] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259772\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76a6f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76a6f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76a6f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.769] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76a6f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76a6f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76a6f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.769] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76a6f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76a6f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76a6f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.769] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259772\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76a6f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76a6f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76a6f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.769] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76a6f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76a6f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76a6f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.769] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76a6f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76a6f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76a6f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.769] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.769] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259772\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259772\\temporaryfile")) returned 1 [0190.769] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76a6f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76a6f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76a6f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.769] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.769] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259772" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259772")) returned 1 [0190.769] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 1 [0190.809] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.810] WriteFile (in: hFile=0xdc, lpBuffer=0x2830028*, nNumberOfBytesToWrite=0xe2808, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2830028*, lpNumberOfBytesWritten=0x18fdd8*=0xe2808, lpOverlapped=0x0) returned 1 [0190.824] CloseHandle (hObject=0xdc) returned 1 [0190.832] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.832] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb620 [0190.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb628) returned 0x2a0a70 [0190.832] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xb620, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0xb620, lpOverlapped=0x0) returned 1 [0190.834] CloseHandle (hObject=0xdc) returned 1 [0190.834] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0 [0190.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0190.834] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.834] GetTickCount () returned 0x3f6fb [0190.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0190.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.835] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259835\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259835\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0190.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259835\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259835\\....\\temporaryfile")) returned 0 [0190.836] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259835\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259835\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259835\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259835\\temporaryfile")) returned 1 [0190.837] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259835\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b07680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b07680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b07680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.837] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b07680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b07680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b07680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.837] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b07680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b07680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b07680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.837] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259835\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b07680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b07680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b07680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.837] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b07680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b07680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b07680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.837] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b07680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b07680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b07680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.837] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.837] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259835\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259835\\temporaryfile")) returned 1 [0190.837] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b07680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b07680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b07680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.837] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.837] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259835" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259835")) returned 1 [0190.838] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 1 [0190.839] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.839] WriteFile (in: hFile=0xdc, lpBuffer=0x2ac0a8*, nNumberOfBytesToWrite=0xb628, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ac0a8*, lpNumberOfBytesWritten=0x18fdd8*=0xb628, lpOverlapped=0x0) returned 1 [0190.840] CloseHandle (hObject=0xdc) returned 1 [0190.841] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.841] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb6710 [0190.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb6718) returned 0x1d70020 [0190.842] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xb6710, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xb6710, lpOverlapped=0x0) returned 1 [0190.855] CloseHandle (hObject=0xdc) returned 1 [0190.855] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0 [0190.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0190.856] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.856] GetTickCount () returned 0x3f71a [0190.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0190.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.856] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259866\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259866\\...."), lpSecurityAttributes=0x256210) returned 1 [0190.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259866\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259866\\....\\temporaryfile")) returned 0 [0190.857] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259866\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259866\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259866\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259866\\temporaryfile")) returned 1 [0190.858] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259866\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b53940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b53940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b53940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b53940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b53940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b53940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b53940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b53940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b53940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.858] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259866\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b53940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b53940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b53940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.858] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b53940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b53940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b53940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.858] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b53940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b53940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b53940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.858] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.858] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259866\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259866\\temporaryfile")) returned 1 [0190.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b53940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76b53940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76b53940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.858] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.858] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259866" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259866")) returned 1 [0190.859] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 1 [0190.901] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.901] WriteFile (in: hFile=0xdc, lpBuffer=0x2710028*, nNumberOfBytesToWrite=0xb6718, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2710028*, lpNumberOfBytesWritten=0x18fdd8*=0xb6718, lpOverlapped=0x0) returned 1 [0190.912] CloseHandle (hObject=0xdc) returned 1 [0190.918] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.919] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc7240 [0190.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc7248) returned 0x1d70020 [0190.919] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xc7240, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xc7240, lpOverlapped=0x0) returned 1 [0190.935] CloseHandle (hObject=0xdc) returned 1 [0190.935] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0 [0190.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0190.935] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0190.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0190.935] GetTickCount () returned 0x3f768 [0190.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0190.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0190.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0190.936] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259944\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259944\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0190.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259944\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259944\\....\\temporaryfile")) returned 0 [0190.937] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259944\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259944\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259944\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259944\\temporaryfile")) returned 1 [0190.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259944\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76c12020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76c12020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76c12020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0190.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76c12020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76c12020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76c12020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76c12020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76c12020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76c12020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0190.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259944\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76c12020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76c12020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76c12020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0190.938] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76c12020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76c12020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76c12020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.938] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76c12020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76c12020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76c12020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0190.938] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0190.938] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259944\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259944\\temporaryfile")) returned 1 [0190.939] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76c12020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76c12020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76c12020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0190.939] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0190.939] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18259944" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18259944")) returned 1 [0190.939] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 1 [0190.973] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0190.974] WriteFile (in: hFile=0xdc, lpBuffer=0x2720028*, nNumberOfBytesToWrite=0xc7248, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2720028*, lpNumberOfBytesWritten=0x18fdd8*=0xc7248, lpOverlapped=0x0) returned 1 [0191.000] CloseHandle (hObject=0xdc) returned 1 [0191.007] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0191.007] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10ca50 [0191.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10ca58) returned 0x2650020 [0191.008] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x10ca50, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x10ca50, lpOverlapped=0x0) returned 1 [0191.037] CloseHandle (hObject=0xdc) returned 1 [0191.037] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0 [0191.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0191.037] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0191.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0191.037] GetTickCount () returned 0x3f7c6 [0191.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0191.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0191.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0191.037] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260038\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260038\\...."), lpSecurityAttributes=0x256210) returned 1 [0191.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260038\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260038\\....\\temporaryfile")) returned 0 [0191.038] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260038\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260038\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260038\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260038\\temporaryfile")) returned 1 [0191.039] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260038\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76cf6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76cf6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76cf6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0191.039] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76cf6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76cf6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76cf6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.039] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76cf6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76cf6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76cf6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0191.039] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260038\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76cf6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76cf6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76cf6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0191.039] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76cf6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76cf6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76cf6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.039] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76cf6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76cf6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76cf6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0191.039] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0191.039] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260038\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260038\\temporaryfile")) returned 1 [0191.040] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76cf6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76cf6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76cf6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0191.040] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0191.040] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260038" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260038")) returned 1 [0191.040] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 1 [0191.086] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0191.087] WriteFile (in: hFile=0xdc, lpBuffer=0x2870028*, nNumberOfBytesToWrite=0x10ca58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2870028*, lpNumberOfBytesWritten=0x18fdd8*=0x10ca58, lpOverlapped=0x0) returned 1 [0191.105] CloseHandle (hObject=0xdc) returned 1 [0191.115] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0191.116] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2e99a0 [0191.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e99a8) returned 0x2650020 [0191.116] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x2e99a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x2e99a0, lpOverlapped=0x0) returned 1 [0191.197] CloseHandle (hObject=0xdc) returned 1 [0191.198] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0 [0191.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0191.198] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0191.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0191.198] GetTickCount () returned 0x3f871 [0191.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0191.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0191.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0191.199] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260209\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260209\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0191.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260209\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260209\\....\\temporaryfile")) returned 0 [0191.200] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260209\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260209\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260209\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260209\\temporaryfile")) returned 1 [0191.201] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260209\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76e99780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76e99780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76e99780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0191.201] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76e99780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76e99780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76e99780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.201] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76e99780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76e99780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76e99780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0191.201] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260209\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76e99780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76e99780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76e99780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0191.201] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76e99780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76e99780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76e99780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.201] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76e99780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76e99780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76e99780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0191.201] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0191.201] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260209\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260209\\temporaryfile")) returned 1 [0191.202] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76e99780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x76e99780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x76e99780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0191.202] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0191.202] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260209" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260209")) returned 1 [0191.202] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 1 [0191.340] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0191.341] WriteFile (in: hFile=0xdc, lpBuffer=0x2c30028*, nNumberOfBytesToWrite=0x2e99a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c30028*, lpNumberOfBytesWritten=0x18fdd8*=0x2e99a8, lpOverlapped=0x0) returned 1 [0191.407] CloseHandle (hObject=0xdc) returned 1 [0191.433] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0191.433] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x21ff00 [0191.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x21ff08) returned 0x2650020 [0191.434] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x21ff00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x21ff00, lpOverlapped=0x0) returned 1 [0191.490] CloseHandle (hObject=0xdc) returned 1 [0191.490] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0 [0191.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0191.490] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0191.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0191.490] GetTickCount () returned 0x3f98a [0191.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0191.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0191.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0191.491] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260490\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260490\\...."), lpSecurityAttributes=0x256210) returned 1 [0191.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260490\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260490\\....\\temporaryfile")) returned 0 [0191.491] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260490\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260490\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260490\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260490\\temporaryfile")) returned 1 [0191.493] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260490\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77147040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77147040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77147040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0191.493] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77147040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77147040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77147040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.493] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77147040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77147040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77147040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0191.493] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260490\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77147040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77147040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77147040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0191.493] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77147040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77147040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77147040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.493] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77147040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77147040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77147040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0191.493] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0191.493] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260490\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260490\\temporaryfile")) returned 1 [0191.493] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77147040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77147040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77147040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0191.493] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0191.493] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260490" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260490")) returned 1 [0191.494] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 1 [0191.644] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0191.644] WriteFile (in: hFile=0xdc, lpBuffer=0x2a90028*, nNumberOfBytesToWrite=0x21ff08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a90028*, lpNumberOfBytesWritten=0x18fdd8*=0x21ff08, lpOverlapped=0x0) returned 1 [0191.689] CloseHandle (hObject=0xdc) returned 1 [0191.709] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0191.709] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30c330 [0191.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30c338) returned 0x2650020 [0191.710] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x30c330, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x30c330, lpOverlapped=0x0) returned 1 [0191.804] CloseHandle (hObject=0xdc) returned 1 [0191.804] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0191.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0191.805] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0191.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0191.805] GetTickCount () returned 0x3fac2 [0191.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0191.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0191.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0191.806] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260802\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260802\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0191.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260802\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260802\\....\\temporaryfile")) returned 0 [0191.807] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260802\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260802\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260802\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260802\\temporaryfile")) returned 1 [0191.808] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260802\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77466d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77466d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77466d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0191.808] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77466d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77466d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77466d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.808] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77466d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77466d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77466d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0191.808] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260802\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77466d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77466d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77466d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0191.808] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77466d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77466d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77466d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.808] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77466d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77466d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77466d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0191.808] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0191.808] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260802\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260802\\temporaryfile")) returned 1 [0191.808] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77466d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77466d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77466d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0191.809] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0191.809] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18260802" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18260802")) returned 1 [0191.809] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 1 [0191.954] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0191.955] WriteFile (in: hFile=0xdc, lpBuffer=0x2c70028*, nNumberOfBytesToWrite=0x30c338, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c70028*, lpNumberOfBytesWritten=0x18fdd8*=0x30c338, lpOverlapped=0x0) returned 1 [0192.082] CloseHandle (hObject=0xdc) returned 1 [0192.110] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.110] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3ee0d0 [0192.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ee0d8) returned 0x2650020 [0192.111] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x3ee0d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x3ee0d0, lpOverlapped=0x0) returned 1 [0192.216] CloseHandle (hObject=0xdc) returned 1 [0192.216] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0192.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.216] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.216] GetTickCount () returned 0x3fc67 [0192.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261223\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261223\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.218] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261223\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261223\\....\\temporaryfile")) returned 0 [0192.218] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261223\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261223\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261223\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261223\\temporaryfile")) returned 1 [0192.219] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261223\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x778450e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x778450e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x778450e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.219] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x778450e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x778450e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x778450e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.219] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x778450e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x778450e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x778450e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.219] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261223\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x778450e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x778450e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x778450e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.219] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x778450e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x778450e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x778450e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.219] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x778450e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x778450e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x778450e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.219] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261223\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261223\\temporaryfile")) returned 1 [0192.219] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x778450e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x778450e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x778450e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.219] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.220] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261223" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261223")) returned 1 [0192.220] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 1 [0192.425] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.426] WriteFile (in: hFile=0xdc, lpBuffer=0x2e30028*, nNumberOfBytesToWrite=0x3ee0d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e30028*, lpNumberOfBytesWritten=0x18fdd8*=0x3ee0d8, lpOverlapped=0x0) returned 1 [0192.504] CloseHandle (hObject=0xdc) returned 1 [0192.541] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.542] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x56400 [0192.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x56408) returned 0x2a0a70 [0192.542] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x56400, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x56400, lpOverlapped=0x0) returned 1 [0192.545] CloseHandle (hObject=0xdc) returned 1 [0192.546] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0 [0192.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.546] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.546] GetTickCount () returned 0x3fdaf [0192.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.549] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261551\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261551\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0192.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261551\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261551\\....\\temporaryfile")) returned 0 [0192.551] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261551\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261551\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261551\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261551\\temporaryfile")) returned 1 [0192.552] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261551\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77b64dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77b64dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77b64dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77b64dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77b64dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77b64dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77b64dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77b64dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77b64dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.552] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261551\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77b64dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77b64dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77b64dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.552] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77b64dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77b64dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77b64dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.552] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77b64dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77b64dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77b64dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.552] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.552] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261551\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261551\\temporaryfile")) returned 1 [0192.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77b64dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77b64dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77b64dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.552] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.552] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261551" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261551")) returned 1 [0192.553] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 1 [0192.567] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.568] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x56408, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x56408, lpOverlapped=0x0) returned 1 [0192.574] CloseHandle (hObject=0xdc) returned 1 [0192.574] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.575] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x201800 [0192.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x201808) returned 0x2650020 [0192.575] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x201800, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x201800, lpOverlapped=0x0) returned 1 [0192.648] CloseHandle (hObject=0xdc) returned 1 [0192.648] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0 [0192.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.648] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.648] GetTickCount () returned 0x3fe1c [0192.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.649] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261660\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261660\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261660\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261660\\....\\temporaryfile")) returned 0 [0192.649] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261660\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261660\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261660\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261660\\temporaryfile")) returned 1 [0192.650] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261660\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77c6f760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77c6f760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77c6f760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.651] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77c6f760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77c6f760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77c6f760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.651] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77c6f760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77c6f760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77c6f760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.651] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261660\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77c6f760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77c6f760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77c6f760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.651] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77c6f760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77c6f760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77c6f760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.651] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77c6f760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77c6f760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77c6f760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.651] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.651] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261660\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261660\\temporaryfile")) returned 1 [0192.651] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77c6f760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77c6f760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77c6f760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.651] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.651] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261660" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261660")) returned 1 [0192.651] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 1 [0192.744] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.744] WriteFile (in: hFile=0xdc, lpBuffer=0x2a70028*, nNumberOfBytesToWrite=0x201808, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a70028*, lpNumberOfBytesWritten=0x18fdd8*=0x201808, lpOverlapped=0x0) returned 1 [0192.793] CloseHandle (hObject=0xdc) returned 1 [0192.811] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.812] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x61000 [0192.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x61008) returned 0x2a0a70 [0192.812] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x61000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x61000, lpOverlapped=0x0) returned 1 [0192.816] CloseHandle (hObject=0xdc) returned 1 [0192.816] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe")) returned 0 [0192.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.816] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.816] GetTickCount () returned 0x3feb8 [0192.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.817] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261816\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261816\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0192.818] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261816\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261816\\....\\temporaryfile")) returned 0 [0192.818] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261816\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261816\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261816\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261816\\temporaryfile")) returned 1 [0192.819] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261816\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77dec520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77dec520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77dec520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77dec520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77dec520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77dec520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77dec520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77dec520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77dec520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.819] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261816\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77dec520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77dec520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77dec520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.819] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77dec520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77dec520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77dec520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.819] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77dec520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77dec520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77dec520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.819] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.820] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261816\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261816\\temporaryfile")) returned 1 [0192.820] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77dec520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77dec520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77dec520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.820] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.820] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261816" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261816")) returned 1 [0192.820] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 1 [0192.831] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.832] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x61008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x61008, lpOverlapped=0x0) returned 1 [0192.838] CloseHandle (hObject=0xdc) returned 1 [0192.838] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.839] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5da00 [0192.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5da08) returned 0x2a0a70 [0192.839] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x5da00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x5da00, lpOverlapped=0x0) returned 1 [0192.842] CloseHandle (hObject=0xdc) returned 1 [0192.842] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0 [0192.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.842] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.842] GetTickCount () returned 0x3fed7 [0192.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0192.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.843] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261847\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261847\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261847\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261847\\....\\temporaryfile")) returned 0 [0192.847] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261847\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261847\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261847\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261847\\temporaryfile")) returned 1 [0192.848] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261847\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e387e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e387e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e387e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.848] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e387e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e387e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e387e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.848] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e387e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e387e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e387e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.848] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261847\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e387e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e387e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e387e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.848] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e387e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e387e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e387e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.848] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e387e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e387e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e387e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.848] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261847\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261847\\temporaryfile")) returned 1 [0192.848] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e387e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e387e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e387e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.849] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.849] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261847" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261847")) returned 1 [0192.849] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 1 [0192.854] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.855] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x5da08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x5da08, lpOverlapped=0x0) returned 1 [0192.861] CloseHandle (hObject=0xdc) returned 1 [0192.861] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.862] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa20 [0192.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa28) returned 0x2649f0 [0192.862] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa20, lpOverlapped=0x0) returned 1 [0192.863] CloseHandle (hObject=0xdc) returned 1 [0192.863] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0 [0192.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.863] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.863] GetTickCount () returned 0x3fee7 [0192.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.864] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261863\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261863\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0192.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261863\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261863\\....\\temporaryfile")) returned 0 [0192.865] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261863\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261863\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261863\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261863\\temporaryfile")) returned 1 [0192.866] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261863\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e5e940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e5e940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e5e940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.866] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e5e940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e5e940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e5e940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.866] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e5e940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e5e940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e5e940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.866] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261863\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e5e940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e5e940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e5e940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.866] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e5e940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e5e940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e5e940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.866] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e5e940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e5e940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e5e940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.866] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261863\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261863\\temporaryfile")) returned 1 [0192.867] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e5e940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e5e940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e5e940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.867] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.867] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261863" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261863")) returned 1 [0192.867] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 1 [0192.867] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.867] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa28, lpOverlapped=0x0) returned 1 [0192.868] CloseHandle (hObject=0xdc) returned 1 [0192.869] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.870] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x99e [0192.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9a6) returned 0x2649f0 [0192.870] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x99e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x99e, lpOverlapped=0x0) returned 1 [0192.871] CloseHandle (hObject=0xdc) returned 1 [0192.871] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0 [0192.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.871] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.871] GetTickCount () returned 0x3fef6 [0192.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.872] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878\\....\\temporaryfile")) returned 0 [0192.872] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878\\temporaryfile")) returned 1 [0192.873] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.873] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.873] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.873] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.873] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.873] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.874] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.874] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878\\temporaryfile")) returned 1 [0192.874] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.874] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.874] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878")) returned 1 [0192.874] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 1 [0192.874] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.875] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x9a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x9a8, lpOverlapped=0x0) returned 1 [0192.875] CloseHandle (hObject=0xdc) returned 1 [0192.876] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.876] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x984 [0192.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x98c) returned 0x2649f0 [0192.876] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x984, lpOverlapped=0x0) returned 1 [0192.878] CloseHandle (hObject=0xdc) returned 1 [0192.878] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0 [0192.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.878] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.878] GetTickCount () returned 0x3fef6 [0192.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.879] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0192.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878\\....\\temporaryfile")) returned 0 [0192.880] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878\\temporaryfile")) returned 1 [0192.881] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.881] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.881] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.881] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.881] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.881] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.881] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.881] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878\\temporaryfile")) returned 1 [0192.882] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77e84aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77e84aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77e84aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.882] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.882] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261878" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261878")) returned 1 [0192.882] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 1 [0192.882] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.882] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x988, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x988, lpOverlapped=0x0) returned 1 [0192.883] CloseHandle (hObject=0xdc) returned 1 [0192.883] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.884] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9fc [0192.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa04) returned 0x2649f0 [0192.884] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x9fc, lpOverlapped=0x0) returned 1 [0192.885] CloseHandle (hObject=0xdc) returned 1 [0192.885] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0 [0192.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.885] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.885] GetTickCount () returned 0x3ff06 [0192.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.886] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894\\....\\temporaryfile")) returned 0 [0192.886] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894\\temporaryfile")) returned 1 [0192.887] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.887] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.887] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.887] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.887] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.888] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.888] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.888] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894\\temporaryfile")) returned 1 [0192.888] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.888] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.888] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894")) returned 1 [0192.888] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 1 [0192.888] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.889] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa00, lpOverlapped=0x0) returned 1 [0192.890] CloseHandle (hObject=0xdc) returned 1 [0192.890] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.890] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9d2 [0192.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9da) returned 0x2649f0 [0192.890] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9d2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x9d2, lpOverlapped=0x0) returned 1 [0192.891] CloseHandle (hObject=0xdc) returned 1 [0192.891] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0 [0192.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.892] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.892] GetTickCount () returned 0x3ff06 [0192.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.892] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0192.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894\\....\\temporaryfile")) returned 0 [0192.893] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894\\temporaryfile")) returned 1 [0192.894] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.894] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.895] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.895] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.895] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.895] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.895] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894\\temporaryfile")) returned 1 [0192.895] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77eaac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77eaac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77eaac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.895] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.895] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261894" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261894")) returned 1 [0192.895] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 1 [0192.895] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.896] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x9d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x9d8, lpOverlapped=0x0) returned 1 [0192.897] CloseHandle (hObject=0xdc) returned 1 [0192.897] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.897] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa38 [0192.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa40) returned 0x2649f0 [0192.897] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa38, lpOverlapped=0x0) returned 1 [0192.901] CloseHandle (hObject=0xdc) returned 1 [0192.901] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0 [0192.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.901] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.901] GetTickCount () returned 0x3ff16 [0192.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.902] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910\\....\\temporaryfile")) returned 0 [0192.902] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910\\temporaryfile")) returned 1 [0192.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.903] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.903] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.903] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.903] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.903] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.903] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910\\temporaryfile")) returned 1 [0192.904] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.904] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910")) returned 1 [0192.904] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 1 [0192.904] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.904] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa40, lpOverlapped=0x0) returned 1 [0192.905] CloseHandle (hObject=0xdc) returned 1 [0192.905] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.906] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa12 [0192.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa1a) returned 0x2649f0 [0192.906] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa12, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa12, lpOverlapped=0x0) returned 1 [0192.908] CloseHandle (hObject=0xdc) returned 1 [0192.908] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0 [0192.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.908] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.908] GetTickCount () returned 0x3ff16 [0192.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.909] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0192.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910\\....\\temporaryfile")) returned 0 [0192.910] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910\\temporaryfile")) returned 1 [0192.911] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.911] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.911] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.911] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.911] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.911] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.911] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.911] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910\\temporaryfile")) returned 1 [0192.911] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ed0d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ed0d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ed0d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.911] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.911] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261910" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261910")) returned 1 [0192.912] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 1 [0192.912] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.912] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa18, lpOverlapped=0x0) returned 1 [0192.913] CloseHandle (hObject=0xdc) returned 1 [0192.913] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.914] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbd0 [0192.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbd8) returned 0x2649f0 [0192.914] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xbd0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xbd0, lpOverlapped=0x0) returned 1 [0192.915] CloseHandle (hObject=0xdc) returned 1 [0192.915] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0 [0192.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.915] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.915] GetTickCount () returned 0x3ff25 [0192.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.916] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925\\....\\temporaryfile")) returned 0 [0192.916] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925\\temporaryfile")) returned 1 [0192.917] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.917] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.918] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.918] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.918] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925\\temporaryfile")) returned 1 [0192.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.918] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925")) returned 1 [0192.918] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 1 [0192.918] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.919] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xbd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xbd8, lpOverlapped=0x0) returned 1 [0192.920] CloseHandle (hObject=0xdc) returned 1 [0192.920] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.920] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x800 [0192.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x2649f0 [0192.920] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x800, lpOverlapped=0x0) returned 1 [0192.921] CloseHandle (hObject=0xdc) returned 1 [0192.921] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0 [0192.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.922] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.922] GetTickCount () returned 0x3ff25 [0192.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0192.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.922] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0192.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925\\....\\temporaryfile")) returned 0 [0192.924] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925\\temporaryfile")) returned 1 [0192.924] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.925] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.925] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.925] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.925] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.925] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.925] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.925] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925\\temporaryfile")) returned 1 [0192.925] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77ef6ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77ef6ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77ef6ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.925] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.925] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261925" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261925")) returned 1 [0192.925] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 1 [0192.926] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.926] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x808, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x808, lpOverlapped=0x0) returned 1 [0192.927] CloseHandle (hObject=0xdc) returned 1 [0192.927] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.927] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa62 [0192.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa6a) returned 0x2649f0 [0192.927] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa62, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa62, lpOverlapped=0x0) returned 1 [0192.929] CloseHandle (hObject=0xdc) returned 1 [0192.929] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0 [0192.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.929] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.929] GetTickCount () returned 0x3ff35 [0192.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.929] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941\\....\\temporaryfile")) returned 0 [0192.930] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941\\temporaryfile")) returned 1 [0192.931] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.931] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.931] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.931] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.931] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.931] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.931] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.931] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941\\temporaryfile")) returned 1 [0192.931] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.931] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.931] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941")) returned 1 [0192.932] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 1 [0192.932] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.932] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa68, lpOverlapped=0x0) returned 1 [0192.933] CloseHandle (hObject=0xdc) returned 1 [0192.933] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.934] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa44 [0192.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa4c) returned 0x2649f0 [0192.934] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa44, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa44, lpOverlapped=0x0) returned 1 [0192.935] CloseHandle (hObject=0xdc) returned 1 [0192.935] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0 [0192.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.936] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.936] GetTickCount () returned 0x3ff35 [0192.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.936] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0192.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941\\....\\temporaryfile")) returned 0 [0192.937] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941\\temporaryfile")) returned 1 [0192.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.939] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.939] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.939] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.939] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941\\temporaryfile")) returned 1 [0192.939] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f1d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f1d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f1d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.939] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.939] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261941" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261941")) returned 1 [0192.939] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 1 [0192.939] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.941] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa48, lpOverlapped=0x0) returned 1 [0192.942] CloseHandle (hObject=0xdc) returned 1 [0192.942] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.942] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa5c [0192.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa64) returned 0x2649f0 [0192.942] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa5c, lpOverlapped=0x0) returned 1 [0192.944] CloseHandle (hObject=0xdc) returned 1 [0192.944] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0 [0192.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.944] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.944] GetTickCount () returned 0x3ff44 [0192.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.945] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\....\\temporaryfile")) returned 0 [0192.945] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\temporaryfile")) returned 1 [0192.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.946] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.946] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.946] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.946] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.946] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.946] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\temporaryfile")) returned 1 [0192.947] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.947] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956")) returned 1 [0192.947] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 1 [0192.947] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.948] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa60, lpOverlapped=0x0) returned 1 [0192.948] CloseHandle (hObject=0xdc) returned 1 [0192.949] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.949] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9de [0192.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9e6) returned 0x2649f0 [0192.949] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9de, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x9de, lpOverlapped=0x0) returned 1 [0192.950] CloseHandle (hObject=0xdc) returned 1 [0192.950] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0 [0192.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.950] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.950] GetTickCount () returned 0x3ff44 [0192.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.951] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0192.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\....\\temporaryfile")) returned 0 [0192.952] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\temporaryfile")) returned 1 [0192.953] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.953] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.953] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.953] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.953] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.953] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.953] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.954] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\temporaryfile")) returned 1 [0192.954] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.954] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.954] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956")) returned 1 [0192.954] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 1 [0192.954] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.955] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x9e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x9e8, lpOverlapped=0x0) returned 1 [0192.955] CloseHandle (hObject=0xdc) returned 1 [0192.955] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.956] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9da [0192.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9e2) returned 0x2649f0 [0192.956] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9da, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x9da, lpOverlapped=0x0) returned 1 [0192.957] CloseHandle (hObject=0xdc) returned 1 [0192.957] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0 [0192.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.957] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.957] GetTickCount () returned 0x3ff44 [0192.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.958] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\....\\temporaryfile")) returned 0 [0192.959] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\temporaryfile")) returned 1 [0192.960] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.960] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.960] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.960] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.960] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.960] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.960] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.960] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956\\temporaryfile")) returned 1 [0192.960] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f43180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f43180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f43180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.960] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.960] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261956" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261956")) returned 1 [0192.960] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 1 [0192.961] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.961] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x9e0, lpOverlapped=0x0) returned 1 [0192.962] CloseHandle (hObject=0xdc) returned 1 [0192.962] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.963] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa08 [0192.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa10) returned 0x2649f0 [0192.963] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa08, lpOverlapped=0x0) returned 1 [0192.966] CloseHandle (hObject=0xdc) returned 1 [0192.966] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0 [0192.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.966] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.966] GetTickCount () returned 0x3ff54 [0192.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.967] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261972\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261972\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0192.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261972\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261972\\....\\temporaryfile")) returned 0 [0192.968] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261972\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261972\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261972\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261972\\temporaryfile")) returned 1 [0192.972] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261972\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f692e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f692e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f692e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.972] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f692e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f692e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f692e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.972] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f692e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f692e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f692e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.972] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261972\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f692e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f692e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f692e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.972] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f692e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f692e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f692e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.972] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f692e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f692e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f692e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.972] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.972] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261972\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261972\\temporaryfile")) returned 1 [0192.972] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f692e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f692e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f692e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.973] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.973] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261972" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261972")) returned 1 [0192.973] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 1 [0192.973] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.973] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa10, lpOverlapped=0x0) returned 1 [0192.974] CloseHandle (hObject=0xdc) returned 1 [0192.974] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.975] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa000 [0192.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa008) returned 0x2a0a70 [0192.975] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0xa000, lpOverlapped=0x0) returned 1 [0192.976] CloseHandle (hObject=0xdc) returned 1 [0192.976] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0 [0192.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.976] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.976] GetTickCount () returned 0x3ff64 [0192.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0192.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.977] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988\\....\\temporaryfile")) returned 0 [0192.977] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988\\temporaryfile")) returned 1 [0192.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.978] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.978] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.979] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.979] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.979] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988\\temporaryfile")) returned 1 [0192.979] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.979] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988")) returned 1 [0192.979] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 1 [0192.980] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.980] WriteFile (in: hFile=0xdc, lpBuffer=0x2aaa88*, nNumberOfBytesToWrite=0xa008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2aaa88*, lpNumberOfBytesWritten=0x18fdd8*=0xa008, lpOverlapped=0x0) returned 1 [0192.982] CloseHandle (hObject=0xdc) returned 1 [0192.982] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.982] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa42 [0192.982] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa4a) returned 0x2649f0 [0192.982] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa42, lpOverlapped=0x0) returned 1 [0192.984] CloseHandle (hObject=0xdc) returned 1 [0192.984] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0 [0192.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.984] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.984] GetTickCount () returned 0x3ff64 [0192.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.984] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0192.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988\\....\\temporaryfile")) returned 0 [0192.986] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988\\temporaryfile")) returned 1 [0192.986] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.987] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.987] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.987] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.987] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988\\temporaryfile")) returned 1 [0192.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77f8f440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77f8f440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77f8f440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.987] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18261988" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18261988")) returned 1 [0192.987] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 1 [0192.988] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.988] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa48, lpOverlapped=0x0) returned 1 [0192.989] CloseHandle (hObject=0xdc) returned 1 [0192.989] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.989] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa14 [0192.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa1c) returned 0x2649f0 [0192.989] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa14, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa14, lpOverlapped=0x0) returned 1 [0192.991] CloseHandle (hObject=0xdc) returned 1 [0192.991] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0 [0192.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0192.991] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.991] GetTickCount () returned 0x3ff73 [0192.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.992] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\...."), lpSecurityAttributes=0x256210) returned 1 [0192.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\....\\temporaryfile")) returned 0 [0192.992] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\temporaryfile")) returned 1 [0192.993] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0192.993] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.993] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0192.993] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0192.993] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.993] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.993] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0192.993] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\temporaryfile")) returned 1 [0192.994] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0192.994] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0192.994] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003")) returned 1 [0192.994] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 1 [0192.994] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.994] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa18, lpOverlapped=0x0) returned 1 [0192.995] CloseHandle (hObject=0xdc) returned 1 [0192.995] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0192.996] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa28 [0192.996] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa30) returned 0x2649f0 [0192.996] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa28, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa28, lpOverlapped=0x0) returned 1 [0192.998] CloseHandle (hObject=0xdc) returned 1 [0192.998] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0 [0192.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0192.998] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0192.998] GetTickCount () returned 0x3ff73 [0192.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0192.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0192.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0192.998] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0193.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\....\\temporaryfile")) returned 0 [0193.000] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\temporaryfile")) returned 1 [0193.001] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.001] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.001] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.001] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.001] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.001] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.001] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.001] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\temporaryfile")) returned 1 [0193.001] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fb55a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fb55a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.001] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.001] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003")) returned 1 [0193.001] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 1 [0193.002] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.002] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa30, lpOverlapped=0x0) returned 1 [0193.003] CloseHandle (hObject=0xdc) returned 1 [0193.003] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.003] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17200 [0193.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17208) returned 0x2a0a70 [0193.004] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x17200, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x17200, lpOverlapped=0x0) returned 1 [0193.005] CloseHandle (hObject=0xdc) returned 1 [0193.005] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0 [0193.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0193.005] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.005] GetTickCount () returned 0x3ff73 [0193.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0193.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.006] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\...."), lpSecurityAttributes=0x256210) returned 1 [0193.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\....\\temporaryfile")) returned 0 [0193.007] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\temporaryfile")) returned 1 [0193.008] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.008] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fb55a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.008] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.008] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.008] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.008] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.008] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.008] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003\\temporaryfile")) returned 1 [0193.009] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.009] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.009] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262003" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262003")) returned 1 [0193.009] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 1 [0193.010] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.012] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7c88*, nNumberOfBytesToWrite=0x17208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7c88*, lpNumberOfBytesWritten=0x18fdd8*=0x17208, lpOverlapped=0x0) returned 1 [0193.014] CloseHandle (hObject=0xdc) returned 1 [0193.015] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.015] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8c6 [0193.015] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8ce) returned 0x2649f0 [0193.015] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x8c6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x8c6, lpOverlapped=0x0) returned 1 [0193.016] CloseHandle (hObject=0xdc) returned 1 [0193.016] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0 [0193.016] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0193.016] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.016] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.017] GetTickCount () returned 0x3ff83 [0193.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0193.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.017] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262019\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262019\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0193.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262019\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262019\\....\\temporaryfile")) returned 0 [0193.018] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262019\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262019\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262019\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262019\\temporaryfile")) returned 1 [0193.019] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262019\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.019] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.019] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.019] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262019\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.019] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.020] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.020] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.020] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262019\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262019\\temporaryfile")) returned 1 [0193.020] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x77fdb700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x77fdb700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x77fdb700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.020] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.020] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262019" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262019")) returned 1 [0193.020] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 1 [0193.020] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.021] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x8d0, lpOverlapped=0x0) returned 1 [0193.021] CloseHandle (hObject=0xdc) returned 1 [0193.022] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.023] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8c0 [0193.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8c8) returned 0x2649f0 [0193.023] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x8c0, lpOverlapped=0x0) returned 1 [0193.024] CloseHandle (hObject=0xdc) returned 1 [0193.024] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0 [0193.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0193.024] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.024] GetTickCount () returned 0x3ff92 [0193.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0193.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.025] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034\\...."), lpSecurityAttributes=0x256210) returned 1 [0193.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034\\....\\temporaryfile")) returned 0 [0193.025] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034\\temporaryfile")) returned 1 [0193.026] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.026] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.026] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.026] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.027] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.027] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.027] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.027] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034\\temporaryfile")) returned 1 [0193.027] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.027] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.027] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034")) returned 1 [0193.027] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 1 [0193.027] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.028] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x8c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x8c8, lpOverlapped=0x0) returned 1 [0193.029] CloseHandle (hObject=0xdc) returned 1 [0193.029] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.029] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa54 [0193.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa5c) returned 0x2649f0 [0193.029] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa54, lpOverlapped=0x0) returned 1 [0193.031] CloseHandle (hObject=0xdc) returned 1 [0193.031] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0 [0193.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0193.031] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.031] GetTickCount () returned 0x3ff92 [0193.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0193.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.032] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0193.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034\\....\\temporaryfile")) returned 0 [0193.033] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034\\temporaryfile")) returned 1 [0193.034] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.034] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.034] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.034] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.035] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.035] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.035] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.035] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034\\temporaryfile")) returned 1 [0193.035] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78001860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78001860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78001860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.035] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.035] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262034" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262034")) returned 1 [0193.035] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 1 [0193.035] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.036] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa58, lpOverlapped=0x0) returned 1 [0193.037] CloseHandle (hObject=0xdc) returned 1 [0193.037] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.038] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9ee [0193.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9f6) returned 0x2649f0 [0193.038] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9ee, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x9ee, lpOverlapped=0x0) returned 1 [0193.039] CloseHandle (hObject=0xdc) returned 1 [0193.039] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0 [0193.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0193.039] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.039] GetTickCount () returned 0x3ffa2 [0193.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0193.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.040] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\...."), lpSecurityAttributes=0x256210) returned 1 [0193.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\....\\temporaryfile")) returned 0 [0193.040] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\temporaryfile")) returned 1 [0193.041] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.041] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.041] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.041] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.041] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.042] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.042] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.042] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\temporaryfile")) returned 1 [0193.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.042] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.042] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050")) returned 1 [0193.042] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 1 [0193.042] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.043] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x9f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x9f8, lpOverlapped=0x0) returned 1 [0193.043] CloseHandle (hObject=0xdc) returned 1 [0193.044] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.044] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa08 [0193.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa10) returned 0x2649f0 [0193.044] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa08, lpOverlapped=0x0) returned 1 [0193.045] CloseHandle (hObject=0xdc) returned 1 [0193.045] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0 [0193.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0193.046] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.046] GetTickCount () returned 0x3ffa2 [0193.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0193.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.046] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0193.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\....\\temporaryfile")) returned 0 [0193.048] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\temporaryfile")) returned 1 [0193.048] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.048] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.049] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.049] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.049] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.049] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.049] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.049] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\temporaryfile")) returned 1 [0193.049] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780279c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780279c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780279c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.049] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.049] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050")) returned 1 [0193.049] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 1 [0193.049] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.050] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa10, lpOverlapped=0x0) returned 1 [0193.051] CloseHandle (hObject=0xdc) returned 1 [0193.051] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.051] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa24 [0193.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa2c) returned 0x2649f0 [0193.051] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0xa24, lpOverlapped=0x0) returned 1 [0193.052] CloseHandle (hObject=0xdc) returned 1 [0193.052] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0 [0193.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0193.053] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.053] GetTickCount () returned 0x3ffa2 [0193.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0193.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.053] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\...."), lpSecurityAttributes=0x256210) returned 1 [0193.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\....\\temporaryfile")) returned 0 [0193.054] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\temporaryfile")) returned 1 [0193.055] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.055] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.055] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.055] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.055] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.055] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050\\temporaryfile")) returned 1 [0193.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.055] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.055] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262050" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262050")) returned 1 [0193.055] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 1 [0193.056] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.056] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa28, lpOverlapped=0x0) returned 1 [0193.057] CloseHandle (hObject=0xdc) returned 1 [0193.057] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.057] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9d8 [0193.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9e0) returned 0x2649f0 [0193.057] ReadFile (in: hFile=0xdc, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x9d8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdf0*=0x9d8, lpOverlapped=0x0) returned 1 [0193.059] CloseHandle (hObject=0xdc) returned 1 [0193.059] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0 [0193.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0193.059] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.059] GetTickCount () returned 0x3ffb2 [0193.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0193.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.060] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262066\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262066\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0193.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262066\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262066\\....\\temporaryfile")) returned 0 [0193.061] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262066\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262066\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262066\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262066\\temporaryfile")) returned 1 [0193.062] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262066\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.062] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.062] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.062] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262066\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.062] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.062] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.062] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.062] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262066\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262066\\temporaryfile")) returned 1 [0193.062] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7804db20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7804db20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7804db20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.062] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.062] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262066" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262066")) returned 1 [0193.063] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 1 [0193.063] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.063] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x9e0, lpOverlapped=0x0) returned 1 [0193.064] CloseHandle (hObject=0xdc) returned 1 [0193.064] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.064] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14de00 [0193.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14de08) returned 0x2650020 [0193.065] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x14de00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x14de00, lpOverlapped=0x0) returned 1 [0193.128] CloseHandle (hObject=0xdc) returned 1 [0193.128] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll")) returned 0 [0193.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0193.129] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.129] GetTickCount () returned 0x3fff0 [0193.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0193.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.130] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262128\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262128\\...."), lpSecurityAttributes=0x256210) returned 1 [0193.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262128\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262128\\....\\temporaryfile")) returned 0 [0193.130] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262128\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262128\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262128\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262128\\temporaryfile")) returned 1 [0193.131] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262128\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780e60a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780e60a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780e60a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.131] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780e60a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780e60a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780e60a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.132] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780e60a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780e60a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780e60a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.132] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262128\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780e60a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780e60a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780e60a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.132] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780e60a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780e60a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780e60a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.132] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780e60a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780e60a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780e60a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.132] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.132] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262128\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262128\\temporaryfile")) returned 1 [0193.132] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x780e60a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x780e60a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x780e60a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.132] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.132] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262128" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262128")) returned 1 [0193.132] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 1 [0193.194] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.195] WriteFile (in: hFile=0xdc, lpBuffer=0x28f0028*, nNumberOfBytesToWrite=0x14de08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28f0028*, lpNumberOfBytesWritten=0x18fdd8*=0x14de08, lpOverlapped=0x0) returned 1 [0193.220] CloseHandle (hObject=0xdc) returned 1 [0193.232] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.233] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a0200 [0193.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a0208) returned 0x2650020 [0193.233] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1a0200, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x1a0200, lpOverlapped=0x0) returned 1 [0193.289] CloseHandle (hObject=0xdc) returned 1 [0193.289] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0 [0193.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0193.289] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.289] GetTickCount () returned 0x4009c [0193.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0193.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.290] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262300\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262300\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0193.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262300\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262300\\....\\temporaryfile")) returned 0 [0193.292] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262300\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262300\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262300\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262300\\temporaryfile")) returned 1 [0193.293] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262300\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78288fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78288fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78288fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78288fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78288fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78288fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78288fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78288fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78288fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.293] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262300\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78288fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78288fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78288fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.293] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78288fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78288fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78288fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.293] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78288fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78288fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78288fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.293] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.293] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262300\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262300\\temporaryfile")) returned 1 [0193.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78288fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78288fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78288fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.293] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.294] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262300" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262300")) returned 1 [0193.294] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 1 [0193.372] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.373] WriteFile (in: hFile=0xdc, lpBuffer=0x29b0028*, nNumberOfBytesToWrite=0x1a0208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b0028*, lpNumberOfBytesWritten=0x18fdd8*=0x1a0208, lpOverlapped=0x0) returned 1 [0193.413] CloseHandle (hObject=0xdc) returned 1 [0193.435] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.436] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c000 [0193.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c008) returned 0x2350048 [0193.437] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7c000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7c000, lpOverlapped=0x0) returned 1 [0193.447] CloseHandle (hObject=0xdc) returned 1 [0193.447] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0 [0193.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0193.447] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.447] GetTickCount () returned 0x40138 [0193.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0193.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.448] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262456\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262456\\...."), lpSecurityAttributes=0x256210) returned 1 [0193.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262456\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262456\\....\\temporaryfile")) returned 0 [0193.449] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262456\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262456\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262456\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262456\\temporaryfile")) returned 1 [0193.454] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262456\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78405d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78405d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78405d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.454] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78405d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78405d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78405d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.454] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78405d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78405d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78405d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.454] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262456\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78405d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78405d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78405d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.454] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78405d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78405d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78405d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.454] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78405d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78405d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78405d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.454] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.454] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262456\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262456\\temporaryfile")) returned 1 [0193.454] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78405d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78405d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78405d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.454] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.454] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262456" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262456")) returned 1 [0193.455] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 1 [0193.475] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.476] WriteFile (in: hFile=0xdc, lpBuffer=0x23cc060*, nNumberOfBytesToWrite=0x7c008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23cc060*, lpNumberOfBytesWritten=0x18fdd8*=0x7c008, lpOverlapped=0x0) returned 1 [0193.484] CloseHandle (hObject=0xdc) returned 1 [0193.486] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.487] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x179c00 [0193.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x179c08) returned 0x2650020 [0193.487] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x179c00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x179c00, lpOverlapped=0x0) returned 1 [0193.529] CloseHandle (hObject=0xdc) returned 1 [0193.529] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0 [0193.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0193.529] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.529] GetTickCount () returned 0x40186 [0193.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0193.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.530] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262534\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262534\\...."), lpSecurityAttributes=0x256210) returned 1 [0193.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262534\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262534\\....\\temporaryfile")) returned 0 [0193.531] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262534\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262534\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262534\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262534\\temporaryfile")) returned 1 [0193.532] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262534\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x784c4460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x784c4460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x784c4460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.532] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x784c4460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x784c4460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x784c4460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.532] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x784c4460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x784c4460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x784c4460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.532] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262534\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x784c4460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x784c4460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x784c4460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.532] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x784c4460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x784c4460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x784c4460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.532] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x784c4460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x784c4460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x784c4460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.532] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262534\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262534\\temporaryfile")) returned 1 [0193.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x784c4460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x784c4460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x784c4460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.533] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262534" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262534")) returned 1 [0193.533] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 1 [0193.677] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.678] WriteFile (in: hFile=0xdc, lpBuffer=0x2950028*, nNumberOfBytesToWrite=0x179c08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2950028*, lpNumberOfBytesWritten=0x18fdd8*=0x179c08, lpOverlapped=0x0) returned 1 [0193.705] CloseHandle (hObject=0xdc) returned 1 [0193.718] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0193.718] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x609c00 [0193.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x609c08) returned 0x2650020 [0193.719] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x609c00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x609c00, lpOverlapped=0x0) returned 1 [0193.915] CloseHandle (hObject=0xdc) returned 1 [0193.915] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0 [0193.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0193.915] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0193.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0193.915] GetTickCount () returned 0x4030c [0193.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0193.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0193.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0193.916] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262924\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262924\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0193.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262924\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262924\\....\\temporaryfile")) returned 0 [0193.917] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262924\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262924\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262924\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262924\\temporaryfile")) returned 1 [0193.918] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262924\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7887c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7887c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7887c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0193.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7887c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7887c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7887c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7887c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7887c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7887c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0193.918] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262924\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7887c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7887c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7887c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0193.918] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7887c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7887c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7887c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.918] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7887c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7887c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7887c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.918] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0193.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262924\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262924\\temporaryfile")) returned 1 [0193.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7887c6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7887c6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7887c6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0193.919] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0193.919] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18262924" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18262924")) returned 1 [0193.919] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 1 [0194.323] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.323] WriteFile (in: hFile=0xdc, lpBuffer=0x3270028*, nNumberOfBytesToWrite=0x609c08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x3270028*, lpNumberOfBytesWritten=0x18fdd8*=0x609c08, lpOverlapped=0x0) returned 1 [0194.453] CloseHandle (hObject=0xdc) returned 1 [0194.507] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.507] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc200 [0194.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc208) returned 0x2a0a70 [0194.507] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xc200, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0xc200, lpOverlapped=0x0) returned 1 [0194.509] CloseHandle (hObject=0xdc) returned 1 [0194.509] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0 [0194.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0194.509] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0194.509] GetTickCount () returned 0x4055c [0194.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0194.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0194.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0194.510] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263516\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263516\\...."), lpSecurityAttributes=0x256210) returned 1 [0194.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263516\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263516\\....\\temporaryfile")) returned 0 [0194.511] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263516\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263516\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263516\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263516\\temporaryfile")) returned 1 [0194.512] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263516\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e23b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e23b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e23b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0194.512] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e23b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e23b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e23b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.512] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e23b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e23b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e23b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0194.513] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263516\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e23b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e23b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e23b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0194.513] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e23b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e23b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e23b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.513] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e23b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e23b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e23b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.513] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0194.513] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263516\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263516\\temporaryfile")) returned 1 [0194.513] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e23b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e23b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e23b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0194.513] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0194.513] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263516" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263516")) returned 1 [0194.513] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 1 [0194.515] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.515] WriteFile (in: hFile=0xdc, lpBuffer=0x2acc88*, nNumberOfBytesToWrite=0xc208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2acc88*, lpNumberOfBytesWritten=0x18fdd8*=0xc208, lpOverlapped=0x0) returned 1 [0194.517] CloseHandle (hObject=0xdc) returned 1 [0194.517] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.517] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x105a00 [0194.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x105a08) returned 0x2650020 [0194.518] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x105a00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x105a00, lpOverlapped=0x0) returned 1 [0194.560] CloseHandle (hObject=0xdc) returned 1 [0194.560] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0 [0194.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0194.560] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0194.560] GetTickCount () returned 0x4058b [0194.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0194.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0194.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0194.561] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263563\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263563\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0194.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263563\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263563\\....\\temporaryfile")) returned 0 [0194.561] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263563\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263563\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263563\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263563\\temporaryfile")) returned 1 [0194.562] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263563\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e95f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e95f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e95f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0194.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e95f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e95f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e95f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e95f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e95f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e95f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0194.562] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263563\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e95f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e95f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e95f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0194.562] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e95f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e95f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e95f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.562] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e95f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e95f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e95f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.562] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0194.563] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263563\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263563\\temporaryfile")) returned 1 [0194.563] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78e95f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78e95f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78e95f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0194.563] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0194.563] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263563" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263563")) returned 1 [0194.563] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 1 [0194.658] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.658] WriteFile (in: hFile=0xdc, lpBuffer=0x2870028*, nNumberOfBytesToWrite=0x105a08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2870028*, lpNumberOfBytesWritten=0x18fdd8*=0x105a08, lpOverlapped=0x0) returned 1 [0194.689] CloseHandle (hObject=0xdc) returned 1 [0194.698] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.699] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x29800 [0194.699] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x29808) returned 0x2a0a70 [0194.699] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x29800, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x29800, lpOverlapped=0x0) returned 1 [0194.700] CloseHandle (hObject=0xdc) returned 1 [0194.701] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0 [0194.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0194.701] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0194.701] GetTickCount () returned 0x40618 [0194.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0194.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0194.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0194.701] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263704\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263704\\...."), lpSecurityAttributes=0x256210) returned 1 [0194.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263704\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263704\\....\\temporaryfile")) returned 0 [0194.703] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263704\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263704\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263704\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263704\\temporaryfile")) returned 1 [0194.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263704\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78fecb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78fecb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78fecb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0194.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78fecb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78fecb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78fecb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78fecb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78fecb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78fecb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0194.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263704\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78fecb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78fecb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78fecb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0194.704] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78fecb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78fecb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78fecb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.704] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78fecb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78fecb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78fecb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.704] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0194.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263704\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263704\\temporaryfile")) returned 1 [0194.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78fecb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x78fecb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x78fecb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0194.704] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0194.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263704" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263704")) returned 1 [0194.705] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 1 [0194.709] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.710] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca288*, nNumberOfBytesToWrite=0x29808, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca288*, lpNumberOfBytesWritten=0x18fdd8*=0x29808, lpOverlapped=0x0) returned 1 [0194.712] CloseHandle (hObject=0xdc) returned 1 [0194.713] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.714] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa9c00 [0194.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa9c08) returned 0x1d70020 [0194.714] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xa9c00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xa9c00, lpOverlapped=0x0) returned 1 [0194.732] CloseHandle (hObject=0xdc) returned 1 [0194.732] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0 [0194.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0194.732] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0194.732] GetTickCount () returned 0x40637 [0194.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0194.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0194.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0194.733] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263735\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263735\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0194.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263735\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263735\\....\\temporaryfile")) returned 0 [0194.733] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263735\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263735\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263735\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263735\\temporaryfile")) returned 1 [0194.734] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263735\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79038e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79038e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79038e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0194.734] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79038e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79038e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79038e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.735] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79038e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79038e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79038e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0194.735] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263735\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79038e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79038e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79038e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0194.735] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79038e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79038e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79038e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.735] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79038e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79038e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79038e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.735] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0194.735] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263735\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263735\\temporaryfile")) returned 1 [0194.735] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79038e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79038e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79038e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0194.735] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0194.735] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263735" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263735")) returned 1 [0194.735] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 1 [0194.767] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.768] WriteFile (in: hFile=0xdc, lpBuffer=0x2700028*, nNumberOfBytesToWrite=0xa9c08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2700028*, lpNumberOfBytesWritten=0x18fdd8*=0xa9c08, lpOverlapped=0x0) returned 1 [0194.779] CloseHandle (hObject=0xdc) returned 1 [0194.785] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.786] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9e00 [0194.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9e08) returned 0x2a0a70 [0194.786] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x9e00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x9e00, lpOverlapped=0x0) returned 1 [0194.790] CloseHandle (hObject=0xdc) returned 1 [0194.790] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0 [0194.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0194.790] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0194.790] GetTickCount () returned 0x40675 [0194.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0194.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0194.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0194.791] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263797\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263797\\...."), lpSecurityAttributes=0x256210) returned 1 [0194.792] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263797\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263797\\....\\temporaryfile")) returned 0 [0194.792] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263797\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263797\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263797\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263797\\temporaryfile")) returned 1 [0194.793] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263797\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790d13c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790d13c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790d13c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0194.793] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790d13c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790d13c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790d13c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.793] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790d13c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790d13c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790d13c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0194.793] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263797\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790d13c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790d13c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790d13c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0194.793] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790d13c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790d13c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790d13c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.793] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790d13c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790d13c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790d13c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.793] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0194.793] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263797\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263797\\temporaryfile")) returned 1 [0194.794] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790d13c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790d13c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790d13c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0194.794] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0194.794] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263797" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263797")) returned 1 [0194.794] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 1 [0194.795] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.795] WriteFile (in: hFile=0xdc, lpBuffer=0x2aa888*, nNumberOfBytesToWrite=0x9e08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2aa888*, lpNumberOfBytesWritten=0x18fdd8*=0x9e08, lpOverlapped=0x0) returned 1 [0194.796] CloseHandle (hObject=0xdc) returned 1 [0194.797] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.797] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6d600 [0194.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6d608) returned 0x2a0a70 [0194.797] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x6d600, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x6d600, lpOverlapped=0x0) returned 1 [0194.802] CloseHandle (hObject=0xdc) returned 1 [0194.802] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0 [0194.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0194.802] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0194.802] GetTickCount () returned 0x40685 [0194.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0194.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0194.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0194.803] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263813\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263813\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0194.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263813\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263813\\....\\temporaryfile")) returned 0 [0194.804] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263813\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263813\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263813\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263813\\temporaryfile")) returned 1 [0194.805] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263813\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790f7520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790f7520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790f7520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0194.805] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790f7520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790f7520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790f7520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.805] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790f7520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790f7520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790f7520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0194.805] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263813\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790f7520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790f7520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790f7520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0194.805] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790f7520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790f7520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790f7520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.805] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790f7520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790f7520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790f7520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.805] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0194.805] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263813\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263813\\temporaryfile")) returned 1 [0194.805] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x790f7520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x790f7520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x790f7520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0194.805] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0194.805] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263813" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263813")) returned 1 [0194.805] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 1 [0194.819] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.820] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x6d608, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x6d608, lpOverlapped=0x0) returned 1 [0194.827] CloseHandle (hObject=0xdc) returned 1 [0194.827] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.828] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x36c00 [0194.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36c08) returned 0x2a0a70 [0194.828] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x36c00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x36c00, lpOverlapped=0x0) returned 1 [0194.830] CloseHandle (hObject=0xdc) returned 1 [0194.831] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0 [0194.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0194.831] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0194.831] GetTickCount () returned 0x40694 [0194.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0194.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0194.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0194.832] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263828\\...."), lpSecurityAttributes=0x256210) returned 1 [0194.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263828\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263828\\....\\temporaryfile")) returned 0 [0194.832] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263828\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263828\\temporaryfile")) returned 1 [0194.833] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263828\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7911d680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791437e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791437e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0194.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7911d680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791437e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791437e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791437e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791437e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791437e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0194.833] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263828\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791437e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791437e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791437e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0194.833] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791437e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791437e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791437e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.833] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791437e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791437e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791437e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.834] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0194.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263828\\temporaryfile")) returned 1 [0194.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791437e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791437e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791437e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0194.834] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0194.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263828" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263828")) returned 1 [0194.834] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 1 [0194.841] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.841] WriteFile (in: hFile=0xdc, lpBuffer=0x2d7688*, nNumberOfBytesToWrite=0x36c08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d7688*, lpNumberOfBytesWritten=0x18fdd8*=0x36c08, lpOverlapped=0x0) returned 1 [0194.845] CloseHandle (hObject=0xdc) returned 1 [0194.845] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.845] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b000 [0194.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b008) returned 0x2a0a70 [0194.845] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x1b000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b000, lpOverlapped=0x0) returned 1 [0194.847] CloseHandle (hObject=0xdc) returned 1 [0194.847] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll")) returned 0 [0194.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0194.847] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0194.847] GetTickCount () returned 0x406b4 [0194.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0194.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0194.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0194.848] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263860\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263860\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0194.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263860\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263860\\....\\temporaryfile")) returned 0 [0194.849] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263860\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263860\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263860\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263860\\temporaryfile")) returned 1 [0194.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263860\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79169940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79169940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79169940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0194.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79169940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79169940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79169940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79169940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79169940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79169940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0194.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263860\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79169940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79169940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79169940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0194.850] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79169940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79169940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79169940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.850] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79169940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79169940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79169940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.850] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0194.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263860\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263860\\temporaryfile")) returned 1 [0194.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79169940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79169940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79169940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0194.850] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0194.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263860" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263860")) returned 1 [0194.850] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 1 [0194.852] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.853] WriteFile (in: hFile=0xdc, lpBuffer=0x2bba88*, nNumberOfBytesToWrite=0x1b008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bba88*, lpNumberOfBytesWritten=0x18fdd8*=0x1b008, lpOverlapped=0x0) returned 1 [0194.855] CloseHandle (hObject=0xdc) returned 1 [0194.855] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.855] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x85000 [0194.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x85008) returned 0x1d70020 [0194.856] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x85000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0x85000, lpOverlapped=0x0) returned 1 [0194.879] CloseHandle (hObject=0xdc) returned 1 [0194.879] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0 [0194.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0194.880] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0194.880] GetTickCount () returned 0x406d3 [0194.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0194.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0194.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0194.880] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263891\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263891\\...."), lpSecurityAttributes=0x256210) returned 1 [0194.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263891\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263891\\....\\temporaryfile")) returned 0 [0194.881] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263891\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263891\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263891\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263891\\temporaryfile")) returned 1 [0194.882] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263891\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791b5c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791b5c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791b5c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0194.882] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791b5c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791b5c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791b5c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.882] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791b5c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791b5c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791b5c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0194.882] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263891\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791b5c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791b5c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791b5c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0194.882] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791b5c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791b5c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791b5c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.882] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791b5c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791b5c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791b5c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.882] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0194.882] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263891\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263891\\temporaryfile")) returned 1 [0194.882] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x791b5c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x791b5c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x791b5c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0194.882] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0194.882] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263891" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263891")) returned 1 [0194.883] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 1 [0194.908] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.908] WriteFile (in: hFile=0xdc, lpBuffer=0x26e0028*, nNumberOfBytesToWrite=0x85008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x26e0028*, lpNumberOfBytesWritten=0x18fdd8*=0x85008, lpOverlapped=0x0) returned 1 [0194.918] CloseHandle (hObject=0xdc) returned 1 [0194.923] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.923] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3000 [0194.923] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3008) returned 0x297460 [0194.923] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x3000, lpOverlapped=0x0) returned 1 [0194.925] CloseHandle (hObject=0xdc) returned 1 [0194.925] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0 [0194.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0194.925] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0194.925] GetTickCount () returned 0x40702 [0194.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0194.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0194.926] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0194.926] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263938\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263938\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0194.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263938\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263938\\....\\temporaryfile")) returned 0 [0194.932] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263938\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263938\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263938\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263938\\temporaryfile")) returned 1 [0194.933] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263938\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79228020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79228020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79228020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0194.933] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79228020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79228020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79228020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.933] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79228020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79228020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79228020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0194.933] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263938\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79228020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79228020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79228020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0194.933] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79228020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79228020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79228020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.933] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79228020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79228020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79228020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.933] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0194.933] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263938\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263938\\temporaryfile")) returned 1 [0194.933] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79228020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79228020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79228020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0194.933] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0194.933] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263938" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263938")) returned 1 [0194.934] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 1 [0194.934] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.935] WriteFile (in: hFile=0xdc, lpBuffer=0x29a478*, nNumberOfBytesToWrite=0x3008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29a478*, lpNumberOfBytesWritten=0x18fdd8*=0x3008, lpOverlapped=0x0) returned 1 [0194.936] CloseHandle (hObject=0xdc) returned 1 [0194.942] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0194.942] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x130600 [0194.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x130608) returned 0x2650020 [0194.943] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x130600, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x130600, lpOverlapped=0x0) returned 1 [0194.977] CloseHandle (hObject=0xdc) returned 1 [0194.977] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0 [0194.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0194.977] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0194.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0194.977] GetTickCount () returned 0x40730 [0194.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0194.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0194.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0194.978] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263984\\...."), lpSecurityAttributes=0x256210) returned 1 [0194.978] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263984\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263984\\....\\temporaryfile")) returned 0 [0194.978] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263984\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263984\\temporaryfile")) returned 1 [0194.980] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263984\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7929a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7929a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7929a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0194.980] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7929a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7929a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7929a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.980] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7929a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7929a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7929a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0194.980] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263984\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7929a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7929a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7929a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0194.980] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7929a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7929a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7929a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.980] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7929a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7929a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7929a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.980] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0194.980] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263984\\temporaryfile")) returned 1 [0194.980] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7929a440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7929a440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7929a440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0194.980] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0194.980] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18263984" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18263984")) returned 1 [0194.980] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 1 [0195.049] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0195.050] WriteFile (in: hFile=0xdc, lpBuffer=0x28d0028*, nNumberOfBytesToWrite=0x130608, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28d0028*, lpNumberOfBytesWritten=0x18fdd8*=0x130608, lpOverlapped=0x0) returned 1 [0195.072] CloseHandle (hObject=0xdc) returned 1 [0195.083] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0195.083] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ae00 [0195.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ae08) returned 0x2350048 [0195.084] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7ae00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7ae00, lpOverlapped=0x0) returned 1 [0195.093] CloseHandle (hObject=0xdc) returned 1 [0195.093] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0 [0195.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.094] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.094] GetTickCount () returned 0x4079e [0195.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0195.094] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264094\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264094\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264094\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264094\\....\\temporaryfile")) returned 0 [0195.095] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264094\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264094\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264094\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264094\\temporaryfile")) returned 1 [0195.097] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264094\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x793a4de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x793a4de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x793a4de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.097] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x793a4de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x793a4de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x793a4de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.097] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x793a4de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x793a4de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x793a4de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.097] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264094\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x793a4de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x793a4de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x793a4de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.097] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x793a4de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x793a4de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x793a4de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.097] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x793a4de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x793a4de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x793a4de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.097] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.097] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264094\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264094\\temporaryfile")) returned 1 [0195.097] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x793a4de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x793a4de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x793a4de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.097] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.097] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264094" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264094")) returned 1 [0195.098] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 1 [0195.119] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0195.119] WriteFile (in: hFile=0xdc, lpBuffer=0x23cae60*, nNumberOfBytesToWrite=0x7ae08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23cae60*, lpNumberOfBytesWritten=0x18fdd8*=0x7ae08, lpOverlapped=0x0) returned 1 [0195.128] CloseHandle (hObject=0xdc) returned 1 [0195.133] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0195.133] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18c00 [0195.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18c08) returned 0x2a0a70 [0195.134] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x18c00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x18c00, lpOverlapped=0x0) returned 1 [0195.137] CloseHandle (hObject=0xdc) returned 1 [0195.137] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0 [0195.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.137] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.137] GetTickCount () returned 0x407cc [0195.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0195.138] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264140\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264140\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264140\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264140\\....\\temporaryfile")) returned 0 [0195.138] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264140\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264140\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264140\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264140\\temporaryfile")) returned 1 [0195.143] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264140\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79417200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79417200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79417200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.143] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79417200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79417200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79417200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.143] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79417200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79417200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79417200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.143] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264140\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79417200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79417200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79417200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.143] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79417200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79417200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79417200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.143] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79417200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79417200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79417200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.143] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.143] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264140\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264140\\temporaryfile")) returned 1 [0195.143] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79417200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79417200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79417200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.144] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.144] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264140" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264140")) returned 1 [0195.144] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 1 [0195.148] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0195.148] WriteFile (in: hFile=0xdc, lpBuffer=0x2b9688*, nNumberOfBytesToWrite=0x18c08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b9688*, lpNumberOfBytesWritten=0x18fdd8*=0x18c08, lpOverlapped=0x0) returned 1 [0195.151] CloseHandle (hObject=0xdc) returned 1 [0195.151] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0195.151] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7943d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7943d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0195.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.151] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.152] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.152] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.152] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.153] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.153] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.154] CloseHandle (hObject=0xe0) returned 1 [0195.155] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0 [0195.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.155] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.155] GetTickCount () returned 0x407dc [0195.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.155] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264156\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264156\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264156\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264156\\....\\temporaryfile")) returned 0 [0195.156] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264156\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264156\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264156\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264156\\temporaryfile")) returned 1 [0195.157] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264156\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7943d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7943d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7943d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.157] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7943d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7943d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7943d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.157] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7943d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7943d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7943d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.157] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264156\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7943d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7943d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7943d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.157] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7943d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7943d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7943d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.157] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7943d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7943d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7943d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.157] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.157] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264156\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264156\\temporaryfile")) returned 1 [0195.158] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7943d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7943d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7943d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.158] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.158] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264156" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264156")) returned 1 [0195.158] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 1 [0195.158] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.159] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.159] CloseHandle (hObject=0xe0) returned 1 [0195.160] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.160] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7943d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7943d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.160] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.160] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.160] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.160] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.160] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.161] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.161] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.162] CloseHandle (hObject=0xe0) returned 1 [0195.162] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0 [0195.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.162] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.162] GetTickCount () returned 0x407ec [0195.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.163] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172\\....\\temporaryfile")) returned 0 [0195.164] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172\\temporaryfile")) returned 1 [0195.164] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.165] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.165] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.165] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.165] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.165] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.165] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.165] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172\\temporaryfile")) returned 1 [0195.165] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.165] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.165] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172")) returned 1 [0195.165] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 1 [0195.166] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.166] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.167] CloseHandle (hObject=0xe0) returned 1 [0195.167] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.167] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.168] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.168] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.168] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.168] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd7545b2, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.168] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.169] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.169] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.170] CloseHandle (hObject=0xe0) returned 1 [0195.170] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0 [0195.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.170] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.170] GetTickCount () returned 0x407ec [0195.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.171] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172\\....\\temporaryfile")) returned 0 [0195.172] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172\\temporaryfile")) returned 1 [0195.173] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.173] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.173] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.173] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.173] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.173] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.173] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.174] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172\\temporaryfile")) returned 1 [0195.174] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794634c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.174] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.174] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264172" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264172")) returned 1 [0195.174] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 1 [0195.174] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.175] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.176] CloseHandle (hObject=0xe0) returned 1 [0195.176] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.178] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x794634c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794634c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.178] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.178] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.179] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.179] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.179] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.179] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.179] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.182] CloseHandle (hObject=0xe0) returned 1 [0195.182] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0 [0195.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.182] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.182] GetTickCount () returned 0x407fb [0195.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.183] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264187\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264187\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264187\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264187\\....\\temporaryfile")) returned 0 [0195.183] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264187\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264187\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264187\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264187\\temporaryfile")) returned 1 [0195.184] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264187\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79489620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79489620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79489620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.184] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79489620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79489620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79489620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.184] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79489620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79489620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79489620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.184] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264187\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79489620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79489620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79489620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.184] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79489620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79489620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79489620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.184] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79489620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79489620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79489620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.184] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.185] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264187\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264187\\temporaryfile")) returned 1 [0195.185] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79489620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79489620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79489620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.185] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.185] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264187" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264187")) returned 1 [0195.185] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 1 [0195.185] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.186] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.186] CloseHandle (hObject=0xe0) returned 1 [0195.187] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.187] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79489620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79489620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.187] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.187] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.187] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.188] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.188] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.188] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.189] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.189] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.190] CloseHandle (hObject=0xe0) returned 1 [0195.190] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0 [0195.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.191] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.191] GetTickCount () returned 0x4080b [0195.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.191] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203\\....\\temporaryfile")) returned 0 [0195.192] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203\\temporaryfile")) returned 1 [0195.193] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.193] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.193] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.193] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.193] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.193] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.193] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.193] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203\\temporaryfile")) returned 1 [0195.193] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.193] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.193] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203")) returned 1 [0195.193] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 1 [0195.194] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.194] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.195] CloseHandle (hObject=0xe0) returned 1 [0195.195] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.195] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.196] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.196] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.196] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.196] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.196] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.196] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.197] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.197] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.198] CloseHandle (hObject=0xe0) returned 1 [0195.198] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0 [0195.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.198] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.198] GetTickCount () returned 0x4080b [0195.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.199] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203\\....\\temporaryfile")) returned 0 [0195.199] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203\\temporaryfile")) returned 1 [0195.200] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.200] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.201] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.201] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.201] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.201] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.201] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.201] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203\\temporaryfile")) returned 1 [0195.201] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794af780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.201] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.201] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264203" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264203")) returned 1 [0195.201] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 1 [0195.202] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.202] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.203] CloseHandle (hObject=0xe0) returned 1 [0195.203] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.203] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x794af780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794af780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.203] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.204] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0195.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdd0 [0195.205] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.206] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x15e00 [0195.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15e08) returned 0x2a0a70 [0195.206] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x15e00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x15e00, lpOverlapped=0x0) returned 1 [0195.208] CloseHandle (hObject=0xe0) returned 1 [0195.208] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0 [0195.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.208] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.208] GetTickCount () returned 0x4081a [0195.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0195.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.209] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218\\....\\temporaryfile")) returned 0 [0195.210] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218\\temporaryfile")) returned 1 [0195.210] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.211] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.211] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.211] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.211] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.211] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218\\temporaryfile")) returned 1 [0195.211] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.211] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218")) returned 1 [0195.211] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 1 [0195.213] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.213] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6888*, nNumberOfBytesToWrite=0x15e08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6888*, lpNumberOfBytesWritten=0x18fdb8*=0x15e08, lpOverlapped=0x0) returned 1 [0195.215] CloseHandle (hObject=0xe0) returned 1 [0195.215] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.216] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7c00 [0195.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c08) returned 0x2a0a70 [0195.216] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x7c00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x7c00, lpOverlapped=0x0) returned 1 [0195.218] CloseHandle (hObject=0xe0) returned 1 [0195.218] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0 [0195.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.218] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.218] GetTickCount () returned 0x4081a [0195.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0195.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.219] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218\\....\\temporaryfile")) returned 0 [0195.219] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218\\temporaryfile")) returned 1 [0195.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.220] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.220] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.221] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.221] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.221] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218\\temporaryfile")) returned 1 [0195.221] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794d58e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794d58e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794d58e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.221] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264218" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264218")) returned 1 [0195.221] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 1 [0195.222] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.222] WriteFile (in: hFile=0xe0, lpBuffer=0x2a8688*, nNumberOfBytesToWrite=0x7c08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a8688*, lpNumberOfBytesWritten=0x18fdb8*=0x7c08, lpOverlapped=0x0) returned 1 [0195.223] CloseHandle (hObject=0xe0) returned 1 [0195.224] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.224] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8200 [0195.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8208) returned 0x2a0a70 [0195.224] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x8200, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x8200, lpOverlapped=0x0) returned 1 [0195.225] CloseHandle (hObject=0xe0) returned 1 [0195.226] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0 [0195.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.226] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.226] GetTickCount () returned 0x4082a [0195.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.226] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234\\....\\temporaryfile")) returned 0 [0195.227] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234\\temporaryfile")) returned 1 [0195.228] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.228] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.228] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.228] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.228] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.228] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.228] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.228] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234\\temporaryfile")) returned 1 [0195.228] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.228] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.228] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234")) returned 1 [0195.229] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 1 [0195.229] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.230] WriteFile (in: hFile=0xe0, lpBuffer=0x2a8c88*, nNumberOfBytesToWrite=0x8208, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a8c88*, lpNumberOfBytesWritten=0x18fdb8*=0x8208, lpOverlapped=0x0) returned 1 [0195.231] CloseHandle (hObject=0xe0) returned 1 [0195.231] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.231] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xf600 [0195.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf608) returned 0x2a0a70 [0195.231] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xf600, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0xf600, lpOverlapped=0x0) returned 1 [0195.233] CloseHandle (hObject=0xe0) returned 1 [0195.233] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0 [0195.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.233] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.233] GetTickCount () returned 0x4082a [0195.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.234] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234\\....\\temporaryfile")) returned 0 [0195.235] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234\\temporaryfile")) returned 1 [0195.236] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.236] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.236] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.236] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.236] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.236] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.236] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.236] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234\\temporaryfile")) returned 1 [0195.236] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794fba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x794fba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x794fba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.236] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.236] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264234" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264234")) returned 1 [0195.237] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 1 [0195.238] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.238] WriteFile (in: hFile=0xe0, lpBuffer=0x2b0088*, nNumberOfBytesToWrite=0xf608, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b0088*, lpNumberOfBytesWritten=0x18fdb8*=0xf608, lpOverlapped=0x0) returned 1 [0195.250] CloseHandle (hObject=0xe0) returned 1 [0195.250] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.251] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x30200 [0195.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30208) returned 0x2a0a70 [0195.251] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x30200, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x30200, lpOverlapped=0x0) returned 1 [0195.253] CloseHandle (hObject=0xe0) returned 1 [0195.253] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0 [0195.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.253] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.253] GetTickCount () returned 0x40849 [0195.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.254] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264265\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264265\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264265\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264265\\....\\temporaryfile")) returned 0 [0195.255] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264265\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264265\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264265\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264265\\temporaryfile")) returned 1 [0195.256] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264265\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79547d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79547d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79547d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.256] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79547d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79547d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79547d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.256] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79547d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79547d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79547d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.256] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264265\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79547d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79547d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79547d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.256] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79547d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79547d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79547d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.256] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79547d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79547d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79547d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.256] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.256] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264265\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264265\\temporaryfile")) returned 1 [0195.256] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79547d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79547d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79547d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.257] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.257] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264265" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264265")) returned 1 [0195.257] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 1 [0195.263] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.264] WriteFile (in: hFile=0xe0, lpBuffer=0x2d0c88*, nNumberOfBytesToWrite=0x30208, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2d0c88*, lpNumberOfBytesWritten=0x18fdb8*=0x30208, lpOverlapped=0x0) returned 1 [0195.267] CloseHandle (hObject=0xe0) returned 1 [0195.267] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.269] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x36c00 [0195.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36c08) returned 0x2a0a70 [0195.269] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x36c00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x36c00, lpOverlapped=0x0) returned 1 [0195.271] CloseHandle (hObject=0xe0) returned 1 [0195.271] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0 [0195.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.271] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.271] GetTickCount () returned 0x40859 [0195.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.272] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264281\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264281\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264281\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264281\\....\\temporaryfile")) returned 0 [0195.272] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264281\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264281\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264281\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264281\\temporaryfile")) returned 1 [0195.273] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264281\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7956de60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7956de60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7956de60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.273] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7956de60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7956de60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7956de60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.273] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7956de60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7956de60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7956de60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.273] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264281\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7956de60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7956de60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7956de60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.273] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7956de60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7956de60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7956de60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.273] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7956de60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7956de60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7956de60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.274] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.274] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264281\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264281\\temporaryfile")) returned 1 [0195.274] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7956de60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7956de60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7956de60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.274] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.274] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264281" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264281")) returned 1 [0195.274] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 1 [0195.278] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.280] WriteFile (in: hFile=0xe0, lpBuffer=0x2d7688*, nNumberOfBytesToWrite=0x36c08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2d7688*, lpNumberOfBytesWritten=0x18fdb8*=0x36c08, lpOverlapped=0x0) returned 1 [0195.283] CloseHandle (hObject=0xe0) returned 1 [0195.284] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.284] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2200 [0195.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2208) returned 0x297460 [0195.285] ReadFile (in: hFile=0xe0, lpBuffer=0x297468, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdd0*=0x2200, lpOverlapped=0x0) returned 1 [0195.286] CloseHandle (hObject=0xe0) returned 1 [0195.286] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0 [0195.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.286] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.286] GetTickCount () returned 0x40868 [0195.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0195.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.287] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296\\....\\temporaryfile")) returned 0 [0195.287] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296\\temporaryfile")) returned 1 [0195.288] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.288] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.288] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.288] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.288] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.288] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.288] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.289] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296\\temporaryfile")) returned 1 [0195.289] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.289] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.289] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296")) returned 1 [0195.289] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 1 [0195.289] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.290] WriteFile (in: hFile=0xe0, lpBuffer=0x299678*, nNumberOfBytesToWrite=0x2208, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299678*, lpNumberOfBytesWritten=0x18fdb8*=0x2208, lpOverlapped=0x0) returned 1 [0195.291] CloseHandle (hObject=0xe0) returned 1 [0195.293] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.293] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1200 [0195.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1208) returned 0x297460 [0195.293] ReadFile (in: hFile=0xe0, lpBuffer=0x297468, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdd0*=0x1200, lpOverlapped=0x0) returned 1 [0195.295] CloseHandle (hObject=0xe0) returned 1 [0195.295] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0 [0195.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.295] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.295] GetTickCount () returned 0x40868 [0195.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.295] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296\\....\\temporaryfile")) returned 0 [0195.297] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296\\temporaryfile")) returned 1 [0195.298] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.298] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.298] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.298] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.298] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.298] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.298] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.298] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296\\temporaryfile")) returned 1 [0195.298] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79593fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79593fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79593fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.298] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.298] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264296" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264296")) returned 1 [0195.299] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 1 [0195.299] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.299] WriteFile (in: hFile=0xe0, lpBuffer=0x298678*, nNumberOfBytesToWrite=0x1208, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x298678*, lpNumberOfBytesWritten=0x18fdb8*=0x1208, lpOverlapped=0x0) returned 1 [0195.300] CloseHandle (hObject=0xe0) returned 1 [0195.300] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.301] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2400 [0195.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2408) returned 0x297460 [0195.302] ReadFile (in: hFile=0xe0, lpBuffer=0x297468, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdd0*=0x2400, lpOverlapped=0x0) returned 1 [0195.303] CloseHandle (hObject=0xe0) returned 1 [0195.303] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0 [0195.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.303] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.303] GetTickCount () returned 0x40878 [0195.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0195.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.304] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312\\....\\temporaryfile")) returned 0 [0195.304] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312\\temporaryfile")) returned 1 [0195.305] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.305] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.305] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.305] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.305] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.305] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.306] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.306] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312\\temporaryfile")) returned 1 [0195.309] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.309] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.309] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312")) returned 1 [0195.310] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 1 [0195.310] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.310] WriteFile (in: hFile=0xe0, lpBuffer=0x299878*, nNumberOfBytesToWrite=0x2408, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299878*, lpNumberOfBytesWritten=0x18fdb8*=0x2408, lpOverlapped=0x0) returned 1 [0195.311] CloseHandle (hObject=0xe0) returned 1 [0195.312] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.312] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa00 [0195.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa08) returned 0x2350048 [0195.313] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xa00, lpOverlapped=0x0) returned 1 [0195.314] CloseHandle (hObject=0xe0) returned 1 [0195.314] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0 [0195.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.314] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.314] GetTickCount () returned 0x40878 [0195.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0195.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.315] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312\\....\\temporaryfile")) returned 0 [0195.315] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312\\temporaryfile")) returned 1 [0195.316] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795e0280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795e0280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.316] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795e0280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795e0280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.316] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.317] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.317] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.317] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.317] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.317] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312\\temporaryfile")) returned 1 [0195.317] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795ba120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795ba120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795ba120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.317] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.317] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264312" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264312")) returned 1 [0195.317] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 1 [0195.317] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.318] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xa08, lpOverlapped=0x0) returned 1 [0195.319] CloseHandle (hObject=0xe0) returned 1 [0195.319] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.319] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5800 [0195.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5808) returned 0x297460 [0195.319] ReadFile (in: hFile=0xe0, lpBuffer=0x297468, nNumberOfBytesToRead=0x5800, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdd0*=0x5800, lpOverlapped=0x0) returned 1 [0195.321] CloseHandle (hObject=0xe0) returned 1 [0195.321] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0 [0195.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.321] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.321] GetTickCount () returned 0x40888 [0195.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0195.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.322] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264328\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264328\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264328\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264328\\....\\temporaryfile")) returned 0 [0195.322] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264328\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264328\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264328\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264328\\temporaryfile")) returned 1 [0195.323] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264328\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795e0280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795e0280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795e0280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.323] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795e0280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795e0280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795e0280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.323] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795e0280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795e0280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795e0280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.323] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264328\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795e0280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795e0280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795e0280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.323] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795e0280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795e0280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795e0280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.324] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795e0280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795e0280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795e0280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.324] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.324] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264328\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264328\\temporaryfile")) returned 1 [0195.324] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x795e0280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x795e0280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x795e0280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.324] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.324] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264328" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264328")) returned 1 [0195.324] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 1 [0195.326] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.326] WriteFile (in: hFile=0xe0, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x5808, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdb8*=0x5808, lpOverlapped=0x0) returned 1 [0195.327] CloseHandle (hObject=0xe0) returned 1 [0195.329] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.329] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa00 [0195.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa08) returned 0x2350048 [0195.329] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xa00, lpOverlapped=0x0) returned 1 [0195.331] CloseHandle (hObject=0xe0) returned 1 [0195.331] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0 [0195.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.331] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.331] GetTickCount () returned 0x40897 [0195.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0195.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.332] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343\\....\\temporaryfile")) returned 0 [0195.333] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343\\temporaryfile")) returned 1 [0195.334] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.334] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.334] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.334] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.334] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.334] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.334] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.334] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343\\temporaryfile")) returned 1 [0195.334] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.334] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.335] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343")) returned 1 [0195.335] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 1 [0195.335] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.335] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xa08, lpOverlapped=0x0) returned 1 [0195.336] CloseHandle (hObject=0xe0) returned 1 [0195.336] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.337] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x36400 [0195.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36408) returned 0x2a0a70 [0195.338] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x36400, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x36400, lpOverlapped=0x0) returned 1 [0195.343] CloseHandle (hObject=0xe0) returned 1 [0195.343] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0 [0195.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.343] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.343] GetTickCount () returned 0x40897 [0195.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.344] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343\\....\\temporaryfile")) returned 0 [0195.344] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343\\temporaryfile")) returned 1 [0195.345] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.345] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.345] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.345] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.346] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.346] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.346] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.346] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343\\temporaryfile")) returned 1 [0195.346] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796063e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796063e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796063e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.346] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.346] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264343" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264343")) returned 1 [0195.346] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 1 [0195.352] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.352] WriteFile (in: hFile=0xe0, lpBuffer=0x2d6e88*, nNumberOfBytesToWrite=0x36408, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2d6e88*, lpNumberOfBytesWritten=0x18fdb8*=0x36408, lpOverlapped=0x0) returned 1 [0195.356] CloseHandle (hObject=0xe0) returned 1 [0195.356] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.357] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2200 [0195.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2208) returned 0x297460 [0195.358] ReadFile (in: hFile=0xe0, lpBuffer=0x297468, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdd0*=0x2200, lpOverlapped=0x0) returned 1 [0195.359] CloseHandle (hObject=0xe0) returned 1 [0195.359] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0 [0195.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.359] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.359] GetTickCount () returned 0x408a7 [0195.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.360] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264359\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264359\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264359\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264359\\....\\temporaryfile")) returned 0 [0195.361] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264359\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264359\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264359\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264359\\temporaryfile")) returned 1 [0195.361] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264359\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7962c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7962c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7962c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.361] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7962c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7962c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7962c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.362] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7962c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7962c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7962c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.362] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264359\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7962c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7962c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7962c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.362] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7962c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7962c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7962c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.362] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7962c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7962c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7962c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.362] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264359\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264359\\temporaryfile")) returned 1 [0195.362] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7962c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7962c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7962c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.362] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264359" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264359")) returned 1 [0195.362] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 1 [0195.363] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.363] WriteFile (in: hFile=0xe0, lpBuffer=0x299678*, nNumberOfBytesToWrite=0x2208, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299678*, lpNumberOfBytesWritten=0x18fdb8*=0x2208, lpOverlapped=0x0) returned 1 [0195.364] CloseHandle (hObject=0xe0) returned 1 [0195.367] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.367] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2800 [0195.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2808) returned 0x297460 [0195.367] ReadFile (in: hFile=0xe0, lpBuffer=0x297468, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdd0*=0x2800, lpOverlapped=0x0) returned 1 [0195.368] CloseHandle (hObject=0xe0) returned 1 [0195.368] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0 [0195.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.369] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.369] GetTickCount () returned 0x408b6 [0195.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.369] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264374\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264374\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264374\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264374\\....\\temporaryfile")) returned 0 [0195.370] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264374\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264374\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264374\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264374\\temporaryfile")) returned 1 [0195.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264374\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796526a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796526a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796526a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.371] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796526a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796526a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796526a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.371] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796526a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796526a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796526a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264374\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796526a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796526a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796526a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.371] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796526a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796526a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796526a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.371] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796526a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796526a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796526a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.371] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.371] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264374\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264374\\temporaryfile")) returned 1 [0195.371] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796526a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796526a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796526a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.371] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.371] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264374" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264374")) returned 1 [0195.371] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 1 [0195.372] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.373] WriteFile (in: hFile=0xe0, lpBuffer=0x299c78*, nNumberOfBytesToWrite=0x2808, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299c78*, lpNumberOfBytesWritten=0x18fdb8*=0x2808, lpOverlapped=0x0) returned 1 [0195.374] CloseHandle (hObject=0xe0) returned 1 [0195.374] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.377] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa00 [0195.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa08) returned 0x2350048 [0195.377] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xa00, lpOverlapped=0x0) returned 1 [0195.379] CloseHandle (hObject=0xe0) returned 1 [0195.379] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0 [0195.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.379] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.379] GetTickCount () returned 0x408c6 [0195.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0195.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.380] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390\\....\\temporaryfile")) returned 0 [0195.381] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390\\temporaryfile")) returned 1 [0195.381] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.382] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.382] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.382] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.382] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.382] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.382] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.382] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390\\temporaryfile")) returned 1 [0195.382] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.382] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.382] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390")) returned 1 [0195.382] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 1 [0195.383] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.383] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xa08, lpOverlapped=0x0) returned 1 [0195.384] CloseHandle (hObject=0xe0) returned 1 [0195.384] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.384] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa00 [0195.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa08) returned 0x2350048 [0195.385] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xa00, lpOverlapped=0x0) returned 1 [0195.386] CloseHandle (hObject=0xe0) returned 1 [0195.386] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0 [0195.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.386] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.386] GetTickCount () returned 0x408c6 [0195.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.387] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.387] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390\\....\\temporaryfile")) returned 0 [0195.387] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390\\temporaryfile")) returned 1 [0195.388] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.388] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.389] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.389] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.389] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.389] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.389] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.389] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390\\temporaryfile")) returned 1 [0195.389] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79678800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79678800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79678800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.389] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.389] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264390" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264390")) returned 1 [0195.389] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 1 [0195.389] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.390] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xa08, lpOverlapped=0x0) returned 1 [0195.391] CloseHandle (hObject=0xe0) returned 1 [0195.391] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.391] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xaa00 [0195.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaa08) returned 0x2a0a70 [0195.392] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xaa00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0xaa00, lpOverlapped=0x0) returned 1 [0195.395] CloseHandle (hObject=0xe0) returned 1 [0195.395] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0 [0195.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.395] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.395] GetTickCount () returned 0x408d6 [0195.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0195.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.396] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406\\....\\temporaryfile")) returned 0 [0195.396] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406\\temporaryfile")) returned 1 [0195.397] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.397] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.397] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.397] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.397] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.397] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.397] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.397] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406\\temporaryfile")) returned 1 [0195.398] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.398] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.398] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406")) returned 1 [0195.398] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 1 [0195.399] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.400] WriteFile (in: hFile=0xe0, lpBuffer=0x2ab488*, nNumberOfBytesToWrite=0xaa08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ab488*, lpNumberOfBytesWritten=0x18fdb8*=0xaa08, lpOverlapped=0x0) returned 1 [0195.401] CloseHandle (hObject=0xe0) returned 1 [0195.401] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.401] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2f600 [0195.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2f608) returned 0x2a0a70 [0195.402] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x2f600, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x2f600, lpOverlapped=0x0) returned 1 [0195.405] CloseHandle (hObject=0xe0) returned 1 [0195.405] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0 [0195.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.405] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.405] GetTickCount () returned 0x408d6 [0195.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.406] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406\\....\\temporaryfile")) returned 0 [0195.407] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406\\temporaryfile")) returned 1 [0195.408] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.408] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.408] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.408] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.408] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.408] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.408] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.408] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406\\temporaryfile")) returned 1 [0195.408] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7969e960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7969e960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7969e960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.409] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.409] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264406" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264406")) returned 1 [0195.409] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 1 [0195.414] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.415] WriteFile (in: hFile=0xe0, lpBuffer=0x2d0088*, nNumberOfBytesToWrite=0x2f608, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2d0088*, lpNumberOfBytesWritten=0x18fdb8*=0x2f608, lpOverlapped=0x0) returned 1 [0195.418] CloseHandle (hObject=0xe0) returned 1 [0195.418] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.419] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc00 [0195.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc08) returned 0x2350048 [0195.419] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xc00, lpOverlapped=0x0) returned 1 [0195.420] CloseHandle (hObject=0xe0) returned 1 [0195.420] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0 [0195.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.421] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.421] GetTickCount () returned 0x408e5 [0195.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.421] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264421\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264421\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264421\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264421\\....\\temporaryfile")) returned 0 [0195.422] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264421\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264421\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264421\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264421\\temporaryfile")) returned 1 [0195.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264421\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796c4ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796c4ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796c4ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.423] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796c4ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796c4ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796c4ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.423] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796c4ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796c4ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796c4ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264421\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796c4ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796c4ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796c4ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.423] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796c4ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796c4ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796c4ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.423] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796c4ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796c4ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796c4ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.423] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264421\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264421\\temporaryfile")) returned 1 [0195.423] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796c4ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796c4ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796c4ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.423] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264421" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264421")) returned 1 [0195.424] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 1 [0195.424] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.424] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xc08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xc08, lpOverlapped=0x0) returned 1 [0195.425] CloseHandle (hObject=0xe0) returned 1 [0195.425] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.426] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc00 [0195.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc08) returned 0x2350048 [0195.426] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xc00, lpOverlapped=0x0) returned 1 [0195.428] CloseHandle (hObject=0xe0) returned 1 [0195.428] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0 [0195.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.428] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.428] GetTickCount () returned 0x408f5 [0195.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.429] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437\\....\\temporaryfile")) returned 0 [0195.429] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437\\temporaryfile")) returned 1 [0195.430] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.430] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.430] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.430] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.430] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.430] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.430] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.430] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437\\temporaryfile")) returned 1 [0195.431] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.431] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.431] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437")) returned 1 [0195.431] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 1 [0195.431] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.432] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xc08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xc08, lpOverlapped=0x0) returned 1 [0195.432] CloseHandle (hObject=0xe0) returned 1 [0195.433] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.433] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8000 [0195.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8008) returned 0x2a0a70 [0195.433] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x8000, lpOverlapped=0x0) returned 1 [0195.435] CloseHandle (hObject=0xe0) returned 1 [0195.435] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0 [0195.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.435] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.435] GetTickCount () returned 0x408f5 [0195.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.436] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437\\....\\temporaryfile")) returned 0 [0195.437] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437\\temporaryfile")) returned 1 [0195.438] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.438] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.438] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.438] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.438] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.438] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.439] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.439] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437\\temporaryfile")) returned 1 [0195.439] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796eac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x796eac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x796eac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.439] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.439] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264437" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264437")) returned 1 [0195.439] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 1 [0195.440] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.440] WriteFile (in: hFile=0xe0, lpBuffer=0x2a8a88*, nNumberOfBytesToWrite=0x8008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a8a88*, lpNumberOfBytesWritten=0x18fdb8*=0x8008, lpOverlapped=0x0) returned 1 [0195.441] CloseHandle (hObject=0xe0) returned 1 [0195.442] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.442] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.442] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.450] CloseHandle (hObject=0xe0) returned 1 [0195.450] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0 [0195.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0195.450] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.450] GetTickCount () returned 0x40904 [0195.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.451] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264452\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264452\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0195.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264452\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264452\\....\\temporaryfile")) returned 0 [0195.452] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264452\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264452\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264452\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264452\\temporaryfile")) returned 1 [0195.453] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264452\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79710d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79710d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79710d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.453] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79710d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79710d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79710d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.453] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79710d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79710d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79710d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.453] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264452\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79710d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79710d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79710d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.454] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79710d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79710d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79710d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.454] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79710d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79710d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79710d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.454] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.454] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264452\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264452\\temporaryfile")) returned 1 [0195.454] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79710d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79710d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79710d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.454] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.454] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264452" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264452")) returned 1 [0195.454] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 1 [0195.455] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.456] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.457] CloseHandle (hObject=0xe0) returned 1 [0195.457] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.457] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc00 [0195.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc08) returned 0x2350048 [0195.458] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xc00, lpOverlapped=0x0) returned 1 [0195.459] CloseHandle (hObject=0xe0) returned 1 [0195.459] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0 [0195.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.459] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.459] GetTickCount () returned 0x40914 [0195.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.460] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468\\....\\temporaryfile")) returned 0 [0195.460] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468\\temporaryfile")) returned 1 [0195.465] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79736ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79736ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79736ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.465] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79736ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79736ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79736ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.465] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79736ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79736ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79736ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.465] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79736ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79736ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79736ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.465] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79736ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79736ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79736ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.465] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79736ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79736ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79736ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.465] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.465] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468\\temporaryfile")) returned 1 [0195.465] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79736ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79736ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79736ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.465] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.465] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468")) returned 1 [0195.466] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 1 [0195.466] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.466] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xc08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xc08, lpOverlapped=0x0) returned 1 [0195.467] CloseHandle (hObject=0xe0) returned 1 [0195.467] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.467] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79736ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79736ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.468] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.468] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.468] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.468] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.468] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.469] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.469] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.470] CloseHandle (hObject=0xe0) returned 1 [0195.470] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0 [0195.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.470] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.470] GetTickCount () returned 0x40914 [0195.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.471] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468\\....\\temporaryfile")) returned 0 [0195.471] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468\\temporaryfile")) returned 1 [0195.472] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79736ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.472] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79736ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.473] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.473] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.473] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.473] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.473] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.473] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468\\temporaryfile")) returned 1 [0195.473] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.473] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.473] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264468" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264468")) returned 1 [0195.473] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 1 [0195.474] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.474] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.475] CloseHandle (hObject=0xe0) returned 1 [0195.475] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.475] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.475] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.475] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.476] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.476] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.476] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.477] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.477] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.478] CloseHandle (hObject=0xe0) returned 1 [0195.478] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0 [0195.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.478] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.478] GetTickCount () returned 0x40924 [0195.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.479] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264484\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264484\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264484\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264484\\....\\temporaryfile")) returned 0 [0195.480] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264484\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264484\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264484\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264484\\temporaryfile")) returned 1 [0195.480] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264484\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.481] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.481] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.481] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264484\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.481] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.481] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.481] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.481] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264484\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264484\\temporaryfile")) returned 1 [0195.481] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7975d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.481] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.481] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264484" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264484")) returned 1 [0195.481] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 1 [0195.482] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.482] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.483] CloseHandle (hObject=0xe0) returned 1 [0195.483] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.483] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7975d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7975d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.483] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.484] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.484] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.484] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd77a70c, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.484] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.485] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.485] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.486] CloseHandle (hObject=0xe0) returned 1 [0195.486] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0 [0195.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.487] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.487] GetTickCount () returned 0x40933 [0195.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.487] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.488] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499\\....\\temporaryfile")) returned 0 [0195.488] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499\\temporaryfile")) returned 1 [0195.489] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.489] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.489] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.490] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.490] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.490] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.490] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.490] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499\\temporaryfile")) returned 1 [0195.490] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.490] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.490] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499")) returned 1 [0195.490] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui") returned 1 [0195.490] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.491] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.492] CloseHandle (hObject=0xe0) returned 1 [0195.492] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.492] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.492] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.492] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.493] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.493] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.493] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.493] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.494] CloseHandle (hObject=0xe0) returned 1 [0195.494] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0 [0195.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.495] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.495] GetTickCount () returned 0x40933 [0195.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.495] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499\\....\\temporaryfile")) returned 0 [0195.496] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499\\temporaryfile")) returned 1 [0195.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.497] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.497] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.497] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.497] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.497] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499\\temporaryfile")) returned 1 [0195.497] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797831a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.497] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264499" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264499")) returned 1 [0195.498] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 1 [0195.498] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.498] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.499] CloseHandle (hObject=0xe0) returned 1 [0195.499] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.500] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x797831a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797831a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.500] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.500] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.501] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.501] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="auxpad", cAlternateFileName="")) returned 1 [0195.501] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0195.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256210 [0195.502] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.502] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd4 [0195.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdc) returned 0x259580 [0195.502] ReadFile (in: hFile=0xe0, lpBuffer=0x259588, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259588*, lpNumberOfBytesRead=0x18fdd0*=0xd4, lpOverlapped=0x0) returned 1 [0195.503] CloseHandle (hObject=0xe0) returned 1 [0195.503] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0 [0195.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.503] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.503] GetTickCount () returned 0x40943 [0195.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.504] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515\\....\\temporaryfile")) returned 0 [0195.504] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515\\temporaryfile")) returned 1 [0195.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.505] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.505] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.505] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.505] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.505] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.505] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515\\temporaryfile")) returned 1 [0195.506] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.506] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.506] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515")) returned 1 [0195.506] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 1 [0195.506] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.506] WriteFile (in: hFile=0xe0, lpBuffer=0x25c788*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesWritten=0x18fdb8*=0xd8, lpOverlapped=0x0) returned 1 [0195.507] CloseHandle (hObject=0xe0) returned 1 [0195.507] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.508] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2d7 [0195.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2df) returned 0x259e70 [0195.509] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x2d7, lpOverlapped=0x0) returned 1 [0195.510] CloseHandle (hObject=0xe0) returned 1 [0195.510] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0 [0195.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.510] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.510] GetTickCount () returned 0x40943 [0195.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.511] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515\\....\\temporaryfile")) returned 0 [0195.512] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515\\temporaryfile")) returned 1 [0195.513] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.513] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.513] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.513] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.513] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.513] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.513] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.513] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515\\temporaryfile")) returned 1 [0195.513] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797a9300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797a9300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797a9300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.514] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264515" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264515")) returned 1 [0195.514] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 1 [0195.514] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.514] WriteFile (in: hFile=0xe0, lpBuffer=0x25a160*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25a160*, lpNumberOfBytesWritten=0x18fdb8*=0x2e0, lpOverlapped=0x0) returned 1 [0195.515] CloseHandle (hObject=0xe0) returned 1 [0195.515] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.516] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x9655 [0195.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x965d) returned 0x2a0a70 [0195.516] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x9655, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x9655, lpOverlapped=0x0) returned 1 [0195.517] CloseHandle (hObject=0xe0) returned 1 [0195.517] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0 [0195.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.518] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.518] GetTickCount () returned 0x40952 [0195.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.518] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\....\\temporaryfile")) returned 0 [0195.519] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\temporaryfile")) returned 1 [0195.520] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.520] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.520] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.520] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.520] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.520] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.520] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.520] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\temporaryfile")) returned 1 [0195.520] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.520] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.521] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530")) returned 1 [0195.521] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 1 [0195.521] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.522] WriteFile (in: hFile=0xe0, lpBuffer=0x2aa0e0*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2aa0e0*, lpNumberOfBytesWritten=0x18fdb8*=0x9660, lpOverlapped=0x0) returned 1 [0195.523] CloseHandle (hObject=0xe0) returned 1 [0195.523] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.524] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd1 [0195.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd9) returned 0x259580 [0195.524] ReadFile (in: hFile=0xe0, lpBuffer=0x259588, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259588*, lpNumberOfBytesRead=0x18fdd0*=0xd1, lpOverlapped=0x0) returned 1 [0195.525] CloseHandle (hObject=0xe0) returned 1 [0195.525] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0 [0195.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.525] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.525] GetTickCount () returned 0x40952 [0195.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.526] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\....\\temporaryfile")) returned 0 [0195.527] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\temporaryfile")) returned 1 [0195.527] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.528] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.528] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.528] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.528] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.528] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.528] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.528] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\temporaryfile")) returned 1 [0195.528] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.528] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.528] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530")) returned 1 [0195.528] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 1 [0195.529] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.529] WriteFile (in: hFile=0xe0, lpBuffer=0x25c788*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesWritten=0x18fdb8*=0xd8, lpOverlapped=0x0) returned 1 [0195.530] CloseHandle (hObject=0xe0) returned 1 [0195.530] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.530] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd7 [0195.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdf) returned 0x259580 [0195.530] ReadFile (in: hFile=0xe0, lpBuffer=0x259588, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259588*, lpNumberOfBytesRead=0x18fdd0*=0xd7, lpOverlapped=0x0) returned 1 [0195.531] CloseHandle (hObject=0xe0) returned 1 [0195.531] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0 [0195.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.531] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.531] GetTickCount () returned 0x40952 [0195.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.532] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\....\\temporaryfile")) returned 0 [0195.533] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\temporaryfile")) returned 1 [0195.534] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.534] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.534] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.534] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.534] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.535] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.535] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.535] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530\\temporaryfile")) returned 1 [0195.535] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797cf460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797cf460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797cf460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.535] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.535] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264530" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264530")) returned 1 [0195.535] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 1 [0195.535] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.536] WriteFile (in: hFile=0xe0, lpBuffer=0x28aa18*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x28aa18*, lpNumberOfBytesWritten=0x18fdb8*=0xe0, lpOverlapped=0x0) returned 1 [0195.536] CloseHandle (hObject=0xe0) returned 1 [0195.537] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.538] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xdb [0195.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe3) returned 0x28aa10 [0195.538] ReadFile (in: hFile=0xe0, lpBuffer=0x28aa18, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28aa18*, lpNumberOfBytesRead=0x18fdd0*=0xdb, lpOverlapped=0x0) returned 1 [0195.539] CloseHandle (hObject=0xe0) returned 1 [0195.539] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0 [0195.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.539] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.539] GetTickCount () returned 0x40962 [0195.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.539] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546\\....\\temporaryfile")) returned 0 [0195.540] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546\\temporaryfile")) returned 1 [0195.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.541] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.541] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.541] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.541] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.541] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546\\temporaryfile")) returned 1 [0195.542] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.542] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.542] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546")) returned 1 [0195.542] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 1 [0195.542] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.542] WriteFile (in: hFile=0xe0, lpBuffer=0x28ab08*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x28ab08*, lpNumberOfBytesWritten=0x18fdb8*=0xe0, lpOverlapped=0x0) returned 1 [0195.543] CloseHandle (hObject=0xe0) returned 1 [0195.543] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.544] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd7 [0195.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdf) returned 0x259580 [0195.544] ReadFile (in: hFile=0xe0, lpBuffer=0x259588, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259588*, lpNumberOfBytesRead=0x18fdd0*=0xd7, lpOverlapped=0x0) returned 1 [0195.545] CloseHandle (hObject=0xe0) returned 1 [0195.545] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0 [0195.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.545] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.545] GetTickCount () returned 0x40962 [0195.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.546] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546\\....\\temporaryfile")) returned 0 [0195.546] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546\\temporaryfile")) returned 1 [0195.547] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.547] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.547] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.547] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.547] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.548] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.548] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.548] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546\\temporaryfile")) returned 1 [0195.548] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797f55c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x797f55c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x797f55c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.548] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.548] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264546" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264546")) returned 1 [0195.548] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 1 [0195.548] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.549] WriteFile (in: hFile=0xe0, lpBuffer=0x28aa18*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x28aa18*, lpNumberOfBytesWritten=0x18fdb8*=0xe0, lpOverlapped=0x0) returned 1 [0195.550] CloseHandle (hObject=0xe0) returned 1 [0195.550] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.551] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x24f [0195.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x257) returned 0x28f1f8 [0195.551] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x24f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x24f, lpOverlapped=0x0) returned 1 [0195.552] CloseHandle (hObject=0xe0) returned 1 [0195.552] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0 [0195.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.552] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.552] GetTickCount () returned 0x40972 [0195.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.553] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562\\....\\temporaryfile")) returned 0 [0195.554] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562\\temporaryfile")) returned 1 [0195.554] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.555] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.555] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.555] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.555] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.555] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.555] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.555] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562\\temporaryfile")) returned 1 [0195.555] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.555] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.555] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562")) returned 1 [0195.555] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 1 [0195.556] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.556] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x258, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x258, lpOverlapped=0x0) returned 1 [0195.557] CloseHandle (hObject=0xe0) returned 1 [0195.557] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.557] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xcf [0195.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd7) returned 0x259580 [0195.557] ReadFile (in: hFile=0xe0, lpBuffer=0x259588, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259588*, lpNumberOfBytesRead=0x18fdd0*=0xcf, lpOverlapped=0x0) returned 1 [0195.558] CloseHandle (hObject=0xe0) returned 1 [0195.558] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0 [0195.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.558] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.558] GetTickCount () returned 0x40972 [0195.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0195.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.559] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562\\....\\temporaryfile")) returned 0 [0195.560] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562\\temporaryfile")) returned 1 [0195.561] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.561] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.561] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.561] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.561] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.561] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.561] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562\\temporaryfile")) returned 1 [0195.561] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7981b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.561] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264562" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264562")) returned 1 [0195.562] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 1 [0195.562] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.563] WriteFile (in: hFile=0xe0, lpBuffer=0x25c788*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesWritten=0x18fdb8*=0xd8, lpOverlapped=0x0) returned 1 [0195.564] CloseHandle (hObject=0xe0) returned 1 [0195.564] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.564] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7981b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7981b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.564] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.565] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.565] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0195.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0195.565] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.566] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x59a [0195.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5a2) returned 0x259e70 [0195.566] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x59a, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x59a, lpOverlapped=0x0) returned 1 [0195.567] CloseHandle (hObject=0xe4) returned 1 [0195.567] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0 [0195.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.568] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.568] GetTickCount () returned 0x40981 [0195.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.568] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577\\....\\temporaryfile")) returned 0 [0195.569] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577\\temporaryfile")) returned 1 [0195.570] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.570] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0195.570] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.570] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.570] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.570] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.570] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.570] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577\\temporaryfile")) returned 1 [0195.570] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.570] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.570] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577")) returned 1 [0195.570] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 1 [0195.571] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.571] WriteFile (in: hFile=0xe4, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fd98*=0x5a0, lpOverlapped=0x0) returned 1 [0195.572] CloseHandle (hObject=0xe4) returned 1 [0195.572] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.572] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.572] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.573] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.573] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.573] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0195.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7) returned 0x25c9b0 [0195.573] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.573] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x180 [0195.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x188) returned 0x25c780 [0195.574] ReadFile (in: hFile=0xe4, lpBuffer=0x25c788, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesRead=0x18fdb0*=0x180, lpOverlapped=0x0) returned 1 [0195.574] CloseHandle (hObject=0xe4) returned 1 [0195.574] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0 [0195.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.575] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.575] GetTickCount () returned 0x40981 [0195.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0195.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.575] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577\\....\\temporaryfile")) returned 0 [0195.577] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577\\temporaryfile")) returned 1 [0195.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.578] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0195.578] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.578] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.578] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.578] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577\\temporaryfile")) returned 1 [0195.578] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79841880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79841880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79841880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.578] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264577" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264577")) returned 1 [0195.578] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 1 [0195.579] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.583] WriteFile (in: hFile=0xe4, lpBuffer=0x28f200*, nNumberOfBytesToWrite=0x188, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesWritten=0x18fd98*=0x188, lpOverlapped=0x0) returned 1 [0195.584] CloseHandle (hObject=0xe4) returned 1 [0195.584] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.585] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x45e [0195.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x466) returned 0x259e70 [0195.585] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x45e, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x45e, lpOverlapped=0x0) returned 1 [0195.586] CloseHandle (hObject=0xe4) returned 1 [0195.586] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0 [0195.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.586] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.586] GetTickCount () returned 0x40991 [0195.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.587] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593\\....\\temporaryfile")) returned 0 [0195.588] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593\\temporaryfile")) returned 1 [0195.588] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.589] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.589] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.589] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.589] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.589] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.589] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.589] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593\\temporaryfile")) returned 1 [0195.589] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.589] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.589] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593")) returned 1 [0195.589] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 1 [0195.590] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.591] WriteFile (in: hFile=0xe4, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x468, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fd98*=0x468, lpOverlapped=0x0) returned 1 [0195.592] CloseHandle (hObject=0xe4) returned 1 [0195.592] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.593] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x188 [0195.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x190) returned 0x25c780 [0195.593] ReadFile (in: hFile=0xe4, lpBuffer=0x25c788, nNumberOfBytesToRead=0x188, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesRead=0x18fdb0*=0x188, lpOverlapped=0x0) returned 1 [0195.594] CloseHandle (hObject=0xe4) returned 1 [0195.594] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0 [0195.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.594] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.594] GetTickCount () returned 0x40991 [0195.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.594] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.595] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593\\....\\temporaryfile")) returned 0 [0195.595] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593\\temporaryfile")) returned 1 [0195.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.601] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.601] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.601] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.601] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.601] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593\\temporaryfile")) returned 1 [0195.602] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798679e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798679e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798679e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.602] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.602] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264593" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264593")) returned 1 [0195.602] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 1 [0195.602] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.603] WriteFile (in: hFile=0xe4, lpBuffer=0x28f200*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesWritten=0x18fd98*=0x190, lpOverlapped=0x0) returned 1 [0195.603] CloseHandle (hObject=0xe4) returned 1 [0195.604] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.604] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7988db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7988db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.604] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.604] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.605] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.605] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="base.xml", cAlternateFileName="")) returned 1 [0195.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0195.606] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.606] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xc4e [0195.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc56) returned 0x2350048 [0195.606] ReadFile (in: hFile=0xe4, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc4e, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdb0*=0xc4e, lpOverlapped=0x0) returned 1 [0195.608] CloseHandle (hObject=0xe4) returned 1 [0195.608] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0 [0195.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.608] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.608] GetTickCount () returned 0x409a0 [0195.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.609] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264608\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264608\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264608\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264608\\....\\temporaryfile")) returned 0 [0195.610] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264608\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264608\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264608\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264608\\temporaryfile")) returned 1 [0195.611] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264608\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7988db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7988db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7988db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.611] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7988db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7988db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7988db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0195.611] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7988db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7988db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7988db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.611] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264608\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7988db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7988db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7988db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.611] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7988db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7988db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7988db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.611] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7988db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7988db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7988db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.611] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.611] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264608\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264608\\temporaryfile")) returned 1 [0195.611] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7988db40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7988db40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7988db40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.611] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.612] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264608" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264608")) returned 1 [0195.612] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 1 [0195.612] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.612] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xc58, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0xc58, lpOverlapped=0x0) returned 1 [0195.613] CloseHandle (hObject=0xe4) returned 1 [0195.613] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.614] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xf7 [0195.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xff) returned 0x25c780 [0195.614] ReadFile (in: hFile=0xe4, lpBuffer=0x25c788, nNumberOfBytesToRead=0xf7, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesRead=0x18fdb0*=0xf7, lpOverlapped=0x0) returned 1 [0195.615] CloseHandle (hObject=0xe4) returned 1 [0195.615] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0 [0195.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.615] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.615] GetTickCount () returned 0x409b0 [0195.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.616] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624\\....\\temporaryfile")) returned 0 [0195.616] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624\\temporaryfile")) returned 1 [0195.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.617] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.617] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.617] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.617] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.617] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.617] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624\\temporaryfile")) returned 1 [0195.618] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.618] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.618] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624")) returned 1 [0195.618] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 1 [0195.618] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.618] WriteFile (in: hFile=0xe4, lpBuffer=0x28f200*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesWritten=0x18fd98*=0x100, lpOverlapped=0x0) returned 1 [0195.619] CloseHandle (hObject=0xe4) returned 1 [0195.619] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.620] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xc59 [0195.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc61) returned 0x2350048 [0195.621] ReadFile (in: hFile=0xe4, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc59, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdb0*=0xc59, lpOverlapped=0x0) returned 1 [0195.622] CloseHandle (hObject=0xe4) returned 1 [0195.622] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0 [0195.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.622] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.622] GetTickCount () returned 0x409b0 [0195.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.623] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624\\....\\temporaryfile")) returned 0 [0195.623] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624\\temporaryfile")) returned 1 [0195.624] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.624] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.624] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.624] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.624] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.625] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.625] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.625] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624\\temporaryfile")) returned 1 [0195.625] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798b3ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798b3ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798b3ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.625] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.625] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264624" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264624")) returned 1 [0195.625] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 1 [0195.625] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.626] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0xc60, lpOverlapped=0x0) returned 1 [0195.627] CloseHandle (hObject=0xe4) returned 1 [0195.627] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.627] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xc5e [0195.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc66) returned 0x2350048 [0195.627] ReadFile (in: hFile=0xe4, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc5e, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdb0*=0xc5e, lpOverlapped=0x0) returned 1 [0195.629] CloseHandle (hObject=0xe4) returned 1 [0195.629] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0 [0195.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.629] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.629] GetTickCount () returned 0x409c0 [0195.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.630] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640\\....\\temporaryfile")) returned 0 [0195.631] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640\\temporaryfile")) returned 1 [0195.632] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.632] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.632] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.632] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.632] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.632] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.632] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.632] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640\\temporaryfile")) returned 1 [0195.632] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.632] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.632] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640")) returned 1 [0195.632] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 1 [0195.633] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.633] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xc68, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0xc68, lpOverlapped=0x0) returned 1 [0195.634] CloseHandle (hObject=0xe4) returned 1 [0195.634] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.638] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2e2 [0195.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ea) returned 0x259e70 [0195.638] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x2e2, lpOverlapped=0x0) returned 1 [0195.639] CloseHandle (hObject=0xe4) returned 1 [0195.639] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0 [0195.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.639] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.639] GetTickCount () returned 0x409c0 [0195.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.640] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640\\....\\temporaryfile")) returned 0 [0195.641] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640\\temporaryfile")) returned 1 [0195.642] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.642] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.642] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.642] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.642] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.642] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.642] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.643] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640\\temporaryfile")) returned 1 [0195.643] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798d9e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798d9e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798d9e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.643] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.643] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264640" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264640")) returned 1 [0195.643] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 1 [0195.643] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.644] WriteFile (in: hFile=0xe4, lpBuffer=0x25a170*, nNumberOfBytesToWrite=0x2e8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25a170*, lpNumberOfBytesWritten=0x18fd98*=0x2e8, lpOverlapped=0x0) returned 1 [0195.645] CloseHandle (hObject=0xe4) returned 1 [0195.645] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.645] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x324 [0195.645] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32c) returned 0x259e70 [0195.645] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x324, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x324, lpOverlapped=0x0) returned 1 [0195.647] CloseHandle (hObject=0xe4) returned 1 [0195.647] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0 [0195.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.647] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.647] GetTickCount () returned 0x409cf [0195.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.647] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655\\....\\temporaryfile")) returned 0 [0195.648] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655\\temporaryfile")) returned 1 [0195.649] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.649] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.649] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.649] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.649] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.649] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.649] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.649] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655\\temporaryfile")) returned 1 [0195.649] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.649] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.649] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655")) returned 1 [0195.650] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 1 [0195.650] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.650] WriteFile (in: hFile=0xe4, lpBuffer=0x25a1b0*, nNumberOfBytesToWrite=0x328, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25a1b0*, lpNumberOfBytesWritten=0x18fd98*=0x328, lpOverlapped=0x0) returned 1 [0195.651] CloseHandle (hObject=0xe4) returned 1 [0195.651] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.652] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x1e8 [0195.652] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f0) returned 0x25c780 [0195.652] ReadFile (in: hFile=0xe4, lpBuffer=0x25c788, nNumberOfBytesToRead=0x1e8, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesRead=0x18fdb0*=0x1e8, lpOverlapped=0x0) returned 1 [0195.653] CloseHandle (hObject=0xe4) returned 1 [0195.653] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0 [0195.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.653] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.653] GetTickCount () returned 0x409cf [0195.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.654] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.655] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655\\....\\temporaryfile")) returned 0 [0195.655] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655\\temporaryfile")) returned 1 [0195.656] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.656] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.656] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.656] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.656] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.657] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.657] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.657] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655\\temporaryfile")) returned 1 [0195.657] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798fff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x798fff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x798fff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.657] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.657] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264655" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264655")) returned 1 [0195.657] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 1 [0195.657] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.658] WriteFile (in: hFile=0xe4, lpBuffer=0x28f200*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesWritten=0x18fd98*=0x1f0, lpOverlapped=0x0) returned 1 [0195.659] CloseHandle (hObject=0xe4) returned 1 [0195.659] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.659] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x269 [0195.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x271) returned 0x259e70 [0195.659] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x269, lpOverlapped=0x0) returned 1 [0195.661] CloseHandle (hObject=0xe4) returned 1 [0195.661] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0 [0195.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.661] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.661] GetTickCount () returned 0x409df [0195.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.661] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671\\....\\temporaryfile")) returned 0 [0195.662] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671\\temporaryfile")) returned 1 [0195.663] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.663] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.663] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.663] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.663] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.663] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.663] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.663] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671\\temporaryfile")) returned 1 [0195.663] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.663] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.663] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671")) returned 1 [0195.664] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 1 [0195.664] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.664] WriteFile (in: hFile=0xe4, lpBuffer=0x25a0f8*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25a0f8*, lpNumberOfBytesWritten=0x18fd98*=0x270, lpOverlapped=0x0) returned 1 [0195.665] CloseHandle (hObject=0xe4) returned 1 [0195.665] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.666] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x40e8 [0195.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40f0) returned 0x297460 [0195.666] ReadFile (in: hFile=0xe4, lpBuffer=0x297468, nNumberOfBytesToRead=0x40e8, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdb0*=0x40e8, lpOverlapped=0x0) returned 1 [0195.668] CloseHandle (hObject=0xe4) returned 1 [0195.668] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0 [0195.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.668] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.668] GetTickCount () returned 0x409df [0195.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.668] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671\\....\\temporaryfile")) returned 0 [0195.670] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671\\temporaryfile")) returned 1 [0195.671] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.671] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.671] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.671] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.671] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.671] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.671] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.671] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671\\temporaryfile")) returned 1 [0195.671] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799260c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799260c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799260c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.671] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.671] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264671" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264671")) returned 1 [0195.672] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 1 [0195.672] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.672] WriteFile (in: hFile=0xe4, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fd98*=0x40f0, lpOverlapped=0x0) returned 1 [0195.674] CloseHandle (hObject=0xe4) returned 1 [0195.676] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.676] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x3af9 [0195.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3b01) returned 0x297460 [0195.676] ReadFile (in: hFile=0xe4, lpBuffer=0x297468, nNumberOfBytesToRead=0x3af9, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdb0*=0x3af9, lpOverlapped=0x0) returned 1 [0195.678] CloseHandle (hObject=0xe4) returned 1 [0195.678] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0 [0195.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.678] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.678] GetTickCount () returned 0x409ee [0195.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.679] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686\\....\\temporaryfile")) returned 0 [0195.679] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686\\temporaryfile")) returned 1 [0195.680] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.680] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.680] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.680] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.680] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.680] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.680] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.681] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686\\temporaryfile")) returned 1 [0195.681] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.681] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.681] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686")) returned 1 [0195.681] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 1 [0195.683] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.683] WriteFile (in: hFile=0xe4, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x3b00, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fd98*=0x3b00, lpOverlapped=0x0) returned 1 [0195.684] CloseHandle (hObject=0xe4) returned 1 [0195.685] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.686] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x264b [0195.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2653) returned 0x297460 [0195.687] ReadFile (in: hFile=0xe4, lpBuffer=0x297468, nNumberOfBytesToRead=0x264b, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdb0*=0x264b, lpOverlapped=0x0) returned 1 [0195.688] CloseHandle (hObject=0xe4) returned 1 [0195.688] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0 [0195.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.688] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.688] GetTickCount () returned 0x409ee [0195.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.689] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686\\....\\temporaryfile")) returned 0 [0195.689] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686\\temporaryfile")) returned 1 [0195.690] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79972380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79972380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.690] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79972380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79972380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.691] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.691] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.691] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.691] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.691] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.691] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686\\temporaryfile")) returned 1 [0195.691] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7994c220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7994c220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7994c220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.691] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.691] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264686" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264686")) returned 1 [0195.691] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 1 [0195.692] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.693] WriteFile (in: hFile=0xe4, lpBuffer=0x299ac8*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x299ac8*, lpNumberOfBytesWritten=0x18fd98*=0x2650, lpOverlapped=0x0) returned 1 [0195.694] CloseHandle (hObject=0xe4) returned 1 [0195.694] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.694] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2b3b [0195.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b43) returned 0x297460 [0195.694] ReadFile (in: hFile=0xe4, lpBuffer=0x297468, nNumberOfBytesToRead=0x2b3b, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdb0*=0x2b3b, lpOverlapped=0x0) returned 1 [0195.696] CloseHandle (hObject=0xe4) returned 1 [0195.696] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0 [0195.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.696] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.696] GetTickCount () returned 0x409fe [0195.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.696] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702\\....\\temporaryfile")) returned 0 [0195.698] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702\\temporaryfile")) returned 1 [0195.699] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79972380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79972380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79972380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.699] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79972380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79972380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79972380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.699] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79972380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79972380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79972380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.699] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79972380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79972380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79972380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.699] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79972380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79972380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79972380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.699] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79972380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79972380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79972380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.699] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.699] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702\\temporaryfile")) returned 1 [0195.699] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79972380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79972380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79972380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.699] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.699] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702")) returned 1 [0195.699] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 1 [0195.700] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.700] WriteFile (in: hFile=0xe4, lpBuffer=0x299fb8*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x299fb8*, lpNumberOfBytesWritten=0x18fd98*=0x2b40, lpOverlapped=0x0) returned 1 [0195.701] CloseHandle (hObject=0xe4) returned 1 [0195.701] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.703] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2ac3 [0195.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2acb) returned 0x297460 [0195.703] ReadFile (in: hFile=0xe4, lpBuffer=0x297468, nNumberOfBytesToRead=0x2ac3, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdb0*=0x2ac3, lpOverlapped=0x0) returned 1 [0195.704] CloseHandle (hObject=0xe4) returned 1 [0195.704] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0 [0195.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.704] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.704] GetTickCount () returned 0x409fe [0195.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.705] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702\\....\\temporaryfile")) returned 0 [0195.706] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702\\temporaryfile")) returned 1 [0195.707] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79972380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.707] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79972380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.707] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.707] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.707] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.707] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.707] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.707] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702\\temporaryfile")) returned 1 [0195.707] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.707] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.707] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264702" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264702")) returned 1 [0195.707] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 1 [0195.708] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.708] WriteFile (in: hFile=0xe4, lpBuffer=0x299f40*, nNumberOfBytesToWrite=0x2ac8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x299f40*, lpNumberOfBytesWritten=0x18fd98*=0x2ac8, lpOverlapped=0x0) returned 1 [0195.709] CloseHandle (hObject=0xe4) returned 1 [0195.713] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.713] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.713] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.713] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.714] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.714] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0195.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0195.714] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.714] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x4c2 [0195.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4ca) returned 0x259e70 [0195.714] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4c2, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x4c2, lpOverlapped=0x0) returned 1 [0195.716] CloseHandle (hObject=0xe4) returned 1 [0195.716] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0 [0195.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.716] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.716] GetTickCount () returned 0x40a0e [0195.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.717] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264718\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264718\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.717] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264718\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264718\\....\\temporaryfile")) returned 0 [0195.717] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264718\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264718\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264718\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264718\\temporaryfile")) returned 1 [0195.718] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264718\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.718] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0195.718] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.718] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264718\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.718] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.718] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.718] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.719] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264718\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264718\\temporaryfile")) returned 1 [0195.719] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799984e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.719] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.719] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264718" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264718")) returned 1 [0195.719] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 1 [0195.719] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.720] WriteFile (in: hFile=0xe4, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x4c8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fd98*=0x4c8, lpOverlapped=0x0) returned 1 [0195.721] CloseHandle (hObject=0xe4) returned 1 [0195.721] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.721] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x799984e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799984e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.721] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.721] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.722] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.722] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0195.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x256210 [0195.722] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.723] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x1d7 [0195.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1df) returned 0x25c780 [0195.723] ReadFile (in: hFile=0xe4, lpBuffer=0x25c788, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x25c788*, lpNumberOfBytesRead=0x18fdb0*=0x1d7, lpOverlapped=0x0) returned 1 [0195.724] CloseHandle (hObject=0xe4) returned 1 [0195.724] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0 [0195.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.724] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.724] GetTickCount () returned 0x40a1d [0195.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.725] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.725] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733\\....\\temporaryfile")) returned 0 [0195.725] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733\\temporaryfile")) returned 1 [0195.726] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.726] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0195.726] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.726] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.726] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.726] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.726] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.726] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733\\temporaryfile")) returned 1 [0195.727] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.727] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.727] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733")) returned 1 [0195.727] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 1 [0195.727] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.728] WriteFile (in: hFile=0xe4, lpBuffer=0x28f200*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesWritten=0x18fd98*=0x1e0, lpOverlapped=0x0) returned 1 [0195.728] CloseHandle (hObject=0xe4) returned 1 [0195.728] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.728] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.729] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.729] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xfd7a0866, dwReserved1=0x1ca0431, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0195.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25ce10 [0195.729] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.730] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x59d [0195.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5a5) returned 0x259e70 [0195.730] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x59d, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x59d, lpOverlapped=0x0) returned 1 [0195.731] CloseHandle (hObject=0xe4) returned 1 [0195.731] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0 [0195.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.731] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.731] GetTickCount () returned 0x40a1d [0195.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.732] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733\\....\\temporaryfile")) returned 0 [0195.733] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733\\temporaryfile")) returned 1 [0195.734] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.734] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0195.734] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.734] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.734] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.734] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.734] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.734] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733\\temporaryfile")) returned 1 [0195.735] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799be640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.735] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.735] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264733" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264733")) returned 1 [0195.735] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 1 [0195.735] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.736] WriteFile (in: hFile=0xe4, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5a8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fd98*=0x5a8, lpOverlapped=0x0) returned 1 [0195.737] CloseHandle (hObject=0xe4) returned 1 [0195.737] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.737] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x799be640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799be640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.737] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.737] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7c69c0, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.737] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7c69c0, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.737] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0xfd7c69c0, dwReserved1=0x1ca0431, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0195.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x256210 [0195.738] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.739] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x39c [0195.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3a4) returned 0x259e70 [0195.739] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x39c, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x39c, lpOverlapped=0x0) returned 1 [0195.740] CloseHandle (hObject=0xe4) returned 1 [0195.740] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0 [0195.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.740] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.740] GetTickCount () returned 0x40a2d [0195.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.741] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749\\....\\temporaryfile")) returned 0 [0195.741] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749\\temporaryfile")) returned 1 [0195.742] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.742] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0195.742] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.742] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.742] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.742] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.742] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.743] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749\\temporaryfile")) returned 1 [0195.743] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.743] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.743] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749")) returned 1 [0195.743] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 1 [0195.743] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.744] WriteFile (in: hFile=0xe4, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fd98*=0x3a0, lpOverlapped=0x0) returned 1 [0195.745] CloseHandle (hObject=0xe4) returned 1 [0195.745] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.745] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.745] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.745] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7c69c0, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.745] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7c69c0, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.745] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0xfd7c69c0, dwReserved1=0x1ca0431, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0195.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256210 [0195.746] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.746] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2ed [0195.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2f5) returned 0x259e70 [0195.746] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2ed, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x2ed, lpOverlapped=0x0) returned 1 [0195.748] CloseHandle (hObject=0xe4) returned 1 [0195.748] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0 [0195.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.748] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.748] GetTickCount () returned 0x40a2d [0195.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.748] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749\\....\\temporaryfile")) returned 0 [0195.749] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749\\temporaryfile")) returned 1 [0195.750] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.750] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0195.750] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.750] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.750] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.750] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.750] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.750] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749\\temporaryfile")) returned 1 [0195.750] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x799e47a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x799e47a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x799e47a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.751] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.751] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264749" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264749")) returned 1 [0195.751] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 1 [0195.751] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.751] WriteFile (in: hFile=0xe4, lpBuffer=0x25a178*, nNumberOfBytesToWrite=0x2f8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25a178*, lpNumberOfBytesWritten=0x18fd98*=0x2f8, lpOverlapped=0x0) returned 1 [0195.752] CloseHandle (hObject=0xe4) returned 1 [0195.752] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.753] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2ed [0195.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2f5) returned 0x259e70 [0195.754] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2ed, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x2ed, lpOverlapped=0x0) returned 1 [0195.755] CloseHandle (hObject=0xe4) returned 1 [0195.755] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0 [0195.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.755] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.755] GetTickCount () returned 0x40a3c [0195.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.756] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764\\....\\temporaryfile")) returned 0 [0195.756] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764\\temporaryfile")) returned 1 [0195.757] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a0a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a0a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a0a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.757] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a0a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a0a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a0a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.757] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a0a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a0a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a0a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.757] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a0a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a0a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a0a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.757] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a0a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a0a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a0a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.757] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a0a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a0a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a0a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.757] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764\\temporaryfile")) returned 1 [0195.757] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a0a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a0a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a0a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.758] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.758] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764")) returned 1 [0195.758] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 1 [0195.758] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.761] WriteFile (in: hFile=0xe4, lpBuffer=0x25a178*, nNumberOfBytesToWrite=0x2f8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25a178*, lpNumberOfBytesWritten=0x18fd98*=0x2f8, lpOverlapped=0x0) returned 1 [0195.761] CloseHandle (hObject=0xe4) returned 1 [0195.762] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.762] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xacc [0195.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xad4) returned 0x2350048 [0195.762] ReadFile (in: hFile=0xe4, lpBuffer=0x2350050, nNumberOfBytesToRead=0xacc, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdb0*=0xacc, lpOverlapped=0x0) returned 1 [0195.763] CloseHandle (hObject=0xe4) returned 1 [0195.763] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0 [0195.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.764] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.764] GetTickCount () returned 0x40a3c [0195.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.764] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764\\....\\temporaryfile")) returned 0 [0195.768] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764\\temporaryfile")) returned 1 [0195.769] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a0a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.769] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a0a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.769] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.769] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.769] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.769] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.769] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.769] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764\\temporaryfile")) returned 1 [0195.770] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.770] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.770] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264764" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264764")) returned 1 [0195.770] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 1 [0195.770] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.771] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0xad0, lpOverlapped=0x0) returned 1 [0195.771] CloseHandle (hObject=0xe4) returned 1 [0195.771] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.772] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.772] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.772] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7c69c0, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.773] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7c69c0, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.773] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0xfd7c69c0, dwReserved1=0x1ca0431, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0195.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0195.773] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.774] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x48e [0195.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x496) returned 0x259e70 [0195.774] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x48e, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x48e, lpOverlapped=0x0) returned 1 [0195.775] CloseHandle (hObject=0xe4) returned 1 [0195.775] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0 [0195.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.775] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.775] GetTickCount () returned 0x40a4c [0195.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0195.776] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264780\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264780\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.777] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264780\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264780\\....\\temporaryfile")) returned 0 [0195.777] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264780\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264780\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264780\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264780\\temporaryfile")) returned 1 [0195.778] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264780\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.778] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0195.778] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.778] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264780\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0195.778] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.778] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.778] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0195.778] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264780\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264780\\temporaryfile")) returned 1 [0195.778] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a30a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.778] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.778] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264780" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264780")) returned 1 [0195.779] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 1 [0195.779] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0195.779] WriteFile (in: hFile=0xe4, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x498, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fd98*=0x498, lpOverlapped=0x0) returned 1 [0195.780] CloseHandle (hObject=0xe4) returned 1 [0195.780] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.780] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79a30a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a30a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.781] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.781] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.781] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.781] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.782] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.782] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.783] CloseHandle (hObject=0xe0) returned 1 [0195.783] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0 [0195.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.783] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.783] GetTickCount () returned 0x40a5c [0195.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.784] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.784] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796\\....\\temporaryfile")) returned 0 [0195.784] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796\\temporaryfile")) returned 1 [0195.785] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.785] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.785] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.785] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.785] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.786] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.786] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.786] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796\\temporaryfile")) returned 1 [0195.786] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.786] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.786] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796")) returned 1 [0195.786] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 1 [0195.786] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.787] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.788] CloseHandle (hObject=0xe0) returned 1 [0195.788] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.788] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.788] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.788] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.788] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.789] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.789] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.790] CloseHandle (hObject=0xe0) returned 1 [0195.790] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0 [0195.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.790] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.790] GetTickCount () returned 0x40a5c [0195.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.791] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.792] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796\\....\\temporaryfile")) returned 0 [0195.792] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796\\temporaryfile")) returned 1 [0195.793] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.793] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.793] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.793] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.793] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.793] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.793] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.793] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796\\temporaryfile")) returned 1 [0195.793] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79a56bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.793] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.793] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264796" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264796")) returned 1 [0195.793] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 1 [0195.794] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.794] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.795] CloseHandle (hObject=0xe0) returned 1 [0195.795] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.795] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79a56bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79a56bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.795] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.796] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.796] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.796] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.796] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.797] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.797] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.801] CloseHandle (hObject=0xe0) returned 1 [0195.801] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0 [0195.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.823] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.825] GetTickCount () returned 0x40a7b [0195.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.826] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264827\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264827\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264827\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264827\\....\\temporaryfile")) returned 0 [0195.827] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264827\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264827\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264827\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264827\\temporaryfile")) returned 1 [0195.828] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264827\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aa2e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aa2e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aa2e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.828] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aa2e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aa2e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aa2e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.828] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aa2e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aa2e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aa2e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.828] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264827\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aa2e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aa2e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aa2e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.828] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aa2e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aa2e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aa2e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.828] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aa2e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aa2e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aa2e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.828] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.828] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264827\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264827\\temporaryfile")) returned 1 [0195.828] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aa2e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aa2e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aa2e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.828] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.828] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264827" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264827")) returned 1 [0195.828] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 1 [0195.829] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.829] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.830] CloseHandle (hObject=0xe0) returned 1 [0195.830] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.830] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79aa2e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aa2e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.832] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.832] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e0df36a, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e0df36a, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0195.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e0df36a, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 0 [0195.833] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.833] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e0df36a, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.834] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.834] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.834] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.835] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.835] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.836] CloseHandle (hObject=0xe0) returned 1 [0195.836] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0 [0195.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.836] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.836] GetTickCount () returned 0x40a8a [0195.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.837] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842\\....\\temporaryfile")) returned 0 [0195.837] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842\\temporaryfile")) returned 1 [0195.839] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79ac8fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79ac8fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79ac8fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.839] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79ac8fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79ac8fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79ac8fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.839] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79ac8fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79ac8fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79ac8fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.839] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79ac8fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79ac8fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79ac8fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.839] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79ac8fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79ac8fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79ac8fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.839] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79ac8fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79ac8fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79ac8fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.839] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.840] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842\\temporaryfile")) returned 1 [0195.840] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79ac8fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79ac8fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79ac8fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.840] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.840] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842")) returned 1 [0195.840] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 1 [0195.840] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.841] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.841] CloseHandle (hObject=0xe0) returned 1 [0195.842] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.842] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79ac8fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79ac8fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.842] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.842] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.842] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.843] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.843] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.844] CloseHandle (hObject=0xe0) returned 1 [0195.844] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0 [0195.844] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.845] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.845] GetTickCount () returned 0x40a8a [0195.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.845] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842\\....\\temporaryfile")) returned 0 [0195.846] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842\\temporaryfile")) returned 1 [0195.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79ac8fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.847] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79ac8fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.847] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.848] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.848] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.848] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842\\temporaryfile")) returned 1 [0195.848] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.848] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264842" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264842")) returned 1 [0195.848] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 1 [0195.848] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.849] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.850] CloseHandle (hObject=0xe0) returned 1 [0195.850] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.850] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.850] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.850] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd7ecb1a, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.851] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.851] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.851] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.852] CloseHandle (hObject=0xe0) returned 1 [0195.852] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0 [0195.852] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.852] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.852] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.852] GetTickCount () returned 0x40a9a [0195.852] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.852] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.853] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264858\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264858\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264858\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264858\\....\\temporaryfile")) returned 0 [0195.854] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264858\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264858\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264858\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264858\\temporaryfile")) returned 1 [0195.855] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264858\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.855] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.855] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.855] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264858\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.855] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.855] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.855] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.855] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264858\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264858\\temporaryfile")) returned 1 [0195.859] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79aef140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.859] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.859] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264858" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264858")) returned 1 [0195.859] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui") returned 1 [0195.859] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.860] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.860] CloseHandle (hObject=0xe0) returned 1 [0195.861] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.861] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79aef140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79aef140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.861] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.861] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.862] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.863] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.863] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.864] CloseHandle (hObject=0xe0) returned 1 [0195.864] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0 [0195.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.864] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.864] GetTickCount () returned 0x40aaa [0195.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.865] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874\\....\\temporaryfile")) returned 0 [0195.865] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874\\temporaryfile")) returned 1 [0195.866] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.866] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.866] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.867] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.867] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.867] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.867] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.867] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874\\temporaryfile")) returned 1 [0195.867] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.867] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.867] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874")) returned 1 [0195.867] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui") returned 1 [0195.867] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.868] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.869] CloseHandle (hObject=0xe0) returned 1 [0195.869] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.869] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.869] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.869] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.870] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.870] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.870] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.872] CloseHandle (hObject=0xe0) returned 1 [0195.872] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0 [0195.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.872] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.872] GetTickCount () returned 0x40aaa [0195.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.872] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874\\....\\temporaryfile")) returned 0 [0195.873] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874\\temporaryfile")) returned 1 [0195.874] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.874] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.874] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.874] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.874] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.874] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.874] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.875] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874\\temporaryfile")) returned 1 [0195.875] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b152a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.875] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.875] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264874" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264874")) returned 1 [0195.875] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 1 [0195.875] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.876] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.877] CloseHandle (hObject=0xe0) returned 1 [0195.877] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.877] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79b152a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b152a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.877] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.877] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.877] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.877] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.878] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.878] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.878] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.879] CloseHandle (hObject=0xe0) returned 1 [0195.879] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0 [0195.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.879] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.879] GetTickCount () returned 0x40ab9 [0195.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.880] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889\\....\\temporaryfile")) returned 0 [0195.881] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889\\temporaryfile")) returned 1 [0195.882] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.882] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.882] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.882] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.882] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.882] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.882] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.882] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889\\temporaryfile")) returned 1 [0195.882] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.882] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.883] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889")) returned 1 [0195.883] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 1 [0195.883] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.883] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.884] CloseHandle (hObject=0xe0) returned 1 [0195.884] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.884] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.885] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.885] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.885] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.885] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.885] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.886] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.886] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.887] CloseHandle (hObject=0xe0) returned 1 [0195.887] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0 [0195.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.887] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.887] GetTickCount () returned 0x40ab9 [0195.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.888] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889\\....\\temporaryfile")) returned 0 [0195.888] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889\\temporaryfile")) returned 1 [0195.889] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.889] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.889] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.890] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.890] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.890] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.890] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.890] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889\\temporaryfile")) returned 1 [0195.890] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b3b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.890] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.890] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264889" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264889")) returned 1 [0195.890] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui") returned 1 [0195.890] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.891] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.892] CloseHandle (hObject=0xe0) returned 1 [0195.892] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.892] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79b3b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b3b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.892] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.892] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.893] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.893] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.893] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.894] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.894] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.895] CloseHandle (hObject=0xe0) returned 1 [0195.895] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0 [0195.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.896] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.896] GetTickCount () returned 0x40ac9 [0195.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.896] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.897] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905\\....\\temporaryfile")) returned 0 [0195.897] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905\\temporaryfile")) returned 1 [0195.898] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.898] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.898] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.898] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.898] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.898] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.898] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.898] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905\\temporaryfile")) returned 1 [0195.898] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.898] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.898] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905")) returned 1 [0195.898] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 1 [0195.899] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.899] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.900] CloseHandle (hObject=0xe0) returned 1 [0195.900] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.900] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.901] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.901] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.901] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.901] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.901] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.902] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.902] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.903] CloseHandle (hObject=0xe0) returned 1 [0195.903] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0 [0195.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.903] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.903] GetTickCount () returned 0x40ac9 [0195.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.904] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905\\....\\temporaryfile")) returned 0 [0195.905] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905\\temporaryfile")) returned 1 [0195.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.906] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.906] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.906] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.906] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.906] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.906] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905\\temporaryfile")) returned 1 [0195.906] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b61560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.906] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264905" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264905")) returned 1 [0195.906] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 1 [0195.907] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.907] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.908] CloseHandle (hObject=0xe0) returned 1 [0195.908] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.908] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79b61560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b61560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.909] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.909] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.909] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.909] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.909] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.911] CloseHandle (hObject=0xe0) returned 1 [0195.911] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0 [0195.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.911] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.911] GetTickCount () returned 0x40ad8 [0195.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.912] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920\\....\\temporaryfile")) returned 0 [0195.913] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920\\temporaryfile")) returned 1 [0195.913] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.914] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.914] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.914] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.914] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.914] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920\\temporaryfile")) returned 1 [0195.914] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.914] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920")) returned 1 [0195.914] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 1 [0195.915] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.915] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.916] CloseHandle (hObject=0xe0) returned 1 [0195.916] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.916] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.916] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.916] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.917] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.917] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.917] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.919] CloseHandle (hObject=0xe0) returned 1 [0195.919] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0 [0195.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.919] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.919] GetTickCount () returned 0x40ad8 [0195.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.919] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920\\....\\temporaryfile")) returned 0 [0195.921] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920\\temporaryfile")) returned 1 [0195.922] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.922] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.922] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.922] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.922] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.922] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.922] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920\\temporaryfile")) returned 1 [0195.922] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79b876c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.922] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264920" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264920")) returned 1 [0195.922] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 1 [0195.923] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.923] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.924] CloseHandle (hObject=0xe0) returned 1 [0195.924] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.924] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79b876c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79b876c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.925] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.925] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.926] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.926] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd812c74, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.926] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.926] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.926] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.927] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.928] CloseHandle (hObject=0xe0) returned 1 [0195.928] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0 [0195.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.928] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.928] GetTickCount () returned 0x40ae8 [0195.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.929] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936\\....\\temporaryfile")) returned 0 [0195.929] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936\\temporaryfile")) returned 1 [0195.930] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.930] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.930] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.930] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.930] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.930] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.930] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.931] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936\\temporaryfile")) returned 1 [0195.931] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.931] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.931] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936")) returned 1 [0195.931] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 1 [0195.931] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.932] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.933] CloseHandle (hObject=0xe0) returned 1 [0195.933] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.933] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.933] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.933] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.934] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.934] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.934] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.934] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.934] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.935] CloseHandle (hObject=0xe0) returned 1 [0195.936] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0 [0195.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.936] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.936] GetTickCount () returned 0x40ae8 [0195.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.936] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936\\....\\temporaryfile")) returned 0 [0195.937] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936\\temporaryfile")) returned 1 [0195.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.938] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.938] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.938] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.938] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.938] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.938] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936\\temporaryfile")) returned 1 [0195.939] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bad820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bad820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bad820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.939] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.939] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264936" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264936")) returned 1 [0195.939] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 1 [0195.939] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.940] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.940] CloseHandle (hObject=0xe0) returned 1 [0195.940] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.941] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.941] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.941] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.941] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.941] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.941] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.942] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.942] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.943] CloseHandle (hObject=0xe0) returned 1 [0195.943] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0 [0195.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.943] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.943] GetTickCount () returned 0x40af8 [0195.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.944] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952\\....\\temporaryfile")) returned 0 [0195.945] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952\\temporaryfile")) returned 1 [0195.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.946] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.946] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.946] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.946] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.946] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.946] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952\\temporaryfile")) returned 1 [0195.947] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.947] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952")) returned 1 [0195.947] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 1 [0195.947] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.947] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.948] CloseHandle (hObject=0xe0) returned 1 [0195.948] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.949] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.949] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.949] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.949] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.949] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x256210 [0195.949] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.950] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.950] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.951] CloseHandle (hObject=0xe0) returned 1 [0195.951] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui")) returned 0 [0195.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0195.951] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.951] GetTickCount () returned 0x40af8 [0195.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0195.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.952] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952\\...."), lpSecurityAttributes=0x256228) returned 1 [0195.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952\\....\\temporaryfile")) returned 0 [0195.952] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952\\temporaryfile")) returned 1 [0195.953] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.953] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0195.953] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.954] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.954] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.954] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.954] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.954] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952\\temporaryfile")) returned 1 [0195.954] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bd3980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bd3980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bd3980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.954] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.954] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264952" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264952")) returned 1 [0195.954] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 1 [0195.955] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.955] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.956] CloseHandle (hObject=0xe0) returned 1 [0195.956] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.956] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.956] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.956] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.957] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.957] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.958] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.958] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.958] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.960] CloseHandle (hObject=0xe0) returned 1 [0195.960] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0 [0195.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.960] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.960] GetTickCount () returned 0x40b07 [0195.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.961] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.961] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967\\....\\temporaryfile")) returned 0 [0195.961] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967\\temporaryfile")) returned 1 [0195.962] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.962] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.962] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.962] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.962] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.962] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.962] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.962] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967\\temporaryfile")) returned 1 [0195.962] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.962] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.963] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967")) returned 1 [0195.963] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 1 [0195.963] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.964] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.965] CloseHandle (hObject=0xe0) returned 1 [0195.965] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.965] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.965] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.965] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.966] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.966] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.966] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.966] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.966] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.967] CloseHandle (hObject=0xe0) returned 1 [0195.968] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0 [0195.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.968] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.968] GetTickCount () returned 0x40b07 [0195.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.968] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967\\....\\temporaryfile")) returned 0 [0195.969] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967\\temporaryfile")) returned 1 [0195.970] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.970] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.970] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.970] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.970] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.970] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.970] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.970] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967\\temporaryfile")) returned 1 [0195.971] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79bf9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79bf9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79bf9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.971] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.971] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264967" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264967")) returned 1 [0195.971] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 1 [0195.971] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.972] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.972] CloseHandle (hObject=0xe0) returned 1 [0195.973] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.973] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79c1fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c1fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0195.973] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.973] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.973] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.974] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1000 [0195.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1008) returned 0x25f580 [0195.974] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x1000, lpOverlapped=0x0) returned 1 [0195.975] CloseHandle (hObject=0xe0) returned 1 [0195.975] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0 [0195.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.975] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.975] GetTickCount () returned 0x40b17 [0195.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.976] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983\\....\\temporaryfile")) returned 0 [0195.977] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983\\temporaryfile")) returned 1 [0195.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c1fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c1fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c1fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.978] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c1fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c1fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c1fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.978] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c1fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c1fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c1fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c1fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c1fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c1fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.978] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c1fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c1fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c1fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.978] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c1fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c1fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c1fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.978] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.978] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983\\temporaryfile")) returned 1 [0195.978] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c1fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c1fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c1fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.978] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.978] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983")) returned 1 [0195.978] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui") returned 1 [0195.979] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.979] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0195.980] CloseHandle (hObject=0xe0) returned 1 [0195.980] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.980] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79c1fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c1fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0195.980] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.981] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.981] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.981] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.981] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.981] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.981] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.983] CloseHandle (hObject=0xe0) returned 1 [0195.983] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0 [0195.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.983] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.983] GetTickCount () returned 0x40b17 [0195.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.987] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983\\....\\temporaryfile")) returned 0 [0195.988] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983\\temporaryfile")) returned 1 [0195.988] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c1fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.989] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c1fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.989] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.989] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.989] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.989] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.989] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.989] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983\\temporaryfile")) returned 1 [0195.989] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.989] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.989] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264983" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264983")) returned 1 [0195.989] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui") returned 1 [0195.990] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.990] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0195.991] CloseHandle (hObject=0xe0) returned 1 [0195.991] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.991] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0195.991] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0195.991] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0195.992] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0195.992] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0195.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0195.992] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.993] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0195.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0195.993] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0195.995] CloseHandle (hObject=0xe0) returned 1 [0195.995] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0 [0195.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0195.995] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0195.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0195.995] GetTickCount () returned 0x40b26 [0195.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0195.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0195.996] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0195.996] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264998\\...."), lpSecurityAttributes=0x256210) returned 1 [0195.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264998\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264998\\....\\temporaryfile")) returned 0 [0195.997] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264998\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264998\\temporaryfile")) returned 1 [0195.998] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264998\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0195.998] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0195.998] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0195.998] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264998\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0195.998] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.998] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.998] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0195.998] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264998\\temporaryfile")) returned 1 [0195.998] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c45da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0195.998] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0195.998] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18264998" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18264998")) returned 1 [0195.999] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 1 [0195.999] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0195.999] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0196.000] CloseHandle (hObject=0xe0) returned 1 [0196.000] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.000] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79c45da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c45da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.000] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0196.000] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.001] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.001] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0196.001] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0196.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x2561c8 [0196.001] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.002] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe00 [0196.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe08) returned 0x2350048 [0196.002] ReadFile (in: hFile=0xe0, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdd0*=0xe00, lpOverlapped=0x0) returned 1 [0196.003] CloseHandle (hObject=0xe0) returned 1 [0196.003] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0 [0196.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0196.003] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.003] GetTickCount () returned 0x40b36 [0196.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0196.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0196.004] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265014\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265014\\...."), lpSecurityAttributes=0x256210) returned 1 [0196.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265014\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265014\\....\\temporaryfile")) returned 0 [0196.004] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265014\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265014\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265014\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265014\\temporaryfile")) returned 1 [0196.005] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265014\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c6bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c6bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c6bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.005] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c6bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c6bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c6bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0196.005] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c6bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c6bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c6bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.005] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265014\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c6bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c6bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c6bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0196.006] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c6bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c6bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c6bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.006] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c6bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c6bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c6bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.006] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0196.006] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265014\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265014\\temporaryfile")) returned 1 [0196.006] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79c6bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79c6bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c6bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.006] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.006] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265014" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265014")) returned 1 [0196.006] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 1 [0196.006] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.007] WriteFile (in: hFile=0xe0, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fdb8*=0xe08, lpOverlapped=0x0) returned 1 [0196.008] CloseHandle (hObject=0xe0) returned 1 [0196.008] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.008] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79c6bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79c6bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0196.008] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.008] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0196.008] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69dc9750, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0196.125] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69dc9750, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0196.127] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x69dc9750, dwReserved1=0x1d301bf, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0196.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256210 [0196.127] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.128] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x665a0 [0196.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x665a8) returned 0x2a0a70 [0196.129] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x665a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x665a0, lpOverlapped=0x0) returned 1 [0196.137] CloseHandle (hObject=0xdc) returned 1 [0196.137] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0196.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0196.141] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.141] GetTickCount () returned 0x40bb3 [0196.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0196.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0196.141] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265139\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265139\\...."), lpSecurityAttributes=0x256228) returned 1 [0196.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265139\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265139\\....\\temporaryfile")) returned 0 [0196.142] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265139\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265139\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265139\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265139\\temporaryfile")) returned 1 [0196.143] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265139\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79d9ca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79dc2b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79dc2b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0196.143] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79d9ca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79dc2b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79dc2b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0196.143] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79d9ca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79d9ca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79d9ca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.143] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265139\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79d9ca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79d9ca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79d9ca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.143] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79d9ca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79d9ca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79d9ca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.143] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79d9ca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79d9ca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79d9ca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.143] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.144] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265139\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265139\\temporaryfile")) returned 1 [0196.144] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79d9ca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79d9ca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79d9ca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.144] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0196.144] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265139" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265139")) returned 1 [0196.144] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 0 [0196.161] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.161] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x665a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x665a8, lpOverlapped=0x0) returned 1 [0196.168] CloseHandle (hObject=0xdc) returned 1 [0196.168] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0196.168] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x79de8cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79de8cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0196.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0196.168] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0196.168] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0196.168] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0196.169] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="en-US", cAlternateFileName="")) returned 1 [0196.169] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0xfd838dce, dwReserved1=0x1ca0431, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0196.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561c8 [0196.169] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.169] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5c800 [0196.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5c808) returned 0x2a0a70 [0196.169] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x5c800, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x5c800, lpOverlapped=0x0) returned 1 [0196.172] CloseHandle (hObject=0xdc) returned 1 [0196.173] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0 [0196.173] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0196.173] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.173] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.173] GetTickCount () returned 0x40be2 [0196.173] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0196.173] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.173] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0196.173] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265186\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265186\\...."), lpSecurityAttributes=0x256210) returned 1 [0196.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265186\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265186\\....\\temporaryfile")) returned 0 [0196.175] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265186\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265186\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265186\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265186\\temporaryfile")) returned 1 [0196.176] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265186\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e0ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e0ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e0ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.176] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e0ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e0ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e0ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0196.176] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e0ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e0ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e0ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.176] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265186\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e0ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e0ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e0ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.176] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e0ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e0ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e0ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.176] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e0ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e0ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e0ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.176] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.176] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265186\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265186\\temporaryfile")) returned 1 [0196.176] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e0ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e0ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e0ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.176] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.176] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265186" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265186")) returned 1 [0196.176] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 1 [0196.187] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.187] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x5c808, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x5c808, lpOverlapped=0x0) returned 1 [0196.193] CloseHandle (hObject=0xdc) returned 1 [0196.194] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0196.194] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x79e0ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e0ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0196.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0196.194] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.194] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 1 [0196.194] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0196.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11) returned 0x25ce10 [0196.194] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.195] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6800 [0196.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6808) returned 0x2a0a70 [0196.195] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x6800, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x6800, lpOverlapped=0x0) returned 1 [0196.197] CloseHandle (hObject=0xe0) returned 1 [0196.197] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0 [0196.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0196.197] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.197] GetTickCount () returned 0x40bf1 [0196.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0196.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0196.198] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265201\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265201\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0196.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265201\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265201\\....\\temporaryfile")) returned 0 [0196.198] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265201\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265201\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265201\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265201\\temporaryfile")) returned 1 [0196.199] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265201\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e34f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e34f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e34f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.199] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e34f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e34f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e34f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0196.199] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e34f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e34f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e34f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.199] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265201\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e34f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e34f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e34f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0196.199] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e34f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e34f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e34f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.199] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e34f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e34f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e34f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.200] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0196.200] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265201\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265201\\temporaryfile")) returned 1 [0196.200] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79e34f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79e34f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e34f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.200] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.200] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265201" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265201")) returned 1 [0196.200] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 1 [0196.201] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0196.201] WriteFile (in: hFile=0xe0, lpBuffer=0x2a7288*, nNumberOfBytesToWrite=0x6808, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a7288*, lpNumberOfBytesWritten=0x18fdb8*=0x6808, lpOverlapped=0x0) returned 1 [0196.202] CloseHandle (hObject=0xe0) returned 1 [0196.202] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.202] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x79e34f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79e34f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0196.203] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.203] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0196.203] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee282250, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0196.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee282250, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0196.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee282250, dwReserved1=0x1d301be, cFileName="1033", cAlternateFileName="")) returned 1 [0196.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0xee282250, dwReserved1=0x1d301be, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0196.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0196.203] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.204] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x310788 [0196.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x310790) returned 0x2650020 [0196.205] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x310788, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x310788, lpOverlapped=0x0) returned 1 [0196.300] CloseHandle (hObject=0xdc) returned 1 [0196.300] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 1 [0196.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0196.301] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.301] GetTickCount () returned 0x40c5e [0196.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0196.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0196.302] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265310\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265310\\...."), lpSecurityAttributes=0x256228) returned 1 [0196.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265310\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265310\\....\\temporaryfile")) returned 0 [0196.302] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265310\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265310\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265310\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265310\\temporaryfile")) returned 1 [0196.304] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265310\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f3f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79f3f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79f3f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.304] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f3f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79f3f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79f3f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd, cFileName="..", cAlternateFileName="")) returned 1 [0196.304] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f3f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79f3f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79f3f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.304] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265310\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f3f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79f3f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79f3f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.304] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f3f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79f3f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79f3f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.304] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f3f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79f3f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79f3f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.304] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.304] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265310\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265310\\temporaryfile")) returned 1 [0196.304] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79f3f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x79f3f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x79f3f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.304] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.304] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265310" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265310")) returned 1 [0196.304] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 0 [0196.465] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.465] WriteFile (in: hFile=0xdc, lpBuffer=0x2c90028*, nNumberOfBytesToWrite=0x310790, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c90028*, lpNumberOfBytesWritten=0x18fdd8*=0x310790, lpOverlapped=0x0) returned 1 [0196.530] CloseHandle (hObject=0xdc) returned 1 [0196.557] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.557] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb5db8 [0196.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb5dc0) returned 0x1d70020 [0196.557] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xb5db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xb5db8, lpOverlapped=0x0) returned 1 [0196.572] CloseHandle (hObject=0xdc) returned 1 [0196.572] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0196.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0196.578] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.578] GetTickCount () returned 0x40d68 [0196.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0196.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0196.579] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265576\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265576\\...."), lpSecurityAttributes=0x256210) returned 1 [0196.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265576\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265576\\....\\temporaryfile")) returned 0 [0196.579] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265576\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265576\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265576\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265576\\temporaryfile")) returned 1 [0196.580] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265576\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a1c7080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a1ed1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a1ed1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.580] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a1c7080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a1ed1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a1ed1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.580] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a1ed1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a1ed1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a1ed1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.580] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265576\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a1ed1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a1ed1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a1ed1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.581] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a1ed1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a1ed1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a1ed1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.581] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a1ed1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a1ed1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a1ed1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.581] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.581] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265576\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265576\\temporaryfile")) returned 1 [0196.581] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a1ed1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a1ed1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a1ed1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.581] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.581] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265576" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265576")) returned 1 [0196.581] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 0 [0196.660] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.661] WriteFile (in: hFile=0xdc, lpBuffer=0x2710028*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2710028*, lpNumberOfBytesWritten=0x18fdd8*=0xb5dc0, lpOverlapped=0x0) returned 1 [0196.672] CloseHandle (hObject=0xdc) returned 1 [0196.678] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.680] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa990 [0196.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa998) returned 0x2a0a70 [0196.680] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xa990, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0xa990, lpOverlapped=0x0) returned 1 [0196.681] CloseHandle (hObject=0xdc) returned 1 [0196.681] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0196.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0196.682] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.682] GetTickCount () returned 0x40dd5 [0196.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0196.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0196.683] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265685\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265685\\...."), lpSecurityAttributes=0x256228) returned 1 [0196.683] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265685\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265685\\....\\temporaryfile")) returned 0 [0196.683] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265685\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265685\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265685\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265685\\temporaryfile")) returned 1 [0196.685] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265685\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a2d1a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a2d1a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a2d1a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.685] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a2d1a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a2d1a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a2d1a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.685] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a2d1a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a2d1a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a2d1a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.685] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265685\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a2d1a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a2d1a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a2d1a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.685] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a2d1a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a2d1a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a2d1a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.685] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a2d1a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a2d1a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a2d1a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.685] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.685] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265685\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265685\\temporaryfile")) returned 1 [0196.685] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a2d1a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a2d1a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a2d1a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.685] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.685] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265685" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265685")) returned 1 [0196.685] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 0 [0196.686] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.687] WriteFile (in: hFile=0xdc, lpBuffer=0x2ab418*, nNumberOfBytesToWrite=0xa998, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ab418*, lpNumberOfBytesWritten=0x18fdd8*=0xa998, lpOverlapped=0x0) returned 1 [0196.688] CloseHandle (hObject=0xdc) returned 1 [0196.688] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.689] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf73a8 [0196.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf73b0) returned 0x2650020 [0196.689] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0xf73a8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0xf73a8, lpOverlapped=0x0) returned 1 [0196.711] CloseHandle (hObject=0xdc) returned 1 [0196.711] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 1 [0196.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0196.719] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.719] GetTickCount () returned 0x40e04 [0196.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0196.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0196.719] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265732\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265732\\...."), lpSecurityAttributes=0x256210) returned 1 [0196.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265732\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265732\\....\\temporaryfile")) returned 0 [0196.720] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265732\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265732\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265732\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265732\\temporaryfile")) returned 1 [0196.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265732\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a343e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a343e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a343e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.721] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a343e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a343e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a343e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.721] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a343e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a343e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a343e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265732\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a343e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a343e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a343e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.721] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a343e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a343e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a343e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.721] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a343e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a343e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a343e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.721] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.722] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265732\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265732\\temporaryfile")) returned 1 [0196.722] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a343e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a343e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a343e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.722] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.722] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265732" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265732")) returned 1 [0196.722] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 0 [0196.767] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.767] WriteFile (in: hFile=0xdc, lpBuffer=0x2850028*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2850028*, lpNumberOfBytesWritten=0x18fdd8*=0xf73b0, lpOverlapped=0x0) returned 1 [0196.793] CloseHandle (hObject=0xdc) returned 1 [0196.802] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.802] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6bfa0 [0196.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6bfa8) returned 0x2a0a70 [0196.802] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x6bfa0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x6bfa0, lpOverlapped=0x0) returned 1 [0196.809] CloseHandle (hObject=0xdc) returned 1 [0196.809] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1 [0196.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0196.813] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.813] GetTickCount () returned 0x40e61 [0196.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0196.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0196.814] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265825\\...."), lpSecurityAttributes=0x256228) returned 1 [0196.814] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265825\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265825\\....\\temporaryfile")) returned 0 [0196.814] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265825\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265825\\temporaryfile")) returned 1 [0196.816] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265825\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a428680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a428680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a428680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.816] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a428680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a428680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a428680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.816] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a428680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a428680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a428680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.816] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265825\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a428680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a428680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a428680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.816] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a428680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a428680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a428680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.816] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a428680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a428680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a428680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.816] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.816] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265825\\temporaryfile")) returned 1 [0196.816] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a428680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a428680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a428680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.816] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.817] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265825" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265825")) returned 1 [0196.817] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 0 [0196.827] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.828] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x6bfa8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x6bfa8, lpOverlapped=0x0) returned 1 [0196.835] CloseHandle (hObject=0xdc) returned 1 [0196.835] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.835] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdbb98 [0196.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdbba0) returned 0x2650020 [0196.835] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0xdbb98, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0xdbb98, lpOverlapped=0x0) returned 1 [0196.854] CloseHandle (hObject=0xdc) returned 1 [0196.854] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1 [0196.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0196.862] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.862] GetTickCount () returned 0x40e90 [0196.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0196.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0196.862] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265872\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265872\\...."), lpSecurityAttributes=0x256210) returned 1 [0196.863] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265872\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265872\\....\\temporaryfile")) returned 0 [0196.863] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265872\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265872\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265872\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265872\\temporaryfile")) returned 1 [0196.864] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265872\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a49aaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a49aaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a49aaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.864] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a49aaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a49aaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a49aaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.864] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a49aaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a49aaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a49aaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.864] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265872\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a49aaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a49aaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a49aaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.864] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a49aaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a49aaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a49aaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.864] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a49aaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a49aaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a49aaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.864] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.864] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265872\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265872\\temporaryfile")) returned 1 [0196.865] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a49aaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a49aaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a49aaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.865] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.865] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265872" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265872")) returned 1 [0196.865] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 0 [0196.905] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.905] WriteFile (in: hFile=0xdc, lpBuffer=0x2810028*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2810028*, lpNumberOfBytesWritten=0x18fdd8*=0xdbba0, lpOverlapped=0x0) returned 1 [0196.920] CloseHandle (hObject=0xdc) returned 1 [0196.928] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.928] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x53bb0 [0196.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x53bb8) returned 0x2a0a70 [0196.928] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x53bb0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x53bb0, lpOverlapped=0x0) returned 1 [0196.932] CloseHandle (hObject=0xdc) returned 1 [0196.932] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 1 [0196.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0196.936] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.936] GetTickCount () returned 0x40ece [0196.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0196.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0196.937] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265934\\...."), lpSecurityAttributes=0x256228) returned 1 [0196.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265934\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265934\\....\\temporaryfile")) returned 0 [0196.937] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265934\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265934\\temporaryfile")) returned 1 [0196.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265934\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a533020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a559180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a559180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a533020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a559180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a559180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a533020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a533020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a533020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.939] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265934\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a533020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a533020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a533020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.939] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a533020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a533020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a533020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.939] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a533020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a533020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a533020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.939] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.939] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265934\\temporaryfile")) returned 1 [0196.939] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a533020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a533020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a533020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.939] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.939] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265934" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265934")) returned 1 [0196.939] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 0 [0196.960] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.960] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x53bb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x53bb8, lpOverlapped=0x0) returned 1 [0196.966] CloseHandle (hObject=0xdc) returned 1 [0196.966] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.968] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3db8 [0196.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3dc0) returned 0x297460 [0196.968] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x3db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x3db8, lpOverlapped=0x0) returned 1 [0196.969] CloseHandle (hObject=0xdc) returned 1 [0196.969] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1 [0196.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0196.970] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.970] GetTickCount () returned 0x40efd [0196.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0196.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0196.971] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265981\\...."), lpSecurityAttributes=0x256210) returned 1 [0196.971] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265981\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265981\\....\\temporaryfile")) returned 0 [0196.971] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265981\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265981\\temporaryfile")) returned 1 [0196.972] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265981\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5a5440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5a5440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5a5440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.972] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5a5440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5a5440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5a5440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5a5440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5a5440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5a5440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.973] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265981\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5a5440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5a5440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5a5440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.973] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5a5440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5a5440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5a5440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.973] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5a5440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5a5440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5a5440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.973] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.973] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265981\\temporaryfile")) returned 1 [0196.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5a5440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5a5440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5a5440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.973] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.973] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265981" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265981")) returned 1 [0196.973] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 0 [0196.974] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.974] WriteFile (in: hFile=0xdc, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdd8*=0x3dc0, lpOverlapped=0x0) returned 1 [0196.975] CloseHandle (hObject=0xdc) returned 1 [0196.979] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.981] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3db8 [0196.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3dc0) returned 0x297460 [0196.981] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x3db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x3db8, lpOverlapped=0x0) returned 1 [0196.983] CloseHandle (hObject=0xdc) returned 1 [0196.983] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1 [0196.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0196.984] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0196.984] GetTickCount () returned 0x40f0d [0196.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0196.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0196.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0196.985] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997\\...."), lpSecurityAttributes=0x256228) returned 1 [0196.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997\\....\\temporaryfile")) returned 0 [0196.985] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997\\temporaryfile")) returned 1 [0196.986] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5cb5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5cb5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5cb5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0196.986] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5cb5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5cb5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5cb5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.986] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5cb5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5cb5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5cb5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0196.986] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5cb5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5cb5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5cb5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0196.987] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5cb5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5cb5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5cb5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.987] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5cb5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5cb5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5cb5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.987] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0196.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997\\temporaryfile")) returned 1 [0196.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5cb5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5cb5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5cb5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0196.987] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0196.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997")) returned 1 [0196.992] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 0 [0196.994] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.994] WriteFile (in: hFile=0xdc, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdd8*=0x3dc0, lpOverlapped=0x0) returned 1 [0196.995] CloseHandle (hObject=0xdc) returned 1 [0196.996] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0196.997] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3db8 [0196.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3dc0) returned 0x297460 [0196.997] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x3db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x3db8, lpOverlapped=0x0) returned 1 [0196.998] CloseHandle (hObject=0xdc) returned 1 [0196.999] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1 [0196.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0196.999] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0196.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0197.000] GetTickCount () returned 0x40f0d [0197.000] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0197.000] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0197.000] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0197.000] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997\\...."), lpSecurityAttributes=0x256210) returned 1 [0197.001] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997\\....\\temporaryfile")) returned 0 [0197.001] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997\\temporaryfile")) returned 1 [0197.002] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5f1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5f1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5f1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0197.002] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5f1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5f1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5f1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.002] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5f1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5f1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5f1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0197.002] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5f1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5f1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5f1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0197.002] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5f1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5f1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5f1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.002] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5f1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5f1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5f1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0197.002] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0197.002] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997\\temporaryfile")) returned 1 [0197.002] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a5f1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a5f1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a5f1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0197.003] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0197.003] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18265997" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18265997")) returned 1 [0197.003] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 0 [0197.004] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.005] WriteFile (in: hFile=0xdc, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdd8*=0x3dc0, lpOverlapped=0x0) returned 1 [0197.006] CloseHandle (hObject=0xdc) returned 1 [0197.007] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.008] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x833a0 [0197.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x833a8) returned 0x1d70020 [0197.008] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x833a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0x833a0, lpOverlapped=0x0) returned 1 [0197.020] CloseHandle (hObject=0xdc) returned 1 [0197.020] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 1 [0197.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0197.025] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0197.025] GetTickCount () returned 0x40f2c [0197.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0197.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0197.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0197.026] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266028\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266028\\...."), lpSecurityAttributes=0x256228) returned 1 [0197.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266028\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266028\\....\\temporaryfile")) returned 0 [0197.026] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266028\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266028\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266028\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266028\\temporaryfile")) returned 1 [0197.027] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266028\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a617860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a617860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a617860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0197.027] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a617860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a617860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a617860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.028] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a617860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a617860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a617860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0197.028] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266028\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a617860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a617860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a617860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0197.028] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a617860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a617860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a617860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.028] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a617860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a617860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a617860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0197.028] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0197.028] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266028\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266028\\temporaryfile")) returned 1 [0197.028] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a617860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a617860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a617860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0197.028] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0197.028] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266028" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266028")) returned 1 [0197.028] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 0 [0197.052] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.052] WriteFile (in: hFile=0xdc, lpBuffer=0x26e0028*, nNumberOfBytesToWrite=0x833a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x26e0028*, lpNumberOfBytesWritten=0x18fdd8*=0x833a8, lpOverlapped=0x0) returned 1 [0197.061] CloseHandle (hObject=0xdc) returned 1 [0197.066] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.066] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6e398 [0197.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6e3a0) returned 0x2a0a70 [0197.068] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x6e398, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x6e398, lpOverlapped=0x0) returned 1 [0197.076] CloseHandle (hObject=0xdc) returned 1 [0197.076] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 1 [0197.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0197.080] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0197.080] GetTickCount () returned 0x40f6a [0197.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0197.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0197.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0197.080] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266090\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266090\\...."), lpSecurityAttributes=0x256210) returned 1 [0197.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266090\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266090\\....\\temporaryfile")) returned 0 [0197.081] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266090\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266090\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266090\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266090\\temporaryfile")) returned 1 [0197.082] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266090\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6afde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6afde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6afde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0197.082] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6afde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6afde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6afde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.082] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6afde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6afde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6afde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0197.082] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266090\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6afde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6afde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6afde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0197.082] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6afde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6afde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6afde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.082] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6afde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6afde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6afde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0197.082] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0197.082] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266090\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266090\\temporaryfile")) returned 1 [0197.083] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6afde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6afde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6afde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0197.083] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0197.083] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266090" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266090")) returned 1 [0197.083] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 0 [0197.100] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.101] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x6e3a0, lpOverlapped=0x0) returned 1 [0197.108] CloseHandle (hObject=0xdc) returned 1 [0197.108] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.109] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd9c0 [0197.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd9c8) returned 0x2a0a70 [0197.109] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xd9c0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0xd9c0, lpOverlapped=0x0) returned 1 [0197.111] CloseHandle (hObject=0xdc) returned 1 [0197.111] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 1 [0197.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0197.112] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0197.112] GetTickCount () returned 0x40f8a [0197.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0197.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0197.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0197.113] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266122\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266122\\...."), lpSecurityAttributes=0x256228) returned 1 [0197.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266122\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266122\\....\\temporaryfile")) returned 0 [0197.113] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266122\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266122\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266122\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266122\\temporaryfile")) returned 1 [0197.115] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266122\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6fc0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6fc0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6fc0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0197.115] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6fc0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6fc0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6fc0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.115] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6fc0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6fc0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6fc0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0197.115] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266122\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6fc0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6fc0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6fc0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0197.115] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6fc0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6fc0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6fc0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.115] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6fc0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6fc0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6fc0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0197.115] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0197.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266122\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266122\\temporaryfile")) returned 1 [0197.115] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a6fc0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a6fc0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a6fc0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0197.115] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0197.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266122" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266122")) returned 1 [0197.115] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 0 [0197.117] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.118] WriteFile (in: hFile=0xdc, lpBuffer=0x2ae448*, nNumberOfBytesToWrite=0xd9c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ae448*, lpNumberOfBytesWritten=0x18fdd8*=0xd9c8, lpOverlapped=0x0) returned 1 [0197.119] CloseHandle (hObject=0xdc) returned 1 [0197.119] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.120] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa8da0 [0197.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa8da8) returned 0x1d70020 [0197.120] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xa8da0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xa8da0, lpOverlapped=0x0) returned 1 [0197.145] CloseHandle (hObject=0xdc) returned 1 [0197.145] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 1 [0197.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0197.151] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0197.151] GetTickCount () returned 0x40fa9 [0197.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0197.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0197.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0197.151] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266153\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266153\\...."), lpSecurityAttributes=0x256210) returned 1 [0197.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266153\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266153\\....\\temporaryfile")) returned 0 [0197.152] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266153\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266153\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266153\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266153\\temporaryfile")) returned 1 [0197.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266153\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a748360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a748360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a748360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0197.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a748360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a748360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a748360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a748360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a748360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a748360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0197.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266153\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a748360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a748360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a748360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0197.153] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a748360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a748360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a748360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.153] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a748360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a748360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a748360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0197.153] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0197.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266153\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266153\\temporaryfile")) returned 1 [0197.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a748360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a748360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a748360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0197.153] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0197.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266153" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266153")) returned 1 [0197.154] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 0 [0197.184] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.185] WriteFile (in: hFile=0xdc, lpBuffer=0x2700028*, nNumberOfBytesToWrite=0xa8da8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2700028*, lpNumberOfBytesWritten=0x18fdd8*=0xa8da8, lpOverlapped=0x0) returned 1 [0197.196] CloseHandle (hObject=0xdc) returned 1 [0197.202] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.202] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x48990 [0197.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48998) returned 0x2a0a70 [0197.202] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x48990, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x48990, lpOverlapped=0x0) returned 1 [0197.206] CloseHandle (hObject=0xdc) returned 1 [0197.206] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 1 [0197.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0197.209] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0197.209] GetTickCount () returned 0x40fe7 [0197.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0197.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0197.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0197.210] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266215\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266215\\...."), lpSecurityAttributes=0x256228) returned 1 [0197.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266215\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266215\\....\\temporaryfile")) returned 0 [0197.210] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266215\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266215\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266215\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266215\\temporaryfile")) returned 1 [0197.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266215\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a7e08e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a7e08e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a7e08e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0197.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a7e08e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a7e08e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a7e08e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a7e08e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a7e08e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a7e08e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0197.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266215\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a7e08e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a7e08e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a7e08e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0197.212] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a7e08e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a7e08e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a7e08e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.212] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a7e08e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a7e08e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a7e08e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0197.212] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0197.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266215\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266215\\temporaryfile")) returned 1 [0197.212] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a7e08e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a7e08e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a7e08e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0197.212] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0197.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266215" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266215")) returned 1 [0197.212] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 0 [0197.220] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.220] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x48998, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x48998, lpOverlapped=0x0) returned 1 [0197.226] CloseHandle (hObject=0xdc) returned 1 [0197.226] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.226] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2e8da0 [0197.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e8da8) returned 0x2650020 [0197.227] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x2e8da0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x2e8da0, lpOverlapped=0x0) returned 1 [0197.319] CloseHandle (hObject=0xdc) returned 1 [0197.319] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 1 [0197.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0197.327] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0197.327] GetTickCount () returned 0x41054 [0197.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0197.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0197.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0197.328] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266324\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266324\\...."), lpSecurityAttributes=0x256210) returned 1 [0197.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266324\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266324\\....\\temporaryfile")) returned 0 [0197.328] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266324\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266324\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266324\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266324\\temporaryfile")) returned 1 [0197.329] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266324\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a8eb280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a9113e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a9113e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0197.329] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a8eb280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a9113e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a9113e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.329] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a9113e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a9113e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a9113e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0197.329] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266324\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a9113e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a9113e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a9113e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0197.329] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a9113e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a9113e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a9113e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.329] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a9113e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a9113e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a9113e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0197.330] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0197.330] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266324\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266324\\temporaryfile")) returned 1 [0197.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a9113e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7a9113e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7a9113e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0197.330] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0197.330] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266324" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266324")) returned 1 [0197.330] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 0 [0197.478] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.479] WriteFile (in: hFile=0xdc, lpBuffer=0x2c30028*, nNumberOfBytesToWrite=0x2e8da8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c30028*, lpNumberOfBytesWritten=0x18fdd8*=0x2e8da8, lpOverlapped=0x0) returned 1 [0197.549] CloseHandle (hObject=0xdc) returned 1 [0197.574] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.575] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4dba0 [0197.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4dba8) returned 0x2a0a70 [0197.575] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x4dba0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x4dba0, lpOverlapped=0x0) returned 1 [0197.578] CloseHandle (hObject=0xdc) returned 1 [0197.578] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 1 [0197.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0197.582] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0197.582] GetTickCount () returned 0x4115e [0197.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0197.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0197.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0197.583] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266590\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266590\\...."), lpSecurityAttributes=0x256228) returned 1 [0197.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266590\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266590\\....\\temporaryfile")) returned 0 [0197.583] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266590\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266590\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266590\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266590\\temporaryfile")) returned 1 [0197.584] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266590\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ab729e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ab729e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ab729e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0197.584] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ab729e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ab729e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ab729e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.585] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ab729e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ab729e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ab729e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0197.585] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266590\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ab729e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ab729e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ab729e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0197.585] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ab729e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ab729e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ab729e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.585] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ab729e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ab729e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ab729e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0197.585] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0197.585] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266590\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266590\\temporaryfile")) returned 1 [0197.585] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ab729e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ab729e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ab729e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0197.585] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0197.585] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266590" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266590")) returned 1 [0197.585] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 0 [0197.590] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.591] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x4dba8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x4dba8, lpOverlapped=0x0) returned 1 [0197.601] CloseHandle (hObject=0xdc) returned 1 [0197.601] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.602] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7a998 [0197.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7a9a0) returned 0x2350048 [0197.603] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7a998, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7a998, lpOverlapped=0x0) returned 1 [0197.612] CloseHandle (hObject=0xdc) returned 1 [0197.612] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 1 [0197.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0197.616] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0197.616] GetTickCount () returned 0x4117d [0197.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0197.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0197.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0197.616] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266621\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266621\\...."), lpSecurityAttributes=0x256210) returned 1 [0197.617] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266621\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266621\\....\\temporaryfile")) returned 0 [0197.617] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266621\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266621\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266621\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266621\\temporaryfile")) returned 1 [0197.618] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266621\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7abbeca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7abbeca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7abbeca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0197.618] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7abbeca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7abbeca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7abbeca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.618] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7abbeca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7abbeca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7abbeca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0197.618] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266621\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7abbeca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7abbeca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7abbeca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0197.618] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7abbeca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7abbeca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7abbeca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.618] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7abbeca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7abbeca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7abbeca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0197.618] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0197.618] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266621\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266621\\temporaryfile")) returned 1 [0197.619] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7abbeca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7abbeca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7abbeca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0197.619] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0197.619] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266621" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266621")) returned 1 [0197.619] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 0 [0197.639] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.639] WriteFile (in: hFile=0xdc, lpBuffer=0x23ca9f8*, nNumberOfBytesToWrite=0x7a9a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23ca9f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7a9a0, lpOverlapped=0x0) returned 1 [0197.647] CloseHandle (hObject=0xdc) returned 1 [0197.652] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.656] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5e158 [0197.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5e160) returned 0x2a0a70 [0197.656] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x5e158, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x5e158, lpOverlapped=0x0) returned 1 [0197.660] CloseHandle (hObject=0xdc) returned 1 [0197.660] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 1 [0197.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0197.663] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0197.663] GetTickCount () returned 0x411ac [0197.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0197.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0197.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0197.664] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266668\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266668\\...."), lpSecurityAttributes=0x256228) returned 1 [0197.665] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266668\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266668\\....\\temporaryfile")) returned 0 [0197.665] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266668\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266668\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266668\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266668\\temporaryfile")) returned 1 [0197.666] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266668\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ac310c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ac310c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ac310c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0197.666] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ac310c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ac310c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ac310c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.666] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ac310c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ac310c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ac310c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0197.666] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266668\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ac310c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ac310c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ac310c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0197.666] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ac310c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ac310c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ac310c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.666] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ac310c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ac310c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ac310c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0197.666] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0197.666] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266668\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266668\\temporaryfile")) returned 1 [0197.666] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ac310c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ac310c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ac310c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0197.666] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0197.667] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266668" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266668")) returned 1 [0197.667] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 0 [0197.677] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.677] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x5e160, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x5e160, lpOverlapped=0x0) returned 1 [0197.683] CloseHandle (hObject=0xdc) returned 1 [0197.684] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0197.685] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4d67b0 [0197.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4d67b8) returned 0x2650020 [0197.685] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x4d67b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x4d67b0, lpOverlapped=0x0) returned 1 [0197.839] CloseHandle (hObject=0xdc) returned 1 [0197.839] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 1 [0197.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0197.847] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0197.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0197.847] GetTickCount () returned 0x41267 [0197.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0197.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0197.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0197.847] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266855\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266855\\...."), lpSecurityAttributes=0x256210) returned 1 [0197.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266855\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266855\\....\\temporaryfile")) returned 0 [0197.848] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266855\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266855\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266855\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266855\\temporaryfile")) returned 1 [0197.849] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266855\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7adfa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7adfa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7adfa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0197.849] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7adfa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7adfa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7adfa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.849] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7adfa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7adfa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7adfa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0197.849] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266855\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7adfa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7adfa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7adfa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0197.849] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7adfa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7adfa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7adfa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.849] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7adfa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7adfa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7adfa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0197.849] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0197.849] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266855\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266855\\temporaryfile")) returned 1 [0197.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7adfa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7adfa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7adfa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0197.850] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0197.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18266855" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18266855")) returned 1 [0197.850] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 0 [0198.144] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.145] WriteFile (in: hFile=0xdc, lpBuffer=0x3010028*, nNumberOfBytesToWrite=0x4d67b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x3010028*, lpNumberOfBytesWritten=0x18fdd8*=0x4d67b8, lpOverlapped=0x0) returned 1 [0198.242] CloseHandle (hObject=0xdc) returned 1 [0198.286] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.287] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b3980 [0198.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b3988) returned 0x2650020 [0198.287] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1b3980, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x1b3980, lpOverlapped=0x0) returned 1 [0198.331] CloseHandle (hObject=0xdc) returned 1 [0198.331] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 1 [0198.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0198.337] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0198.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0198.337] GetTickCount () returned 0x4144a [0198.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0198.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0198.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0198.338] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267338\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267338\\...."), lpSecurityAttributes=0x256228) returned 1 [0198.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267338\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267338\\....\\temporaryfile")) returned 0 [0198.338] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267338\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267338\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267338\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267338\\temporaryfile")) returned 1 [0198.340] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267338\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b296be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b296be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b296be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0198.340] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b296be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b296be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b296be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.340] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b296be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b296be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b296be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0198.340] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267338\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b296be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b296be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b296be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0198.340] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b296be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b296be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b296be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.340] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b296be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b296be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b296be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0198.340] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0198.340] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267338\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267338\\temporaryfile")) returned 1 [0198.340] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b296be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b296be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b296be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0198.340] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0198.340] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267338" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267338")) returned 1 [0198.341] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 0 [0198.428] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.429] WriteFile (in: hFile=0xdc, lpBuffer=0x29d0028*, nNumberOfBytesToWrite=0x1b3988, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29d0028*, lpNumberOfBytesWritten=0x18fdd8*=0x1b3988, lpOverlapped=0x0) returned 1 [0198.467] CloseHandle (hObject=0xdc) returned 1 [0198.483] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.483] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7eb48 [0198.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7eb50) returned 0x2350048 [0198.485] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7eb48, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7eb48, lpOverlapped=0x0) returned 1 [0198.500] CloseHandle (hObject=0xdc) returned 1 [0198.500] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 1 [0198.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0198.505] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0198.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0198.505] GetTickCount () returned 0x414f6 [0198.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0198.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0198.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0198.505] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267510\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267510\\...."), lpSecurityAttributes=0x256210) returned 1 [0198.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267510\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267510\\....\\temporaryfile")) returned 0 [0198.506] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267510\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267510\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267510\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267510\\temporaryfile")) returned 1 [0198.507] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267510\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b439b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b439b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b439b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0198.507] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b439b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b439b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b439b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.507] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b439b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b439b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b439b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0198.507] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267510\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b439b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b439b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b439b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0198.507] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b439b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b439b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b439b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.508] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b439b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b439b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b439b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0198.508] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0198.508] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267510\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267510\\temporaryfile")) returned 1 [0198.508] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b439b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b439b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b439b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0198.508] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0198.508] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267510" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267510")) returned 1 [0198.508] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 0 [0198.527] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.528] WriteFile (in: hFile=0xdc, lpBuffer=0x23ceba8*, nNumberOfBytesToWrite=0x7eb50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23ceba8*, lpNumberOfBytesWritten=0x18fdd8*=0x7eb50, lpOverlapped=0x0) returned 1 [0198.536] CloseHandle (hObject=0xdc) returned 1 [0198.538] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.539] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x21d78 [0198.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x21d80) returned 0x2a0a70 [0198.540] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x21d78, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x21d78, lpOverlapped=0x0) returned 1 [0198.541] CloseHandle (hObject=0xdc) returned 1 [0198.541] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 1 [0198.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0198.543] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0198.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0198.543] GetTickCount () returned 0x41515 [0198.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0198.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0198.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0198.544] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267541\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267541\\...."), lpSecurityAttributes=0x256228) returned 1 [0198.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267541\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267541\\....\\temporaryfile")) returned 0 [0198.544] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267541\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267541\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267541\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267541\\temporaryfile")) returned 1 [0198.548] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267541\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b485dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4abf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4abf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0198.548] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b485dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4abf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4abf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.548] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b485dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b485dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b485dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0198.548] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267541\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b485dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b485dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b485dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0198.549] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b485dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b485dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b485dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.549] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b485dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b485dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b485dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0198.549] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0198.549] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267541\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267541\\temporaryfile")) returned 1 [0198.549] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b485dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b485dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b485dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0198.549] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0198.549] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267541" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267541")) returned 1 [0198.549] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 0 [0198.553] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.553] WriteFile (in: hFile=0xdc, lpBuffer=0x2c2800*, nNumberOfBytesToWrite=0x21d80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c2800*, lpNumberOfBytesWritten=0x18fdd8*=0x21d80, lpOverlapped=0x0) returned 1 [0198.556] CloseHandle (hObject=0xdc) returned 1 [0198.556] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.557] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x11578 [0198.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11580) returned 0x2a0a70 [0198.557] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x11578, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x11578, lpOverlapped=0x0) returned 1 [0198.559] CloseHandle (hObject=0xdc) returned 1 [0198.559] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 1 [0198.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0198.560] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0198.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0198.560] GetTickCount () returned 0x41534 [0198.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0198.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0198.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0198.561] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572\\...."), lpSecurityAttributes=0x256210) returned 1 [0198.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572\\....\\temporaryfile")) returned 0 [0198.561] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572\\temporaryfile")) returned 1 [0198.562] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0198.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0198.563] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0198.563] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.563] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0198.563] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0198.563] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572\\temporaryfile")) returned 1 [0198.563] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0198.563] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0198.563] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572")) returned 1 [0198.563] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 0 [0198.564] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.565] WriteFile (in: hFile=0xdc, lpBuffer=0x2b2000*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b2000*, lpNumberOfBytesWritten=0x18fdd8*=0x11580, lpOverlapped=0x0) returned 1 [0198.566] CloseHandle (hObject=0xdc) returned 1 [0198.567] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.568] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x26560 [0198.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26568) returned 0x2a0a70 [0198.568] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x26560, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x26560, lpOverlapped=0x0) returned 1 [0198.570] CloseHandle (hObject=0xdc) returned 1 [0198.570] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 1 [0198.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0198.572] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0198.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0198.572] GetTickCount () returned 0x41534 [0198.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0198.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0198.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0198.572] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572\\...."), lpSecurityAttributes=0x256228) returned 1 [0198.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572\\....\\temporaryfile")) returned 0 [0198.573] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572\\temporaryfile")) returned 1 [0198.574] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0198.574] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.574] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0198.574] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0198.574] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.574] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0198.575] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0198.575] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572\\temporaryfile")) returned 1 [0198.575] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b4d2080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b4d2080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b4d2080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0198.575] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0198.575] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267572" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267572")) returned 1 [0198.575] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 0 [0198.578] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.579] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6fe8*, nNumberOfBytesToWrite=0x26568, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6fe8*, lpNumberOfBytesWritten=0x18fdd8*=0x26568, lpOverlapped=0x0) returned 1 [0198.582] CloseHandle (hObject=0xdc) returned 1 [0198.582] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.583] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x417360 [0198.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x417368) returned 0x2650020 [0198.583] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x417360, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x417360, lpOverlapped=0x0) returned 1 [0198.748] CloseHandle (hObject=0xdc) returned 1 [0198.748] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 1 [0198.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0198.750] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0198.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0198.750] GetTickCount () returned 0x415f0 [0198.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0198.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0198.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0198.750] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267760\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267760\\...."), lpSecurityAttributes=0x256210) returned 1 [0198.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267760\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267760\\....\\temporaryfile")) returned 0 [0198.751] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267760\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267760\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267760\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267760\\temporaryfile")) returned 1 [0198.752] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267760\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b69b100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b69b100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b69b100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0198.752] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b69b100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b69b100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b69b100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.752] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b69b100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b69b100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b69b100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0198.752] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267760\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b69b100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b69b100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b69b100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0198.752] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b69b100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b69b100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b69b100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.752] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b69b100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b69b100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b69b100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0198.752] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0198.752] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267760\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267760\\temporaryfile")) returned 1 [0198.753] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b69b100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b69b100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b69b100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0198.753] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0198.753] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18267760" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18267760")) returned 1 [0198.753] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 0 [0198.951] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0198.952] WriteFile (in: hFile=0xdc, lpBuffer=0x2e90028*, nNumberOfBytesToWrite=0x417368, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e90028*, lpNumberOfBytesWritten=0x18fdd8*=0x417368, lpOverlapped=0x0) returned 1 [0199.035] CloseHandle (hObject=0xdc) returned 1 [0199.071] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0199.072] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x31d88 [0199.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x31d90) returned 0x2a0a70 [0199.072] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x31d88, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x31d88, lpOverlapped=0x0) returned 1 [0199.074] CloseHandle (hObject=0xdc) returned 1 [0199.074] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 1 [0199.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0199.076] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0199.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0199.076] GetTickCount () returned 0x41737 [0199.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0199.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0199.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0199.077] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268087\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268087\\...."), lpSecurityAttributes=0x256228) returned 1 [0199.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268087\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268087\\....\\temporaryfile")) returned 0 [0199.077] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268087\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268087\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268087\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268087\\temporaryfile")) returned 1 [0199.078] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268087\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b9bade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b9bade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b9bade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0199.079] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b9bade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b9bade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b9bade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.079] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b9bade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b9bade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b9bade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0199.079] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268087\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b9bade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b9bade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b9bade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0199.079] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b9bade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b9bade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b9bade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.079] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b9bade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b9bade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b9bade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0199.079] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0199.079] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268087\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268087\\temporaryfile")) returned 1 [0199.079] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b9bade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7b9bade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7b9bade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0199.079] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0199.079] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268087" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268087")) returned 1 [0199.079] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 0 [0199.083] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0199.084] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2810*, nNumberOfBytesToWrite=0x31d90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2810*, lpNumberOfBytesWritten=0x18fdd8*=0x31d90, lpOverlapped=0x0) returned 1 [0199.087] CloseHandle (hObject=0xdc) returned 1 [0199.087] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0199.087] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x183d780 [0199.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x183d788) returned 0x2650020 [0199.088] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x183d780, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x183d780, lpOverlapped=0x0) returned 1 [0199.849] CloseHandle (hObject=0xdc) returned 1 [0199.849] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 1 [0199.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0199.854] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0199.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0199.854] GetTickCount () returned 0x41a34 [0199.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0199.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0199.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0199.855] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268852\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268852\\...."), lpSecurityAttributes=0x256210) returned 1 [0199.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268852\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268852\\....\\temporaryfile")) returned 0 [0199.855] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268852\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268852\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268852\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268852\\temporaryfile")) returned 1 [0199.856] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268852\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c105140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7c12b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7c12b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0199.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c105140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7c12b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7c12b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c12b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7c12b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7c12b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0199.857] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268852\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c12b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7c12b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7c12b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0199.857] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c12b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7c12b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7c12b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.857] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c12b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7c12b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7c12b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0199.857] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0199.857] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268852\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268852\\temporaryfile")) returned 1 [0199.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c12b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7c12b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7c12b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0199.857] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0199.857] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18268852" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18268852")) returned 1 [0199.857] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 0 [0201.108] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0201.108] WriteFile (in: hFile=0xdc, lpBuffer=0x56d0028*, nNumberOfBytesToWrite=0x183d788, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x56d0028*, lpNumberOfBytesWritten=0x18fdd8*=0x183d788, lpOverlapped=0x0) returned 1 [0201.701] CloseHandle (hObject=0xdc) returned 1 [0201.962] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0201.964] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x73b60 [0201.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x73b68) returned 0x2450048 [0201.964] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x73b60, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x73b60, lpOverlapped=0x0) returned 1 [0201.968] CloseHandle (hObject=0xdc) returned 1 [0201.968] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 1 [0201.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0201.974] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0201.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0201.974] GetTickCount () returned 0x4227d [0201.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0201.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0201.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0201.975] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18270973\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18270973\\...."), lpSecurityAttributes=0x256228) returned 1 [0201.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18270973\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18270973\\....\\temporaryfile")) returned 0 [0201.976] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18270973\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18270973\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18270973\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18270973\\temporaryfile")) returned 1 [0201.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18270973\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7d540c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7d566da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7d566da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0201.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7d540c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7d566da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7d566da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7d540c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7d540c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7d540c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0201.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18270973\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7d540c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7d540c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7d540c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0201.983] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7d540c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7d540c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7d540c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.983] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7d540c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7d540c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7d540c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0201.983] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0201.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18270973\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18270973\\temporaryfile")) returned 1 [0201.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7d540c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7d540c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7d540c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0201.983] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0201.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18270973" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18270973")) returned 1 [0201.984] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 0 [0202.025] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0202.025] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x73b68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x73b68, lpOverlapped=0x0) returned 1 [0202.033] CloseHandle (hObject=0xdc) returned 1 [0202.033] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0202.033] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4529780 [0202.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4529788) returned 0x2650020 [0202.035] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x4529780, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x4529780, lpOverlapped=0x0) returned 1 [0204.165] CloseHandle (hObject=0xdc) returned 1 [0204.165] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 1 [0204.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0204.174] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0204.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0204.174] GetTickCount () returned 0x42b15 [0204.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0204.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0204.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0204.174] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18273173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18273173\\...."), lpSecurityAttributes=0x256210) returned 1 [0204.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18273173\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18273173\\....\\temporaryfile")) returned 0 [0204.175] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18273173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18273173\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18273173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18273173\\temporaryfile")) returned 1 [0204.176] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18273173\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ea3ae20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ea3ae20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ea3ae20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0204.177] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ea3ae20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ea3ae20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ea3ae20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.177] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ea3ae20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ea3ae20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ea3ae20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0204.177] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18273173\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ea3ae20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ea3ae20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ea3ae20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0204.177] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ea3ae20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ea3ae20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ea3ae20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.177] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ea3ae20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ea3ae20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ea3ae20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.177] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0204.177] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18273173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18273173\\temporaryfile")) returned 1 [0204.177] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7ea3ae20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x7ea3ae20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x7ea3ae20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0204.177] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0204.177] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18273173" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18273173")) returned 1 [0204.177] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 0 [0207.816] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0207.817] WriteFile (in: hFile=0xdc, lpBuffer=0xb0b0028*, nNumberOfBytesToWrite=0x4529788, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0xb0b0028*, lpNumberOfBytesWritten=0x18fdd8*=0x4529788, lpOverlapped=0x0) returned 1 [0209.535] CloseHandle (hObject=0xdc) returned 1 [0210.244] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.244] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x135f90 [0210.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x135f98) returned 0x2650020 [0210.245] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x135f90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x135f90, lpOverlapped=0x0) returned 1 [0210.287] CloseHandle (hObject=0xdc) returned 1 [0210.287] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 1 [0210.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0210.289] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.289] GetTickCount () returned 0x442f8 [0210.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.290] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279288\\...."), lpSecurityAttributes=0x256228) returned 1 [0210.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279288\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279288\\....\\temporaryfile")) returned 0 [0210.291] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279288\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279288\\temporaryfile")) returned 1 [0210.292] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279288\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8248c920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x824b2a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x824b2a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.292] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8248c920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x824b2a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x824b2a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.292] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8248c920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8248c920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8248c920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.292] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279288\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8248c920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8248c920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8248c920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.292] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8248c920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8248c920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8248c920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.292] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8248c920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8248c920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8248c920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.293] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.293] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279288\\temporaryfile")) returned 1 [0210.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8248c920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8248c920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8248c920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.293] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.293] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279288" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279288")) returned 1 [0210.293] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 0 [0210.347] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.348] WriteFile (in: hFile=0xdc, lpBuffer=0x28d0028*, nNumberOfBytesToWrite=0x135f98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28d0028*, lpNumberOfBytesWritten=0x18fdd8*=0x135f98, lpOverlapped=0x0) returned 1 [0210.368] CloseHandle (hObject=0xdc) returned 1 [0210.379] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.380] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdb50 [0210.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdb58) returned 0x2a0a70 [0210.380] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xdb50, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0xdb50, lpOverlapped=0x0) returned 1 [0210.381] CloseHandle (hObject=0xdc) returned 1 [0210.382] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 1 [0210.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0210.383] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.383] GetTickCount () returned 0x44356 [0210.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.383] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279382\\...."), lpSecurityAttributes=0x256210) returned 1 [0210.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279382\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279382\\....\\temporaryfile")) returned 0 [0210.384] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279382\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279382\\temporaryfile")) returned 1 [0210.385] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279382\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82571160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82571160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82571160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.385] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82571160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82571160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82571160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.385] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82571160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82571160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82571160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.385] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279382\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82571160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82571160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82571160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.385] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82571160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82571160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82571160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.385] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82571160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82571160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82571160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.385] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.386] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279382\\temporaryfile")) returned 1 [0210.386] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82571160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82571160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82571160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.386] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.386] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279382" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279382")) returned 1 [0210.386] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 0 [0210.388] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.388] WriteFile (in: hFile=0xdc, lpBuffer=0x2ae5d8*, nNumberOfBytesToWrite=0xdb58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ae5d8*, lpNumberOfBytesWritten=0x18fdd8*=0xdb58, lpOverlapped=0x0) returned 1 [0210.389] CloseHandle (hObject=0xdc) returned 1 [0210.390] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.390] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d950 [0210.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d958) returned 0x2a0a70 [0210.390] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x1d950, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x1d950, lpOverlapped=0x0) returned 1 [0210.392] CloseHandle (hObject=0xdc) returned 1 [0210.392] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 1 [0210.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0210.393] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.393] GetTickCount () returned 0x44365 [0210.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.394] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279397\\...."), lpSecurityAttributes=0x256228) returned 1 [0210.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279397\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279397\\....\\temporaryfile")) returned 0 [0210.394] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279397\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279397\\temporaryfile")) returned 1 [0210.396] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279397\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825972c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825972c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825972c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.396] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825972c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825972c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825972c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.396] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825972c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825972c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825972c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.396] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279397\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825972c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825972c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825972c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.396] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825972c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825972c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825972c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.396] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825972c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825972c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825972c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.396] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.396] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279397\\temporaryfile")) returned 1 [0210.399] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825972c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825972c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825972c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.399] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279397" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279397")) returned 1 [0210.399] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 0 [0210.402] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.403] WriteFile (in: hFile=0xdc, lpBuffer=0x2be3d8*, nNumberOfBytesToWrite=0x1d958, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2be3d8*, lpNumberOfBytesWritten=0x18fdd8*=0x1d958, lpOverlapped=0x0) returned 1 [0210.405] CloseHandle (hObject=0xdc) returned 1 [0210.405] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.405] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdb80 [0210.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdb88) returned 0x2a0a70 [0210.405] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xdb80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0xdb80, lpOverlapped=0x0) returned 1 [0210.407] CloseHandle (hObject=0xdc) returned 1 [0210.407] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 1 [0210.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0210.408] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.408] GetTickCount () returned 0x44375 [0210.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.409] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279413\\...."), lpSecurityAttributes=0x256210) returned 1 [0210.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279413\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279413\\....\\temporaryfile")) returned 0 [0210.409] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279413\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279413\\temporaryfile")) returned 1 [0210.410] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279413\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825bd420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825bd420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825bd420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.410] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825bd420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825bd420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825bd420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.410] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825bd420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825bd420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825bd420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.410] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279413\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825bd420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825bd420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825bd420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.410] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825bd420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825bd420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825bd420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.410] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825bd420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825bd420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825bd420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.410] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.410] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279413\\temporaryfile")) returned 1 [0210.410] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x825bd420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x825bd420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x825bd420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.411] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.411] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279413" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279413")) returned 1 [0210.411] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 0 [0210.412] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.412] WriteFile (in: hFile=0xdc, lpBuffer=0x2ae608*, nNumberOfBytesToWrite=0xdb88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ae608*, lpNumberOfBytesWritten=0x18fdd8*=0xdb88, lpOverlapped=0x0) returned 1 [0210.413] CloseHandle (hObject=0xdc) returned 1 [0210.414] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.414] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x124980 [0210.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x124988) returned 0x2650020 [0210.415] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x124980, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x124980, lpOverlapped=0x0) returned 1 [0210.454] CloseHandle (hObject=0xdc) returned 1 [0210.454] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 1 [0210.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0210.456] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.456] GetTickCount () returned 0x443a4 [0210.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.456] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279460\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279460\\...."), lpSecurityAttributes=0x256228) returned 1 [0210.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279460\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279460\\....\\temporaryfile")) returned 0 [0210.457] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279460\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279460\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279460\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279460\\temporaryfile")) returned 1 [0210.458] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279460\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8262f840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8262f840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8262f840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.458] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8262f840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8262f840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8262f840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.458] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8262f840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8262f840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8262f840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.458] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279460\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8262f840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8262f840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8262f840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.458] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8262f840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8262f840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8262f840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.458] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8262f840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8262f840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8262f840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.458] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.458] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279460\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279460\\temporaryfile")) returned 1 [0210.458] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8262f840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8262f840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8262f840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.458] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.458] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279460" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279460")) returned 1 [0210.458] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 0 [0210.507] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.508] WriteFile (in: hFile=0xdc, lpBuffer=0x28b0028*, nNumberOfBytesToWrite=0x124988, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28b0028*, lpNumberOfBytesWritten=0x18fdd8*=0x124988, lpOverlapped=0x0) returned 1 [0210.527] CloseHandle (hObject=0xdc) returned 1 [0210.537] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.537] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xac370 [0210.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xac378) returned 0x1d70020 [0210.537] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xac370, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xac370, lpOverlapped=0x0) returned 1 [0210.561] CloseHandle (hObject=0xdc) returned 1 [0210.561] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 1 [0210.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0210.567] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.567] GetTickCount () returned 0x44411 [0210.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.567] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279569\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279569\\...."), lpSecurityAttributes=0x256210) returned 1 [0210.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279569\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279569\\....\\temporaryfile")) returned 0 [0210.568] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279569\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279569\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279569\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279569\\temporaryfile")) returned 1 [0210.569] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279569\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8273a1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8273a1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8273a1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.569] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8273a1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8273a1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8273a1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.569] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8273a1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8273a1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8273a1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.569] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279569\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8273a1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8273a1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8273a1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.569] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8273a1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8273a1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8273a1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.569] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8273a1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8273a1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8273a1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.569] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.569] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279569\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279569\\temporaryfile")) returned 1 [0210.569] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8273a1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8273a1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8273a1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.569] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.569] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279569" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279569")) returned 1 [0210.570] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 0 [0210.603] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.603] WriteFile (in: hFile=0xdc, lpBuffer=0x2700028*, nNumberOfBytesToWrite=0xac378, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2700028*, lpNumberOfBytesWritten=0x18fdd8*=0xac378, lpOverlapped=0x0) returned 1 [0210.613] CloseHandle (hObject=0xdc) returned 1 [0210.619] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.624] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a5b [0210.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a63) returned 0x297460 [0210.624] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x1a5b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x1a5b, lpOverlapped=0x0) returned 1 [0210.628] CloseHandle (hObject=0xdc) returned 1 [0210.628] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 1 [0210.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0210.629] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.629] GetTickCount () returned 0x4444f [0210.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.629] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279631\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279631\\...."), lpSecurityAttributes=0x256228) returned 1 [0210.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279631\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279631\\....\\temporaryfile")) returned 0 [0210.630] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279631\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279631\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279631\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279631\\temporaryfile")) returned 1 [0210.631] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279631\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827d2760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827d2760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827d2760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.631] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827d2760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827d2760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827d2760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.631] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827d2760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827d2760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827d2760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.631] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279631\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827d2760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827d2760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827d2760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.631] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827d2760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827d2760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827d2760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.631] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827d2760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827d2760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827d2760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.631] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.631] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279631\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279631\\temporaryfile")) returned 1 [0210.631] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827d2760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827d2760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827d2760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.631] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.631] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279631" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279631")) returned 1 [0210.632] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 0 [0210.632] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.632] WriteFile (in: hFile=0xdc, lpBuffer=0x298ed8*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x298ed8*, lpNumberOfBytesWritten=0x18fdd8*=0x1a60, lpOverlapped=0x0) returned 1 [0210.633] CloseHandle (hObject=0xdc) returned 1 [0210.642] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.643] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6190 [0210.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6198) returned 0x2a0a70 [0210.644] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x6190, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x6190, lpOverlapped=0x0) returned 1 [0210.646] CloseHandle (hObject=0xdc) returned 1 [0210.646] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 1 [0210.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0210.648] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.648] GetTickCount () returned 0x4445f [0210.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.648] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279647\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279647\\...."), lpSecurityAttributes=0x256210) returned 1 [0210.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279647\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279647\\....\\temporaryfile")) returned 0 [0210.649] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279647\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279647\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279647\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279647\\temporaryfile")) returned 1 [0210.650] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279647\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f88c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827f88c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827f88c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.650] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f88c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827f88c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827f88c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.650] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f88c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827f88c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827f88c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.650] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279647\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f88c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827f88c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827f88c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.650] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f88c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827f88c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827f88c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.650] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f88c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827f88c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827f88c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.650] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.650] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279647\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279647\\temporaryfile")) returned 1 [0210.650] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f88c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x827f88c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x827f88c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.650] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.650] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279647" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279647")) returned 1 [0210.651] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 0 [0210.651] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.652] WriteFile (in: hFile=0xdc, lpBuffer=0x2a6c18*, nNumberOfBytesToWrite=0x6198, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a6c18*, lpNumberOfBytesWritten=0x18fdd8*=0x6198, lpOverlapped=0x0) returned 1 [0210.653] CloseHandle (hObject=0xdc) returned 1 [0210.653] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.661] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x38d88 [0210.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x38d90) returned 0x2a0a70 [0210.661] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x38d88, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x38d88, lpOverlapped=0x0) returned 1 [0210.664] CloseHandle (hObject=0xdc) returned 1 [0210.664] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 1 [0210.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0210.667] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.667] GetTickCount () returned 0x4447e [0210.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.667] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279678\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279678\\...."), lpSecurityAttributes=0x256228) returned 1 [0210.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279678\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279678\\....\\temporaryfile")) returned 0 [0210.668] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279678\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279678\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279678\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279678\\temporaryfile")) returned 1 [0210.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279678\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82844b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82844b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82844b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.669] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82844b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82844b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82844b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.669] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82844b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82844b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82844b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279678\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82844b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82844b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82844b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.669] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82844b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82844b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82844b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.669] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82844b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82844b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82844b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.669] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.669] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279678\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279678\\temporaryfile")) returned 1 [0210.670] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82844b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82844b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82844b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.670] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279678" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279678")) returned 1 [0210.670] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 0 [0210.677] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.677] WriteFile (in: hFile=0xdc, lpBuffer=0x2d9810*, nNumberOfBytesToWrite=0x38d90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d9810*, lpNumberOfBytesWritten=0x18fdd8*=0x38d90, lpOverlapped=0x0) returned 1 [0210.681] CloseHandle (hObject=0xdc) returned 1 [0210.681] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.682] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7568 [0210.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7570) returned 0x2a0a70 [0210.682] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x7568, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x7568, lpOverlapped=0x0) returned 1 [0210.683] CloseHandle (hObject=0xdc) returned 1 [0210.683] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 1 [0210.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0210.684] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.684] GetTickCount () returned 0x4448e [0210.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.685] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694\\...."), lpSecurityAttributes=0x256210) returned 1 [0210.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694\\....\\temporaryfile")) returned 0 [0210.686] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694\\temporaryfile")) returned 1 [0210.687] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.687] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.687] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.687] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.687] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.687] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694\\temporaryfile")) returned 1 [0210.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.687] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.687] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694")) returned 1 [0210.687] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 0 [0210.688] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.688] WriteFile (in: hFile=0xdc, lpBuffer=0x2a7ff0*, nNumberOfBytesToWrite=0x7570, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a7ff0*, lpNumberOfBytesWritten=0x18fdd8*=0x7570, lpOverlapped=0x0) returned 1 [0210.690] CloseHandle (hObject=0xdc) returned 1 [0210.690] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.690] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2560 [0210.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2568) returned 0x297460 [0210.690] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x2560, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x2560, lpOverlapped=0x0) returned 1 [0210.693] CloseHandle (hObject=0xdc) returned 1 [0210.693] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 1 [0210.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0210.694] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.694] GetTickCount () returned 0x4448e [0210.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.694] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694\\...."), lpSecurityAttributes=0x256228) returned 1 [0210.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694\\....\\temporaryfile")) returned 0 [0210.695] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694\\temporaryfile")) returned 1 [0210.696] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.696] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.696] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.696] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.696] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.697] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.697] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694\\temporaryfile")) returned 1 [0210.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286ace0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8286ace0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8286ace0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.697] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279694" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279694")) returned 1 [0210.697] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 0 [0210.698] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.698] WriteFile (in: hFile=0xdc, lpBuffer=0x2999d8*, nNumberOfBytesToWrite=0x2568, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2999d8*, lpNumberOfBytesWritten=0x18fdd8*=0x2568, lpOverlapped=0x0) returned 1 [0210.699] CloseHandle (hObject=0xdc) returned 1 [0210.701] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.701] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4d88 [0210.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4d90) returned 0x297460 [0210.702] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x4d88, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x4d88, lpOverlapped=0x0) returned 1 [0210.703] CloseHandle (hObject=0xdc) returned 1 [0210.703] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 1 [0210.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0210.704] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.704] GetTickCount () returned 0x4449d [0210.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.705] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279709\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279709\\...."), lpSecurityAttributes=0x256210) returned 1 [0210.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279709\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279709\\....\\temporaryfile")) returned 0 [0210.705] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279709\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279709\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279709\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279709\\temporaryfile")) returned 1 [0210.706] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279709\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82890e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82890e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82890e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82890e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82890e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82890e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82890e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82890e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82890e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.707] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279709\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82890e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82890e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82890e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.707] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82890e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82890e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82890e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.707] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82890e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82890e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82890e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.707] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.707] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279709\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279709\\temporaryfile")) returned 1 [0210.707] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82890e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82890e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82890e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.707] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.707] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279709" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279709")) returned 1 [0210.707] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 0 [0210.709] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.709] WriteFile (in: hFile=0xdc, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdd8*=0x4d90, lpOverlapped=0x0) returned 1 [0210.710] CloseHandle (hObject=0xdc) returned 1 [0210.712] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.713] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x47a0 [0210.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x47a8) returned 0x297460 [0210.713] ReadFile (in: hFile=0xdc, lpBuffer=0x297468, nNumberOfBytesToRead=0x47a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdf0*=0x47a0, lpOverlapped=0x0) returned 1 [0210.714] CloseHandle (hObject=0xdc) returned 1 [0210.714] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 1 [0210.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0210.715] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.715] GetTickCount () returned 0x444ad [0210.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.716] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279725\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279725\\...."), lpSecurityAttributes=0x256228) returned 1 [0210.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279725\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279725\\....\\temporaryfile")) returned 0 [0210.716] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279725\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279725\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279725\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279725\\temporaryfile")) returned 1 [0210.717] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279725\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828b6fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x828b6fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x828b6fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.718] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828b6fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x828b6fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x828b6fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.718] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828b6fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x828b6fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x828b6fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.718] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279725\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828b6fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x828b6fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x828b6fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.718] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828b6fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x828b6fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x828b6fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.718] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828b6fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x828b6fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x828b6fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.718] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.718] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279725\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279725\\temporaryfile")) returned 1 [0210.718] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828b6fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x828b6fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x828b6fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.718] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.718] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279725" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279725")) returned 1 [0210.718] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 0 [0210.720] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.720] WriteFile (in: hFile=0xdc, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x47a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdd8*=0x47a8, lpOverlapped=0x0) returned 1 [0210.722] CloseHandle (hObject=0xdc) returned 1 [0210.723] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.724] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb7ba8 [0210.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb7bb0) returned 0x1d70020 [0210.724] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xb7ba8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xb7ba8, lpOverlapped=0x0) returned 1 [0210.738] CloseHandle (hObject=0xdc) returned 1 [0210.738] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 1 [0210.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0210.745] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.745] GetTickCount () returned 0x444cc [0210.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.746] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279756\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279756\\...."), lpSecurityAttributes=0x256210) returned 1 [0210.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279756\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279756\\....\\temporaryfile")) returned 0 [0210.746] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279756\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279756\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279756\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279756\\temporaryfile")) returned 1 [0210.747] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279756\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82903260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82903260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82903260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.747] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82903260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82903260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82903260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.747] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82903260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82903260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82903260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.747] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279756\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82903260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82903260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82903260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.747] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82903260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82903260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82903260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.747] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82903260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82903260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82903260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.747] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.747] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279756\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279756\\temporaryfile")) returned 1 [0210.748] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82903260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82903260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82903260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.748] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.748] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279756" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279756")) returned 1 [0210.748] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 0 [0210.781] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.781] WriteFile (in: hFile=0xdc, lpBuffer=0x2710028*, nNumberOfBytesToWrite=0xb7bb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2710028*, lpNumberOfBytesWritten=0x18fdd8*=0xb7bb0, lpOverlapped=0x0) returned 1 [0210.801] CloseHandle (hObject=0xdc) returned 1 [0210.808] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.808] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3fb90 [0210.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3fb98) returned 0x2a0a70 [0210.809] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x3fb90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x3fb90, lpOverlapped=0x0) returned 1 [0210.814] CloseHandle (hObject=0xdc) returned 1 [0210.814] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 1 [0210.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0210.816] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.816] GetTickCount () returned 0x4450a [0210.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.817] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279818\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279818\\...."), lpSecurityAttributes=0x256228) returned 1 [0210.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279818\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279818\\....\\temporaryfile")) returned 0 [0210.817] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279818\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279818\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279818\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279818\\temporaryfile")) returned 1 [0210.818] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279818\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8299b7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8299b7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8299b7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.818] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8299b7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8299b7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8299b7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.818] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8299b7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8299b7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8299b7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.818] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279818\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8299b7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8299b7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8299b7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.818] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8299b7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8299b7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8299b7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.818] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8299b7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8299b7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8299b7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.819] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.819] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279818\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279818\\temporaryfile")) returned 1 [0210.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8299b7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8299b7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8299b7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.819] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.819] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279818" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279818")) returned 1 [0210.819] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 0 [0210.827] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.827] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x3fb98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x3fb98, lpOverlapped=0x0) returned 1 [0210.831] CloseHandle (hObject=0xdc) returned 1 [0210.831] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0210.832] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3c2b90 [0210.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3c2b98) returned 0x2650020 [0210.832] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x3c2b90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x3c2b90, lpOverlapped=0x0) returned 1 [0210.935] CloseHandle (hObject=0xdc) returned 1 [0210.935] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll")) returned 1 [0210.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0210.942] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0210.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0210.942] GetTickCount () returned 0x44587 [0210.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0210.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0210.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0210.942] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279943\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279943\\...."), lpSecurityAttributes=0x256210) returned 1 [0210.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279943\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279943\\....\\temporaryfile")) returned 0 [0210.943] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279943\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279943\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279943\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279943\\temporaryfile")) returned 1 [0210.944] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279943\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82acc2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82acc2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82acc2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0210.944] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82acc2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82acc2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82acc2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.944] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82acc2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82acc2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82acc2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0210.944] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279943\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82acc2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82acc2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82acc2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0210.944] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82acc2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82acc2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82acc2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.944] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82acc2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82acc2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82acc2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.944] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0210.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279943\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279943\\temporaryfile")) returned 1 [0210.944] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82acc2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82acc2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82acc2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0210.944] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0210.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18279943" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18279943")) returned 1 [0210.945] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 0 [0211.118] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0211.119] WriteFile (in: hFile=0xdc, lpBuffer=0x2df0028*, nNumberOfBytesToWrite=0x3c2b98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2df0028*, lpNumberOfBytesWritten=0x18fdd8*=0x3c2b98, lpOverlapped=0x0) returned 1 [0211.191] CloseHandle (hObject=0xdc) returned 1 [0211.226] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0211.226] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c8b68 [0211.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c8b70) returned 0x2650020 [0211.226] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1c8b68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x1c8b68, lpOverlapped=0x0) returned 1 [0211.268] CloseHandle (hObject=0xdc) returned 1 [0211.268] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll")) returned 1 [0211.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0211.274] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0211.274] GetTickCount () returned 0x446de [0211.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0211.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0211.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0211.275] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280286\\...."), lpSecurityAttributes=0x256228) returned 1 [0211.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280286\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280286\\....\\temporaryfile")) returned 0 [0211.278] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280286\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280286\\temporaryfile")) returned 1 [0211.279] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280286\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82e12120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82e12120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82e12120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0211.279] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82e12120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82e12120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82e12120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.279] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82e12120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82e12120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82e12120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0211.279] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280286\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82e12120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82e12120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82e12120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0211.279] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82e12120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82e12120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82e12120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.280] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82e12120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82e12120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82e12120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.280] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0211.280] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280286\\temporaryfile")) returned 1 [0211.280] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82e12120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82e12120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82e12120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0211.280] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0211.280] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280286" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280286")) returned 1 [0211.280] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 0 [0211.368] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0211.369] WriteFile (in: hFile=0xdc, lpBuffer=0x29f0028*, nNumberOfBytesToWrite=0x1c8b70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29f0028*, lpNumberOfBytesWritten=0x18fdd8*=0x1c8b70, lpOverlapped=0x0) returned 1 [0211.399] CloseHandle (hObject=0xdc) returned 1 [0211.415] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0211.415] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x90778 [0211.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x90780) returned 0x1d70020 [0211.415] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x90778, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0x90778, lpOverlapped=0x0) returned 1 [0211.437] CloseHandle (hObject=0xdc) returned 1 [0211.438] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 1 [0211.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0211.443] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0211.443] GetTickCount () returned 0x4477a [0211.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0211.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0211.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0211.447] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280442\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280442\\...."), lpSecurityAttributes=0x256210) returned 1 [0211.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280442\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280442\\....\\temporaryfile")) returned 0 [0211.447] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280442\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280442\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280442\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280442\\temporaryfile")) returned 1 [0211.448] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280442\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82f8eee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82fb5040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82fb5040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0211.448] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82f8eee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82fb5040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82fb5040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.448] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82fb5040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82fb5040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82fb5040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0211.448] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280442\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82fb5040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82fb5040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82fb5040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0211.449] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82fb5040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82fb5040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82fb5040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.449] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82fb5040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82fb5040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82fb5040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.449] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0211.449] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280442\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280442\\temporaryfile")) returned 1 [0211.449] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82fb5040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x82fb5040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x82fb5040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0211.449] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0211.449] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280442" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280442")) returned 1 [0211.449] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 0 [0211.474] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0211.474] WriteFile (in: hFile=0xdc, lpBuffer=0x26f0028*, nNumberOfBytesToWrite=0x90780, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x26f0028*, lpNumberOfBytesWritten=0x18fdd8*=0x90780, lpOverlapped=0x0) returned 1 [0211.483] CloseHandle (hObject=0xdc) returned 1 [0211.489] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0211.490] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc6b00 [0211.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc6b08) returned 0x1d70020 [0211.490] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xc6b00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xc6b00, lpOverlapped=0x0) returned 1 [0211.506] CloseHandle (hObject=0xdc) returned 1 [0211.506] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 1 [0211.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0211.513] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0211.513] GetTickCount () returned 0x447c8 [0211.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0211.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0211.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0211.513] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280520\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280520\\...."), lpSecurityAttributes=0x256228) returned 1 [0211.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280520\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280520\\....\\temporaryfile")) returned 0 [0211.514] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280520\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280520\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280520\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280520\\temporaryfile")) returned 1 [0211.515] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280520\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8304d5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8304d5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8304d5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0211.515] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8304d5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8304d5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8304d5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.515] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8304d5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8304d5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8304d5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0211.515] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280520\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8304d5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8304d5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8304d5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0211.515] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8304d5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8304d5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8304d5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.515] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8304d5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8304d5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8304d5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.515] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0211.515] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280520\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280520\\temporaryfile")) returned 1 [0211.516] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8304d5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8304d5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8304d5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0211.516] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0211.516] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280520" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280520")) returned 1 [0211.516] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 0 [0211.560] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0211.561] WriteFile (in: hFile=0xdc, lpBuffer=0x2720028*, nNumberOfBytesToWrite=0xc6b08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2720028*, lpNumberOfBytesWritten=0x18fdd8*=0xc6b08, lpOverlapped=0x0) returned 1 [0211.573] CloseHandle (hObject=0xdc) returned 1 [0211.580] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0211.581] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc150 [0211.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc158) returned 0x2a0a70 [0211.581] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xc150, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0xc150, lpOverlapped=0x0) returned 1 [0211.582] CloseHandle (hObject=0xdc) returned 1 [0211.582] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 1 [0211.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0211.583] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0211.583] GetTickCount () returned 0x44807 [0211.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0211.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0211.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0211.584] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280583\\...."), lpSecurityAttributes=0x256210) returned 1 [0211.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280583\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280583\\....\\temporaryfile")) returned 0 [0211.585] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280583\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280583\\temporaryfile")) returned 1 [0211.586] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280583\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x830e5b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x830e5b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x830e5b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0211.586] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x830e5b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x830e5b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x830e5b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.586] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x830e5b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x830e5b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x830e5b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0211.586] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280583\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x830e5b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x830e5b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x830e5b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0211.586] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x830e5b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x830e5b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x830e5b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.586] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x830e5b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x830e5b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x830e5b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.586] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0211.586] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280583\\temporaryfile")) returned 1 [0211.586] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x830e5b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x830e5b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x830e5b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0211.587] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0211.587] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280583" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280583")) returned 1 [0211.587] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 0 [0211.588] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0211.588] WriteFile (in: hFile=0xdc, lpBuffer=0x2acbd8*, nNumberOfBytesToWrite=0xc158, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2acbd8*, lpNumberOfBytesWritten=0x18fdd8*=0xc158, lpOverlapped=0x0) returned 1 [0211.589] CloseHandle (hObject=0xdc) returned 1 [0211.590] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0211.591] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x23f90 [0211.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23f98) returned 0x2a0a70 [0211.591] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x23f90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdf0*=0x23f90, lpOverlapped=0x0) returned 1 [0211.592] CloseHandle (hObject=0xdc) returned 1 [0211.593] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 1 [0211.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0211.594] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0211.594] GetTickCount () returned 0x44816 [0211.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0211.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0211.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0211.595] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280598\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280598\\...."), lpSecurityAttributes=0x256228) returned 1 [0211.595] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280598\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280598\\....\\temporaryfile")) returned 0 [0211.595] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280598\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280598\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280598\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280598\\temporaryfile")) returned 1 [0211.596] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280598\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8310bca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8310bca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8310bca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0211.596] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8310bca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8310bca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8310bca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.596] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8310bca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8310bca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8310bca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0211.596] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280598\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8310bca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8310bca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8310bca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0211.597] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8310bca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8310bca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8310bca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.597] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8310bca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8310bca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8310bca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.597] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0211.597] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280598\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280598\\temporaryfile")) returned 1 [0211.597] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8310bca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8310bca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8310bca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0211.597] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0211.597] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280598" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280598")) returned 1 [0211.597] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 0 [0211.600] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0211.601] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a18*, nNumberOfBytesToWrite=0x23f98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a18*, lpNumberOfBytesWritten=0x18fdd8*=0x23f98, lpOverlapped=0x0) returned 1 [0211.608] CloseHandle (hObject=0xdc) returned 1 [0211.608] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0211.608] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8310bca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8310bca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0211.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0211.608] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee282250, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0211.611] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee282250, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0211.611] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0xee282250, dwReserved1=0x1d301be, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0211.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0211.611] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.611] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x305a8 [0211.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x305b0) returned 0x2a0a70 [0211.611] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x305a8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x305a8, lpOverlapped=0x0) returned 1 [0211.613] CloseHandle (hObject=0xe0) returned 1 [0211.613] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0211.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0211.615] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0211.615] GetTickCount () returned 0x44826 [0211.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0211.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0211.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0211.616] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280614\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280614\\...."), lpSecurityAttributes=0x256228) returned 1 [0211.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280614\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280614\\....\\temporaryfile")) returned 0 [0211.616] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280614\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280614\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280614\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280614\\temporaryfile")) returned 1 [0211.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280614\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83131e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83131e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83131e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0211.617] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83131e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83131e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83131e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0211.617] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83131e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83131e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83131e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0211.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280614\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83131e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83131e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83131e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0211.618] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83131e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83131e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83131e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.618] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83131e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83131e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83131e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.618] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0211.618] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280614\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280614\\temporaryfile")) returned 1 [0211.618] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83131e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83131e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83131e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0211.618] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0211.618] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280614" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280614")) returned 1 [0211.618] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 0 [0211.622] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.623] WriteFile (in: hFile=0xe0, lpBuffer=0x2d1030*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2d1030*, lpNumberOfBytesWritten=0x18fdb8*=0x305b0, lpOverlapped=0x0) returned 1 [0211.626] CloseHandle (hObject=0xe0) returned 1 [0211.626] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.626] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xcdb0 [0211.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcdb8) returned 0x2a0a70 [0211.626] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xcdb0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0xcdb0, lpOverlapped=0x0) returned 1 [0211.628] CloseHandle (hObject=0xe0) returned 1 [0211.628] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0211.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0211.629] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0211.629] GetTickCount () returned 0x44836 [0211.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0211.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0211.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0211.630] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280630\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280630\\...."), lpSecurityAttributes=0x256210) returned 1 [0211.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280630\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280630\\....\\temporaryfile")) returned 0 [0211.630] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280630\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280630\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280630\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280630\\temporaryfile")) returned 1 [0211.631] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280630\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83157f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83157f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83157f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0211.631] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83157f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83157f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83157f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.631] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83157f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83157f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83157f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0211.631] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280630\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83157f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83157f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83157f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0211.631] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83157f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83157f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83157f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.631] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83157f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83157f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83157f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.632] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0211.632] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280630\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280630\\temporaryfile")) returned 1 [0211.632] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83157f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83157f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83157f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0211.632] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0211.632] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280630" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280630")) returned 1 [0211.632] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 0 [0211.633] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.634] WriteFile (in: hFile=0xe0, lpBuffer=0x2ad838*, nNumberOfBytesToWrite=0xcdb8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ad838*, lpNumberOfBytesWritten=0x18fdb8*=0xcdb8, lpOverlapped=0x0) returned 1 [0211.635] CloseHandle (hObject=0xe0) returned 1 [0211.635] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.636] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x51d0 [0211.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x51d8) returned 0x297460 [0211.636] ReadFile (in: hFile=0xe0, lpBuffer=0x297468, nNumberOfBytesToRead=0x51d0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdd0*=0x51d0, lpOverlapped=0x0) returned 1 [0211.638] CloseHandle (hObject=0xe0) returned 1 [0211.638] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0211.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0211.639] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0211.639] GetTickCount () returned 0x44845 [0211.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0211.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0211.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0211.639] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280645\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280645\\...."), lpSecurityAttributes=0x256228) returned 1 [0211.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280645\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280645\\....\\temporaryfile")) returned 0 [0211.640] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280645\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280645\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280645\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280645\\temporaryfile")) returned 1 [0211.641] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280645\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8317e0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8317e0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8317e0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0211.641] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8317e0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8317e0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8317e0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.641] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8317e0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8317e0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8317e0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0211.641] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280645\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8317e0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8317e0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8317e0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0211.641] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8317e0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8317e0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8317e0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.641] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8317e0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8317e0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8317e0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.641] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0211.641] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280645\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280645\\temporaryfile")) returned 1 [0211.641] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8317e0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8317e0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8317e0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0211.641] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0211.642] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280645" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280645")) returned 1 [0211.642] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 0 [0211.642] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.643] WriteFile (in: hFile=0xe0, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x51d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdb8*=0x51d8, lpOverlapped=0x0) returned 1 [0211.644] CloseHandle (hObject=0xe0) returned 1 [0211.647] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.648] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd2990 [0211.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd2998) returned 0x2650020 [0211.648] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0xd2990, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0xd2990, lpOverlapped=0x0) returned 1 [0211.674] CloseHandle (hObject=0xe0) returned 1 [0211.674] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0211.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0211.681] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0211.681] GetTickCount () returned 0x44874 [0211.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0211.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0211.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0211.682] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280692\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280692\\...."), lpSecurityAttributes=0x256210) returned 1 [0211.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280692\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280692\\....\\temporaryfile")) returned 0 [0211.683] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280692\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280692\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280692\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280692\\temporaryfile")) returned 1 [0211.684] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280692\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x831f04e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x831f04e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x831f04e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0211.684] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x831f04e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x831f04e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x831f04e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.684] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x831f04e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x831f04e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x831f04e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0211.684] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280692\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x831f04e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x831f04e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x831f04e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0211.684] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x831f04e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x831f04e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x831f04e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.684] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x831f04e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x831f04e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x831f04e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.684] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0211.684] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280692\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280692\\temporaryfile")) returned 1 [0211.684] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x831f04e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x831f04e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x831f04e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0211.685] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0211.685] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280692" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280692")) returned 1 [0211.685] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 0 [0211.721] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.722] WriteFile (in: hFile=0xe0, lpBuffer=0x2810028*, nNumberOfBytesToWrite=0xd2998, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2810028*, lpNumberOfBytesWritten=0x18fdb8*=0xd2998, lpOverlapped=0x0) returned 1 [0211.737] CloseHandle (hObject=0xe0) returned 1 [0211.744] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.745] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x19a3ff [0211.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19a407) returned 0x2650020 [0211.745] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x19a3ff, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x19a3ff, lpOverlapped=0x0) returned 1 [0211.794] CloseHandle (hObject=0xe0) returned 1 [0211.794] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm")) returned 1 [0211.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0211.799] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0211.799] GetTickCount () returned 0x448e1 [0211.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0211.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0211.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0211.800] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280801\\...."), lpSecurityAttributes=0x256228) returned 1 [0211.800] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280801\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280801\\....\\temporaryfile")) returned 0 [0211.801] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280801\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280801\\temporaryfile")) returned 1 [0211.802] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280801\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x832fae80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x832fae80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x832fae80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0211.802] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x832fae80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x832fae80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x832fae80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.802] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x832fae80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x832fae80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x832fae80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0211.802] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280801\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x832fae80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x832fae80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x832fae80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0211.802] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x832fae80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x832fae80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x832fae80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.802] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x832fae80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x832fae80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x832fae80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.802] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0211.802] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280801\\temporaryfile")) returned 1 [0211.802] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x832fae80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x832fae80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x832fae80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0211.802] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0211.803] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280801" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280801")) returned 1 [0211.803] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 0 [0211.870] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.871] WriteFile (in: hFile=0xe0, lpBuffer=0x2990028*, nNumberOfBytesToWrite=0x19a408, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2990028*, lpNumberOfBytesWritten=0x18fdb8*=0x19a408, lpOverlapped=0x0) returned 1 [0211.906] CloseHandle (hObject=0xe0) returned 1 [0211.920] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.921] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x25b50 [0211.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25b58) returned 0x2a0a70 [0211.922] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x25b50, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x25b50, lpOverlapped=0x0) returned 1 [0211.925] CloseHandle (hObject=0xe0) returned 1 [0211.925] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0211.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0211.927] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0211.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0211.927] GetTickCount () returned 0x4495e [0211.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0211.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0211.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0211.927] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280926\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280926\\...."), lpSecurityAttributes=0x256210) returned 1 [0211.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280926\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280926\\....\\temporaryfile")) returned 0 [0211.928] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280926\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280926\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280926\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280926\\temporaryfile")) returned 1 [0211.929] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280926\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342b980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8342b980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8342b980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0211.929] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342b980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8342b980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8342b980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.929] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342b980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8342b980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8342b980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0211.929] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280926\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342b980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8342b980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8342b980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0211.929] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342b980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8342b980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8342b980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.929] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342b980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8342b980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8342b980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.929] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0211.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280926\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280926\\temporaryfile")) returned 1 [0211.930] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342b980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8342b980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8342b980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0211.930] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0211.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18280926" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18280926")) returned 1 [0211.930] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 0 [0211.934] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.934] WriteFile (in: hFile=0xe0, lpBuffer=0x2c65d8*, nNumberOfBytesToWrite=0x25b58, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c65d8*, lpNumberOfBytesWritten=0x18fdb8*=0x25b58, lpOverlapped=0x0) returned 1 [0211.937] CloseHandle (hObject=0xe0) returned 1 [0211.937] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0211.938] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x269380 [0211.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x269388) returned 0x2650020 [0211.938] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x269380, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x269380, lpOverlapped=0x0) returned 1 [0212.022] CloseHandle (hObject=0xe0) returned 1 [0212.022] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 1 [0212.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0212.026] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0212.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0212.026] GetTickCount () returned 0x449cb [0212.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0212.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0212.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0212.027] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281035\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281035\\...."), lpSecurityAttributes=0x256228) returned 1 [0212.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281035\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281035\\....\\temporaryfile")) returned 0 [0212.028] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281035\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281035\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281035\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281035\\temporaryfile")) returned 1 [0212.029] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281035\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83536320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83536320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83536320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0212.029] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83536320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83536320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83536320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.029] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83536320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83536320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83536320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0212.029] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281035\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83536320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83536320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83536320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0212.029] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83536320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83536320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83536320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.029] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83536320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83536320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83536320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0212.029] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0212.029] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281035\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281035\\temporaryfile")) returned 1 [0212.029] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83536320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83536320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83536320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0212.029] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0212.030] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281035" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281035")) returned 1 [0212.030] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 0 [0212.142] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.143] WriteFile (in: hFile=0xe0, lpBuffer=0x2b30028*, nNumberOfBytesToWrite=0x269388, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b30028*, lpNumberOfBytesWritten=0x18fdb8*=0x269388, lpOverlapped=0x0) returned 1 [0212.193] CloseHandle (hObject=0xe0) returned 1 [0212.215] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.215] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd980 [0212.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd988) returned 0x2a0a70 [0212.216] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xd980, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0xd980, lpOverlapped=0x0) returned 1 [0212.217] CloseHandle (hObject=0xe0) returned 1 [0212.217] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0212.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0212.218] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0212.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0212.218] GetTickCount () returned 0x44a87 [0212.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0212.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0212.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0212.219] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281223\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281223\\...."), lpSecurityAttributes=0x256210) returned 1 [0212.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281223\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281223\\....\\temporaryfile")) returned 0 [0212.219] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281223\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281223\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281223\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281223\\temporaryfile")) returned 1 [0212.221] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281223\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ff3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x836ff3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x836ff3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0212.221] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ff3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x836ff3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x836ff3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.221] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ff3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x836ff3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x836ff3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0212.221] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281223\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ff3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x836ff3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x836ff3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0212.221] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ff3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x836ff3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x836ff3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.221] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ff3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x836ff3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x836ff3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0212.221] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0212.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281223\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281223\\temporaryfile")) returned 1 [0212.221] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ff3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x836ff3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x836ff3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0212.221] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0212.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281223" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281223")) returned 1 [0212.222] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 0 [0212.223] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.223] WriteFile (in: hFile=0xe0, lpBuffer=0x2ae408*, nNumberOfBytesToWrite=0xd988, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ae408*, lpNumberOfBytesWritten=0x18fdb8*=0xd988, lpOverlapped=0x0) returned 1 [0212.225] CloseHandle (hObject=0xe0) returned 1 [0212.225] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.226] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x152f80 [0212.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x152f88) returned 0x2650020 [0212.226] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x152f80, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x152f80, lpOverlapped=0x0) returned 1 [0212.259] CloseHandle (hObject=0xe0) returned 1 [0212.259] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1 [0212.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0212.262] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0212.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0212.262] GetTickCount () returned 0x44ab5 [0212.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0212.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0212.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0212.263] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281269\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281269\\...."), lpSecurityAttributes=0x256210) returned 1 [0212.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281269\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281269\\....\\temporaryfile")) returned 0 [0212.263] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281269\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281269\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281269\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281269\\temporaryfile")) returned 1 [0212.264] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281269\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x837717c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x837717c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x837717c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0212.264] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x837717c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x837717c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x837717c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.265] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x837717c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x837717c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x837717c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0212.265] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281269\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x837717c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x837717c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x837717c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0212.265] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x837717c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x837717c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x837717c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.265] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x837717c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x837717c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x837717c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0212.265] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0212.265] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281269\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281269\\temporaryfile")) returned 1 [0212.265] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x837717c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x837717c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x837717c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0212.265] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0212.265] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281269" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281269")) returned 1 [0212.265] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 0 [0212.333] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.334] WriteFile (in: hFile=0xe0, lpBuffer=0x2910028*, nNumberOfBytesToWrite=0x152f88, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2910028*, lpNumberOfBytesWritten=0x18fdb8*=0x152f88, lpOverlapped=0x0) returned 1 [0212.355] CloseHandle (hObject=0xe0) returned 1 [0212.367] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.368] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa388 [0212.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa390) returned 0x2a0a70 [0212.368] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xa388, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0xa388, lpOverlapped=0x0) returned 1 [0212.370] CloseHandle (hObject=0xe0) returned 1 [0212.370] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1 [0212.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0212.371] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0212.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0212.371] GetTickCount () returned 0x44b23 [0212.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0212.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0212.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0212.371] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379\\...."), lpSecurityAttributes=0x256228) returned 1 [0212.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379\\....\\temporaryfile")) returned 0 [0212.372] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379\\temporaryfile")) returned 1 [0212.373] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0212.373] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.373] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0212.373] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0212.373] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.373] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0212.373] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0212.373] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379\\temporaryfile")) returned 1 [0212.374] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0212.374] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0212.374] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379")) returned 1 [0212.374] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 0 [0212.375] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.375] WriteFile (in: hFile=0xe0, lpBuffer=0x2aae10*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2aae10*, lpNumberOfBytesWritten=0x18fdb8*=0xa390, lpOverlapped=0x0) returned 1 [0212.376] CloseHandle (hObject=0xe0) returned 1 [0212.377] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.377] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2d88 [0212.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d90) returned 0x297460 [0212.377] ReadFile (in: hFile=0xe0, lpBuffer=0x297468, nNumberOfBytesToRead=0x2d88, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdd0*=0x2d88, lpOverlapped=0x0) returned 1 [0212.379] CloseHandle (hObject=0xe0) returned 1 [0212.379] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0212.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0212.380] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0212.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0212.380] GetTickCount () returned 0x44b23 [0212.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0212.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0212.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0212.380] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379\\...."), lpSecurityAttributes=0x256210) returned 1 [0212.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379\\....\\temporaryfile")) returned 0 [0212.386] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379\\temporaryfile")) returned 1 [0212.387] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838a22c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838a22c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0212.387] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838a22c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838a22c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.387] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0212.387] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0212.387] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.388] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0212.388] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0212.388] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379\\temporaryfile")) returned 1 [0212.388] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8387c160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8387c160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8387c160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0212.388] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0212.388] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281379" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281379")) returned 1 [0212.388] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 0 [0212.388] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.389] WriteFile (in: hFile=0xe0, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdb8*=0x2d90, lpOverlapped=0x0) returned 1 [0212.390] CloseHandle (hObject=0xe0) returned 1 [0212.392] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.393] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x795 [0212.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x79d) returned 0x2649f0 [0212.393] ReadFile (in: hFile=0xe0, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x795, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdd0*=0x795, lpOverlapped=0x0) returned 1 [0212.394] CloseHandle (hObject=0xe0) returned 1 [0212.394] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0212.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0212.395] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0212.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0212.395] GetTickCount () returned 0x44b32 [0212.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0212.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0212.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0212.396] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281394\\...."), lpSecurityAttributes=0x256228) returned 1 [0212.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281394\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281394\\....\\temporaryfile")) returned 0 [0212.396] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281394\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281394\\temporaryfile")) returned 1 [0212.397] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281394\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838a22c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838a22c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838a22c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0212.397] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838a22c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838a22c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838a22c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.398] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838a22c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838a22c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838a22c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0212.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281394\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838a22c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838a22c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838a22c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0212.398] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838a22c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838a22c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838a22c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.398] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838a22c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838a22c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838a22c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0212.398] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0212.398] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281394\\temporaryfile")) returned 1 [0212.398] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838a22c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838a22c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838a22c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0212.398] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0212.398] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281394" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281394")) returned 1 [0212.398] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 0 [0212.398] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.399] WriteFile (in: hFile=0xe0, lpBuffer=0x2651a0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2651a0*, lpNumberOfBytesWritten=0x18fdb8*=0x7a0, lpOverlapped=0x0) returned 1 [0212.400] CloseHandle (hObject=0xe0) returned 1 [0212.400] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.401] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x19b80 [0212.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19b88) returned 0x2a0a70 [0212.402] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x19b80, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0x19b80, lpOverlapped=0x0) returned 1 [0212.405] CloseHandle (hObject=0xe0) returned 1 [0212.405] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0212.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0212.406] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0212.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0212.406] GetTickCount () returned 0x44b42 [0212.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0212.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0212.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0212.407] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281410\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281410\\...."), lpSecurityAttributes=0x256210) returned 1 [0212.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281410\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281410\\....\\temporaryfile")) returned 0 [0212.407] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281410\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281410\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281410\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281410\\temporaryfile")) returned 1 [0212.408] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281410\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838c8420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838c8420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838c8420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0212.408] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838c8420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838c8420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838c8420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.408] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838c8420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838c8420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838c8420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0212.408] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281410\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838c8420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838c8420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838c8420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0212.408] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838c8420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838c8420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838c8420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.408] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838c8420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838c8420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838c8420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0212.408] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0212.408] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281410\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281410\\temporaryfile")) returned 1 [0212.409] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x838c8420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x838c8420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838c8420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0212.409] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0212.409] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281410" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281410")) returned 1 [0212.409] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 0 [0212.412] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.412] WriteFile (in: hFile=0xe0, lpBuffer=0x2ba608*, nNumberOfBytesToWrite=0x19b88, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ba608*, lpNumberOfBytesWritten=0x18fdb8*=0x19b88, lpOverlapped=0x0) returned 1 [0212.414] CloseHandle (hObject=0xe0) returned 1 [0212.414] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0212.414] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x838c8420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x838c8420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0212.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0212.415] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0212.415] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xceefecc0, dwReserved1=0x1d305eb, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0212.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xceefecc0, dwReserved1=0x1d305eb, cFileName="..", cAlternateFileName="")) returned 1 [0212.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0xceefecc0, dwReserved1=0x1d305eb, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0212.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256210 [0212.415] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.415] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x419360 [0212.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x419368) returned 0x2650020 [0212.416] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x419360, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x419360, lpOverlapped=0x0) returned 1 [0212.532] CloseHandle (hObject=0xe0) returned 1 [0212.532] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0 [0212.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0212.532] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0212.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0212.532] GetTickCount () returned 0x44bbf [0212.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0212.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0212.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0212.533] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281535\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281535\\...."), lpSecurityAttributes=0x256198) returned 1 [0212.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281535\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281535\\....\\temporaryfile")) returned 1 [0212.534] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281535\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281535\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281535\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281535\\temporaryfile")) returned 1 [0212.535] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281535\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x839f8f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x839f8f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x839f8f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0212.535] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x839f8f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x839f8f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x839f8f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0212.535] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x839f8f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x839f8f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x839f8f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0212.535] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281535\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x839f8f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x839f8f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x839f8f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0212.536] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x839f8f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x839f8f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x839f8f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.536] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0212.536] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281535\\TemporaryFile\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281535\\temporaryfile\\temporaryfile")) returned 0 [0212.536] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0212.536] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0212.536] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 0 [0212.738] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.739] WriteFile (in: hFile=0xe0, lpBuffer=0x2e90028*, nNumberOfBytesToWrite=0x419368, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2e90028*, lpNumberOfBytesWritten=0x18fdb8*=0x419368, lpOverlapped=0x0) returned 1 [0212.819] CloseHandle (hObject=0xe0) returned 1 [0212.856] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0212.856] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83be8100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83be8100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0212.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0212.856] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0212.857] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0212.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0212.859] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0212.859] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0212.859] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0212.859] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0212.859] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0212.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0212.859] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.859] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8b7b8 [0212.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8b7c0) returned 0x1d70020 [0212.860] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x8b7b8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0x8b7b8, lpOverlapped=0x0) returned 1 [0212.871] CloseHandle (hObject=0xe0) returned 1 [0212.871] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 1 [0212.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0212.876] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0212.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0212.876] GetTickCount () returned 0x44d16 [0212.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0212.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0212.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0212.877] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281878\\...."), lpSecurityAttributes=0x256210) returned 1 [0212.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281878\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281878\\....\\temporaryfile")) returned 0 [0212.878] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281878\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281878\\temporaryfile")) returned 1 [0212.879] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281878\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83d3ed60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83d3ed60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83d3ed60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcef24e20, dwReserved1=0x16, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0212.880] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83d3ed60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83d3ed60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83d3ed60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcef24e20, dwReserved1=0x16, cFileName="..", cAlternateFileName="")) returned 1 [0212.880] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83d3ed60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83d3ed60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83d3ed60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcef24e20, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0212.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281878\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83d3ed60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83d3ed60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83d3ed60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0212.880] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83d3ed60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83d3ed60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83d3ed60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.880] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83d3ed60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83d3ed60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83d3ed60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0212.880] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0212.880] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281878\\temporaryfile")) returned 1 [0212.880] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83d3ed60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83d3ed60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83d3ed60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcef24e20, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0212.880] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0212.880] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18281878" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18281878")) returned 1 [0212.880] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 0 [0212.915] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.916] WriteFile (in: hFile=0xe0, lpBuffer=0x26e0028*, nNumberOfBytesToWrite=0x8b7c0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x26e0028*, lpNumberOfBytesWritten=0x18fdb8*=0x8b7c0, lpOverlapped=0x0) returned 1 [0212.925] CloseHandle (hObject=0xe0) returned 1 [0212.930] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0212.931] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x709b68 [0212.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x709b70) returned 0x2650020 [0212.932] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x709b68, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x709b68, lpOverlapped=0x0) returned 1 [0213.134] CloseHandle (hObject=0xe0) returned 1 [0213.134] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 1 [0213.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0213.136] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0213.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0213.136] GetTickCount () returned 0x44e1f [0213.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0213.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0213.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0213.137] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282143\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282143\\...."), lpSecurityAttributes=0x256228) returned 1 [0213.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282143\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282143\\....\\temporaryfile")) returned 0 [0213.137] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282143\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282143\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282143\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282143\\temporaryfile")) returned 1 [0213.138] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282143\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83fc64c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83fc64c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83fc64c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0213.138] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83fc64c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83fc64c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83fc64c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.139] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83fc64c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83fc64c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83fc64c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0213.139] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282143\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83fc64c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83fc64c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83fc64c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0213.139] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83fc64c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83fc64c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83fc64c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.139] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83fc64c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83fc64c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83fc64c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0213.139] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0213.139] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282143\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282143\\temporaryfile")) returned 1 [0213.139] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83fc64c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x83fc64c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x83fc64c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0213.139] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0213.139] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282143" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282143")) returned 1 [0213.139] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 0 [0213.475] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0213.476] WriteFile (in: hFile=0xe0, lpBuffer=0x3470028*, nNumberOfBytesToWrite=0x709b70, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3470028*, lpNumberOfBytesWritten=0x18fdb8*=0x709b70, lpOverlapped=0x0) returned 1 [0213.617] CloseHandle (hObject=0xe0) returned 1 [0213.676] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0213.677] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb9a0 [0213.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb9a8) returned 0x2a0a70 [0213.677] ReadFile (in: hFile=0xe0, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0xb9a0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdd0*=0xb9a0, lpOverlapped=0x0) returned 1 [0213.679] CloseHandle (hObject=0xe0) returned 1 [0213.679] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 1 [0213.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0213.680] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0213.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0213.680] GetTickCount () returned 0x45041 [0213.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0213.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0213.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0213.681] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282689\\...."), lpSecurityAttributes=0x256210) returned 1 [0213.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282689\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282689\\....\\temporaryfile")) returned 0 [0213.681] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282689\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282689\\temporaryfile")) returned 1 [0213.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282689\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844fb4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x844fb4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x844fb4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0213.683] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844fb4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x844fb4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x844fb4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.683] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844fb4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x844fb4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x844fb4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0213.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282689\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844fb4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x844fb4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x844fb4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0213.683] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844fb4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x844fb4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x844fb4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.683] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844fb4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x844fb4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x844fb4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0213.683] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0213.683] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282689\\temporaryfile")) returned 1 [0213.683] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844fb4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x844fb4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x844fb4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0213.683] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0213.683] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282689" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282689")) returned 1 [0213.683] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 0 [0213.684] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0213.685] WriteFile (in: hFile=0xe0, lpBuffer=0x2ac428*, nNumberOfBytesToWrite=0xb9a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ac428*, lpNumberOfBytesWritten=0x18fdb8*=0xb9a8, lpOverlapped=0x0) returned 1 [0213.686] CloseHandle (hObject=0xe0) returned 1 [0213.686] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0213.689] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x165510 [0213.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x165518) returned 0x2650020 [0213.689] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x165510, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x165510, lpOverlapped=0x0) returned 1 [0213.738] CloseHandle (hObject=0xe0) returned 1 [0213.738] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 1 [0213.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0213.742] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0213.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0213.742] GetTickCount () returned 0x4507f [0213.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0213.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0213.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0213.743] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282751\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282751\\...."), lpSecurityAttributes=0x256228) returned 1 [0213.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282751\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282751\\....\\temporaryfile")) returned 0 [0213.743] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282751\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282751\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282751\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282751\\temporaryfile")) returned 1 [0213.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282751\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84593a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84593a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84593a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0213.744] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84593a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84593a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84593a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.744] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84593a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84593a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84593a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0213.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282751\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84593a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84593a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84593a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0213.745] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84593a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84593a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84593a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.745] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84593a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84593a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84593a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0213.745] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0213.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282751\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282751\\temporaryfile")) returned 1 [0213.745] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84593a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84593a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84593a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0213.745] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0213.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282751" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282751")) returned 1 [0213.745] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 0 [0213.806] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0213.807] WriteFile (in: hFile=0xe0, lpBuffer=0x2930028*, nNumberOfBytesToWrite=0x165518, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2930028*, lpNumberOfBytesWritten=0x18fdb8*=0x165518, lpOverlapped=0x0) returned 1 [0213.841] CloseHandle (hObject=0xe0) returned 1 [0213.853] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0213.855] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xaec3a [0213.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaec42) returned 0x1d70020 [0213.855] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xaec3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0xaec3a, lpOverlapped=0x0) returned 1 [0213.868] CloseHandle (hObject=0xe0) returned 1 [0213.868] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0213.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0213.874] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0213.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0213.874] GetTickCount () returned 0x450fc [0213.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0213.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0213.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0213.875] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282876\\...."), lpSecurityAttributes=0x256210) returned 1 [0213.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282876\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282876\\....\\temporaryfile")) returned 0 [0213.875] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282876\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282876\\temporaryfile")) returned 1 [0213.877] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282876\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x846c4560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x846c4560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x846c4560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0213.877] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x846c4560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x846c4560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x846c4560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.877] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x846c4560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x846c4560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x846c4560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0213.877] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282876\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x846c4560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x846c4560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x846c4560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0213.877] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x846c4560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x846c4560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x846c4560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.877] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x846c4560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x846c4560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x846c4560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0213.877] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0213.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282876\\temporaryfile")) returned 1 [0213.877] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x846c4560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x846c4560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x846c4560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0213.877] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0213.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282876" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282876")) returned 1 [0213.878] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 0 [0213.907] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0213.908] WriteFile (in: hFile=0xe0, lpBuffer=0x2700028*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2700028*, lpNumberOfBytesWritten=0x18fdb8*=0xaec40, lpOverlapped=0x0) returned 1 [0213.918] CloseHandle (hObject=0xe0) returned 1 [0213.924] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0213.924] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3d78 [0213.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d80) returned 0x297460 [0213.924] ReadFile (in: hFile=0xe0, lpBuffer=0x297468, nNumberOfBytesToRead=0x3d78, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x297468*, lpNumberOfBytesRead=0x18fdd0*=0x3d78, lpOverlapped=0x0) returned 1 [0213.926] CloseHandle (hObject=0xe0) returned 1 [0213.926] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0213.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0213.927] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0213.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0213.927] GetTickCount () returned 0x4513b [0213.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0213.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0213.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0213.928] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282939\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282939\\...."), lpSecurityAttributes=0x256210) returned 1 [0213.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282939\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282939\\....\\temporaryfile")) returned 0 [0213.928] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282939\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282939\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282939\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282939\\temporaryfile")) returned 1 [0213.929] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282939\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8475cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8475cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8475cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0213.930] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8475cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8475cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8475cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.930] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8475cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8475cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8475cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0213.930] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282939\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8475cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8475cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8475cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0213.930] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8475cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8475cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8475cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.930] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8475cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8475cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8475cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0213.930] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0213.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282939\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282939\\temporaryfile")) returned 1 [0213.930] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8475cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8475cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8475cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0213.930] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0213.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282939" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282939")) returned 1 [0213.930] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 0 [0213.931] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0213.931] WriteFile (in: hFile=0xe0, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fdb8*=0x3d80, lpOverlapped=0x0) returned 1 [0213.932] CloseHandle (hObject=0xe0) returned 1 [0213.934] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0213.935] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x150378 [0213.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x150380) returned 0x2650020 [0213.935] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x150378, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x150378, lpOverlapped=0x0) returned 1 [0213.978] CloseHandle (hObject=0xe0) returned 1 [0213.978] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 1 [0213.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0213.981] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0213.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0213.981] GetTickCount () returned 0x45169 [0213.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0213.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0213.982] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0213.982] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282985\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282985\\...."), lpSecurityAttributes=0x256228) returned 1 [0213.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282985\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282985\\....\\temporaryfile")) returned 0 [0213.982] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282985\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282985\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282985\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282985\\temporaryfile")) returned 1 [0213.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282985\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x847cef00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x847cef00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x847cef00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0213.983] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x847cef00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x847cef00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x847cef00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.983] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x847cef00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x847cef00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x847cef00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0213.984] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282985\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x847cef00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x847cef00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x847cef00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0213.984] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x847cef00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x847cef00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x847cef00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.984] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x847cef00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x847cef00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x847cef00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0213.984] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0213.984] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282985\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282985\\temporaryfile")) returned 1 [0213.984] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x847cef00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x847cef00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x847cef00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0213.984] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0213.984] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18282985" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18282985")) returned 1 [0213.984] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 0 [0214.072] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0214.073] WriteFile (in: hFile=0xe0, lpBuffer=0x2910028*, nNumberOfBytesToWrite=0x150380, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2910028*, lpNumberOfBytesWritten=0x18fdb8*=0x150380, lpOverlapped=0x0) returned 1 [0214.094] CloseHandle (hObject=0xe0) returned 1 [0214.106] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0214.106] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x848b3740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x848b3740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0214.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0214.106] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15419830, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.109] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15419830, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.109] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x15419830, dwReserved1=0x1d301bf, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0214.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x256228 [0214.109] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.109] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x545 [0214.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54d) returned 0x259e70 [0214.109] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x545, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x545, lpOverlapped=0x0) returned 1 [0214.111] CloseHandle (hObject=0xe4) returned 1 [0214.111] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0214.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.112] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.112] GetTickCount () returned 0x451e6 [0214.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.112] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283110\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283110\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283110\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283110\\....\\temporaryfile")) returned 0 [0214.113] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283110\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283110\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283110\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283110\\temporaryfile")) returned 1 [0214.114] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283110\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x848ffa00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84925b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84925b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.114] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x848ffa00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84925b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84925b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.114] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x848ffa00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x848ffa00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x848ffa00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.114] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283110\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x848ffa00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x848ffa00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x848ffa00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.114] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x848ffa00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x848ffa00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x848ffa00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.114] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x848ffa00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x848ffa00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x848ffa00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.114] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283110\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283110\\temporaryfile")) returned 1 [0214.115] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x848ffa00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x848ffa00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x848ffa00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.115] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283110" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283110")) returned 1 [0214.115] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 0 [0214.115] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.116] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x550, lpOverlapped=0x0) returned 1 [0214.116] CloseHandle (hObject=0xe4) returned 1 [0214.117] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.118] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x333 [0214.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x33b) returned 0x259e70 [0214.118] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x333, lpOverlapped=0x0) returned 1 [0214.119] CloseHandle (hObject=0xe4) returned 1 [0214.119] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0214.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.120] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.120] GetTickCount () returned 0x451f6 [0214.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0214.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.120] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126\\....\\temporaryfile")) returned 0 [0214.121] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126\\temporaryfile")) returned 1 [0214.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84925b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84925b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84925b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.122] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84925b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84925b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84925b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.122] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84925b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84925b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84925b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84925b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84925b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84925b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.122] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84925b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84925b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84925b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.123] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84925b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84925b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84925b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.123] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.123] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126\\temporaryfile")) returned 1 [0214.123] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84925b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84925b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84925b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.123] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.123] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126")) returned 1 [0214.123] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 0 [0214.123] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.124] WriteFile (in: hFile=0xe4, lpBuffer=0x25a1c0*, nNumberOfBytesToWrite=0x338, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25a1c0*, lpNumberOfBytesWritten=0x18fd98*=0x338, lpOverlapped=0x0) returned 1 [0214.125] CloseHandle (hObject=0xe4) returned 1 [0214.125] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.126] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xa40 [0214.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa48) returned 0x2649f0 [0214.126] ReadFile (in: hFile=0xe4, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdb0*=0xa40, lpOverlapped=0x0) returned 1 [0214.127] CloseHandle (hObject=0xe4) returned 1 [0214.127] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0214.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.128] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.128] GetTickCount () returned 0x451f6 [0214.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.129] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126\\....\\temporaryfile")) returned 0 [0214.129] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126\\temporaryfile")) returned 1 [0214.130] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84925b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.130] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84925b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.131] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.131] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.131] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.131] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.131] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.131] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126\\temporaryfile")) returned 1 [0214.131] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.131] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.131] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283126" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283126")) returned 1 [0214.131] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 0 [0214.131] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.132] WriteFile (in: hFile=0xe4, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa48, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fd98*=0xa48, lpOverlapped=0x0) returned 1 [0214.133] CloseHandle (hObject=0xe4) returned 1 [0214.133] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.133] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0214.133] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.133] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa64b3d0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.133] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa64b3d0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0214.134] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0xfa64b3d0, dwReserved1=0x1d301be, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0214.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0214.134] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.134] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x61d [0214.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x625) returned 0x259e70 [0214.134] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x61d, lpOverlapped=0x0) returned 1 [0214.136] CloseHandle (hObject=0xe4) returned 1 [0214.136] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0214.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.136] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.136] GetTickCount () returned 0x45205 [0214.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.137] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283141\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283141\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283141\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283141\\....\\temporaryfile")) returned 0 [0214.138] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283141\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283141\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283141\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283141\\temporaryfile")) returned 1 [0214.154] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283141\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84971e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84971e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.154] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84971e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84971e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.154] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.154] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283141\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.154] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.154] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.154] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.154] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283141\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283141\\temporaryfile")) returned 1 [0214.155] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8494bcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8494bcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8494bcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.155] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.155] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283141" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283141")) returned 1 [0214.155] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 0 [0214.155] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.156] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x628, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x628, lpOverlapped=0x0) returned 1 [0214.157] CloseHandle (hObject=0xe4) returned 1 [0214.157] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.158] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x8f8 [0214.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x900) returned 0x2649f0 [0214.158] ReadFile (in: hFile=0xe4, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdb0*=0x8f8, lpOverlapped=0x0) returned 1 [0214.160] CloseHandle (hObject=0xe4) returned 1 [0214.160] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0214.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.161] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.161] GetTickCount () returned 0x45225 [0214.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.161] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173\\....\\temporaryfile")) returned 0 [0214.162] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173\\temporaryfile")) returned 1 [0214.162] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.163] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.163] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.163] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.163] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.163] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.163] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173\\temporaryfile")) returned 1 [0214.163] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.163] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173")) returned 1 [0214.163] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 0 [0214.164] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.164] WriteFile (in: hFile=0xe4, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fd98*=0x900, lpOverlapped=0x0) returned 1 [0214.165] CloseHandle (hObject=0xe4) returned 1 [0214.165] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.165] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0214.165] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.165] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd658ff0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.166] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd658ff0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0214.166] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0xfd658ff0, dwReserved1=0x1d301be, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0214.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x256228 [0214.166] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.167] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x391 [0214.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x399) returned 0x259e70 [0214.167] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x391, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x391, lpOverlapped=0x0) returned 1 [0214.168] CloseHandle (hObject=0xe4) returned 1 [0214.168] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0214.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.169] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.169] GetTickCount () returned 0x45225 [0214.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.170] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173\\....\\temporaryfile")) returned 0 [0214.170] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173\\temporaryfile")) returned 1 [0214.171] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.171] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.171] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.172] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.172] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.172] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.172] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.172] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173\\temporaryfile")) returned 1 [0214.172] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84997f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84997f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84997f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.172] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.172] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283173" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283173")) returned 1 [0214.172] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 0 [0214.172] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.173] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x398, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x398, lpOverlapped=0x0) returned 1 [0214.174] CloseHandle (hObject=0xe4) returned 1 [0214.174] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.175] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x5ac [0214.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b4) returned 0x259e70 [0214.175] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x5ac, lpOverlapped=0x0) returned 1 [0214.176] CloseHandle (hObject=0xe4) returned 1 [0214.176] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0214.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.177] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.177] GetTickCount () returned 0x45234 [0214.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.178] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188\\....\\temporaryfile")) returned 0 [0214.178] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188\\temporaryfile")) returned 1 [0214.179] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.179] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.179] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.179] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.179] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.179] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.179] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.179] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188\\temporaryfile")) returned 1 [0214.180] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.180] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.180] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188")) returned 1 [0214.180] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 0 [0214.180] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.181] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x5b0, lpOverlapped=0x0) returned 1 [0214.181] CloseHandle (hObject=0xe4) returned 1 [0214.182] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.182] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0214.182] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.182] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x112a3b30, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.183] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x112a3b30, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.183] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x112a3b30, dwReserved1=0x1d301bf, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0214.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x256198 [0214.183] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.183] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x4cf [0214.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4d7) returned 0x259e70 [0214.184] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4cf, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x4cf, lpOverlapped=0x0) returned 1 [0214.185] CloseHandle (hObject=0xe4) returned 1 [0214.185] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0214.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.186] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.186] GetTickCount () returned 0x45234 [0214.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.186] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188\\....\\temporaryfile")) returned 0 [0214.187] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188\\temporaryfile")) returned 1 [0214.188] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.188] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.188] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.188] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.188] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.188] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.188] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.188] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188\\temporaryfile")) returned 1 [0214.188] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849be0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849be0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849be0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.188] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.189] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283188" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283188")) returned 1 [0214.189] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 0 [0214.189] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.190] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x4d8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x4d8, lpOverlapped=0x0) returned 1 [0214.190] CloseHandle (hObject=0xe4) returned 1 [0214.191] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.191] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x73c [0214.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x744) returned 0x2649f0 [0214.191] ReadFile (in: hFile=0xe4, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x73c, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdb0*=0x73c, lpOverlapped=0x0) returned 1 [0214.193] CloseHandle (hObject=0xe4) returned 1 [0214.193] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0214.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.194] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.194] GetTickCount () returned 0x45244 [0214.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.194] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204\\....\\temporaryfile")) returned 0 [0214.195] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204\\temporaryfile")) returned 1 [0214.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.196] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.196] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.196] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.196] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.196] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.196] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.196] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204\\temporaryfile")) returned 1 [0214.196] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.196] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.196] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204")) returned 1 [0214.196] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 0 [0214.197] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.197] WriteFile (in: hFile=0xe4, lpBuffer=0x265148*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x265148*, lpNumberOfBytesWritten=0x18fd98*=0x740, lpOverlapped=0x0) returned 1 [0214.198] CloseHandle (hObject=0xe4) returned 1 [0214.198] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.198] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0214.198] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.198] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.200] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0214.200] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0214.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0214.200] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.201] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x3b78 [0214.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3b80) returned 0x2a0a70 [0214.202] ReadFile (in: hFile=0xe4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x3b78, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdb0*=0x3b78, lpOverlapped=0x0) returned 1 [0214.203] CloseHandle (hObject=0xe4) returned 1 [0214.204] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 1 [0214.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.204] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.205] GetTickCount () returned 0x45244 [0214.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.205] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.206] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204\\....\\temporaryfile")) returned 0 [0214.206] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204\\temporaryfile")) returned 1 [0214.207] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.207] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.207] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.207] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.207] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.207] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.207] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.207] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204\\temporaryfile")) returned 1 [0214.207] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x849e4240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x849e4240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x849e4240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.207] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.207] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283204" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283204")) returned 1 [0214.208] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 0 [0214.208] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.209] WriteFile (in: hFile=0xe4, lpBuffer=0x2a4600*, nNumberOfBytesToWrite=0x3b80, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a4600*, lpNumberOfBytesWritten=0x18fd98*=0x3b80, lpOverlapped=0x0) returned 1 [0214.210] CloseHandle (hObject=0xe4) returned 1 [0214.210] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.211] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x91975 [0214.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9197d) returned 0x1d70020 [0214.211] ReadFile (in: hFile=0xe4, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x91975, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdb0*=0x91975, lpOverlapped=0x0) returned 1 [0214.222] CloseHandle (hObject=0xe4) returned 1 [0214.222] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0214.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.228] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.228] GetTickCount () returned 0x45263 [0214.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.228] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283235\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283235\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283235\\....\\temporaryfile")) returned 0 [0214.229] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283235\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283235\\temporaryfile")) returned 1 [0214.230] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283235\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84a30500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84a30500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84a30500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.230] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84a30500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84a30500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84a30500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.230] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84a30500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84a30500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84a30500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.230] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283235\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84a30500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84a30500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84a30500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.230] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84a30500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84a30500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84a30500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.230] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84a30500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84a30500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84a30500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.230] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.230] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283235\\temporaryfile")) returned 1 [0214.230] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84a30500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84a30500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84a30500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.230] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.230] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283235" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283235")) returned 1 [0214.231] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 0 [0214.256] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.257] WriteFile (in: hFile=0xe4, lpBuffer=0x26f0028*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x26f0028*, lpNumberOfBytesWritten=0x18fd98*=0x91980, lpOverlapped=0x0) returned 1 [0214.266] CloseHandle (hObject=0xe4) returned 1 [0214.272] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.273] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x11644 [0214.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1164c) returned 0x2a0a70 [0214.273] ReadFile (in: hFile=0xe4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x11644, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdb0*=0x11644, lpOverlapped=0x0) returned 1 [0214.275] CloseHandle (hObject=0xe4) returned 1 [0214.275] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0214.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.276] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.276] GetTickCount () returned 0x45292 [0214.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0214.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.277] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283282\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283282\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.277] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283282\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283282\\....\\temporaryfile")) returned 0 [0214.277] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283282\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283282\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283282\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283282\\temporaryfile")) returned 1 [0214.278] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283282\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aa2920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aa2920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aa2920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.278] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aa2920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aa2920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aa2920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.278] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aa2920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aa2920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aa2920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.278] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283282\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aa2920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aa2920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aa2920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.279] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aa2920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aa2920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aa2920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.279] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aa2920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aa2920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aa2920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.279] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.279] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283282\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283282\\temporaryfile")) returned 1 [0214.279] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aa2920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aa2920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aa2920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.279] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.279] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283282" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283282")) returned 1 [0214.279] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 0 [0214.283] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.284] WriteFile (in: hFile=0xe4, lpBuffer=0x2b20d0*, nNumberOfBytesToWrite=0x11648, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2b20d0*, lpNumberOfBytesWritten=0x18fd98*=0x11648, lpOverlapped=0x0) returned 1 [0214.286] CloseHandle (hObject=0xe4) returned 1 [0214.286] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.286] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x15b5 [0214.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15bd) returned 0x299460 [0214.286] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x15b5, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x15b5, lpOverlapped=0x0) returned 1 [0214.288] CloseHandle (hObject=0xe4) returned 1 [0214.288] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0214.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.289] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.289] GetTickCount () returned 0x452a1 [0214.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.289] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.290] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297\\....\\temporaryfile")) returned 0 [0214.290] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297\\temporaryfile")) returned 1 [0214.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.291] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.291] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.291] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.291] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.291] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297\\temporaryfile")) returned 1 [0214.291] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.292] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.292] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297")) returned 1 [0214.292] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 0 [0214.292] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.293] WriteFile (in: hFile=0xe4, lpBuffer=0x29aa30*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x29aa30*, lpNumberOfBytesWritten=0x18fd98*=0x15c0, lpOverlapped=0x0) returned 1 [0214.293] CloseHandle (hObject=0xe4) returned 1 [0214.294] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.294] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x333 [0214.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x33b) returned 0x259e70 [0214.294] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x333, lpOverlapped=0x0) returned 1 [0214.295] CloseHandle (hObject=0xe4) returned 1 [0214.295] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0214.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.296] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.296] GetTickCount () returned 0x452a1 [0214.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0214.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.297] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297\\....\\temporaryfile")) returned 0 [0214.298] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297\\temporaryfile")) returned 1 [0214.299] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.299] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.299] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.299] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.299] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.299] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.299] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.299] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297\\temporaryfile")) returned 1 [0214.299] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ac8a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ac8a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ac8a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.299] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.299] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283297" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283297")) returned 1 [0214.299] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 0 [0214.300] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.300] WriteFile (in: hFile=0xe4, lpBuffer=0x25a1c0*, nNumberOfBytesToWrite=0x338, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25a1c0*, lpNumberOfBytesWritten=0x18fd98*=0x338, lpOverlapped=0x0) returned 1 [0214.301] CloseHandle (hObject=0xe4) returned 1 [0214.301] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.302] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2ed80 [0214.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ed88) returned 0x2a0a70 [0214.302] ReadFile (in: hFile=0xe4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x2ed80, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdb0*=0x2ed80, lpOverlapped=0x0) returned 1 [0214.305] CloseHandle (hObject=0xe4) returned 1 [0214.305] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 1 [0214.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.307] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.307] GetTickCount () returned 0x452b1 [0214.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.307] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283313\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283313\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283313\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283313\\....\\temporaryfile")) returned 0 [0214.308] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283313\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283313\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283313\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283313\\temporaryfile")) returned 1 [0214.309] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283313\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aeebe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aeebe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aeebe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.309] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aeebe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aeebe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aeebe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.309] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aeebe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aeebe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aeebe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.309] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283313\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aeebe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aeebe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aeebe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.309] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aeebe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aeebe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aeebe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.309] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aeebe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aeebe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aeebe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.309] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.309] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283313\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283313\\temporaryfile")) returned 1 [0214.309] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84aeebe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84aeebe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84aeebe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.309] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.309] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283313" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283313")) returned 1 [0214.310] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 0 [0214.314] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.315] WriteFile (in: hFile=0xe4, lpBuffer=0x2cf808*, nNumberOfBytesToWrite=0x2ed88, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2cf808*, lpNumberOfBytesWritten=0x18fd98*=0x2ed88, lpOverlapped=0x0) returned 1 [0214.318] CloseHandle (hObject=0xe4) returned 1 [0214.318] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.319] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x3d90 [0214.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d98) returned 0x2a0a70 [0214.320] ReadFile (in: hFile=0xe4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdb0*=0x3d90, lpOverlapped=0x0) returned 1 [0214.321] CloseHandle (hObject=0xe4) returned 1 [0214.321] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 1 [0214.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.322] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.322] GetTickCount () returned 0x452c1 [0214.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.322] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329\\....\\temporaryfile")) returned 0 [0214.323] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329\\temporaryfile")) returned 1 [0214.324] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.324] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.324] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.324] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.324] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.324] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.324] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.324] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329\\temporaryfile")) returned 1 [0214.325] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.325] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329")) returned 1 [0214.325] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 0 [0214.325] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.326] WriteFile (in: hFile=0xe4, lpBuffer=0x2a4818*, nNumberOfBytesToWrite=0x3d98, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a4818*, lpNumberOfBytesWritten=0x18fd98*=0x3d98, lpOverlapped=0x0) returned 1 [0214.327] CloseHandle (hObject=0xe4) returned 1 [0214.327] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.328] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x9339 [0214.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9341) returned 0x2a0a70 [0214.328] ReadFile (in: hFile=0xe4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x9339, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdb0*=0x9339, lpOverlapped=0x0) returned 1 [0214.329] CloseHandle (hObject=0xe4) returned 1 [0214.329] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0214.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.330] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.331] GetTickCount () returned 0x452c1 [0214.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.331] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329\\....\\temporaryfile")) returned 0 [0214.332] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329\\temporaryfile")) returned 1 [0214.333] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b3aea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b3aea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.333] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b3aea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b3aea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.333] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.333] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.333] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.333] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.333] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.333] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329\\temporaryfile")) returned 1 [0214.333] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b14d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b14d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b14d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.334] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.334] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283329" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283329")) returned 1 [0214.334] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 0 [0214.334] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.335] WriteFile (in: hFile=0xe4, lpBuffer=0x2a9dc8*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a9dc8*, lpNumberOfBytesWritten=0x18fd98*=0x9340, lpOverlapped=0x0) returned 1 [0214.336] CloseHandle (hObject=0xe4) returned 1 [0214.336] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.337] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x6931 [0214.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6939) returned 0x2a0a70 [0214.337] ReadFile (in: hFile=0xe4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x6931, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdb0*=0x6931, lpOverlapped=0x0) returned 1 [0214.338] CloseHandle (hObject=0xe4) returned 1 [0214.338] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0214.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.339] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.339] GetTickCount () returned 0x452d0 [0214.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.340] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283344\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283344\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283344\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283344\\....\\temporaryfile")) returned 0 [0214.341] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283344\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283344\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283344\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283344\\temporaryfile")) returned 1 [0214.341] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283344\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b3aea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b3aea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b3aea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.342] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b3aea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b3aea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b3aea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.342] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b3aea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b3aea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b3aea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.342] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283344\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b3aea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b3aea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b3aea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.342] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b3aea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b3aea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b3aea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.342] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b3aea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b3aea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b3aea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.342] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.342] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283344\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283344\\temporaryfile")) returned 1 [0214.342] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b3aea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b3aea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b3aea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.342] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.342] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283344" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283344")) returned 1 [0214.347] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 0 [0214.348] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.348] WriteFile (in: hFile=0xe4, lpBuffer=0x2a73c0*, nNumberOfBytesToWrite=0x6938, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a73c0*, lpNumberOfBytesWritten=0x18fd98*=0x6938, lpOverlapped=0x0) returned 1 [0214.349] CloseHandle (hObject=0xe4) returned 1 [0214.349] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.350] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x6a3b [0214.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6a43) returned 0x2a0a70 [0214.351] ReadFile (in: hFile=0xe4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x6a3b, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdb0*=0x6a3b, lpOverlapped=0x0) returned 1 [0214.352] CloseHandle (hObject=0xe4) returned 1 [0214.352] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0214.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.353] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.353] GetTickCount () returned 0x452e0 [0214.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.354] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360\\....\\temporaryfile")) returned 0 [0214.354] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360\\temporaryfile")) returned 1 [0214.355] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b61000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b61000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b61000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.355] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b61000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b61000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b61000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.355] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b61000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b61000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b61000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.355] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b61000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b61000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b61000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.355] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b61000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b61000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b61000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.355] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b61000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b61000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b61000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.355] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.355] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360\\temporaryfile")) returned 1 [0214.356] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b61000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b61000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b61000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.356] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.356] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360")) returned 1 [0214.356] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 0 [0214.357] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.357] WriteFile (in: hFile=0xe4, lpBuffer=0x2a74c8*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a74c8*, lpNumberOfBytesWritten=0x18fd98*=0x6a40, lpOverlapped=0x0) returned 1 [0214.358] CloseHandle (hObject=0xe4) returned 1 [0214.358] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.359] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x10676 [0214.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1067e) returned 0x2a0a70 [0214.359] ReadFile (in: hFile=0xe4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x10676, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdb0*=0x10676, lpOverlapped=0x0) returned 1 [0214.361] CloseHandle (hObject=0xe4) returned 1 [0214.361] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0214.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.362] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.362] GetTickCount () returned 0x452e0 [0214.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.363] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360\\....\\temporaryfile")) returned 0 [0214.364] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360\\temporaryfile")) returned 1 [0214.364] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.365] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.365] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.365] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.365] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.365] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.365] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.365] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360\\temporaryfile")) returned 1 [0214.365] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.365] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.365] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283360" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283360")) returned 1 [0214.365] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 0 [0214.367] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.367] WriteFile (in: hFile=0xe4, lpBuffer=0x2b1100*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2b1100*, lpNumberOfBytesWritten=0x18fd98*=0x10680, lpOverlapped=0x0) returned 1 [0214.369] CloseHandle (hObject=0xe4) returned 1 [0214.369] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.369] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2488 [0214.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2490) returned 0x299460 [0214.369] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x2488, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x2488, lpOverlapped=0x0) returned 1 [0214.371] CloseHandle (hObject=0xe4) returned 1 [0214.371] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0214.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.372] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.372] GetTickCount () returned 0x452ef [0214.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.372] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283375\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283375\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283375\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283375\\....\\temporaryfile")) returned 0 [0214.373] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283375\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283375\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283375\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283375\\temporaryfile")) returned 1 [0214.374] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283375\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.374] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.374] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.374] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283375\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.374] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.374] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.374] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.375] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283375\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283375\\temporaryfile")) returned 1 [0214.375] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84b87160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.375] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.375] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283375" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283375")) returned 1 [0214.375] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 0 [0214.375] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.376] WriteFile (in: hFile=0xe4, lpBuffer=0x2a0a78*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesWritten=0x18fd98*=0x2490, lpOverlapped=0x0) returned 1 [0214.377] CloseHandle (hObject=0xe4) returned 1 [0214.377] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.377] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x84b87160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84b87160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0214.377] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.377] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19b82c30, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.378] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19b82c30, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.378] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x19b82c30, dwReserved1=0x1d301bf, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0214.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x256228 [0214.378] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.379] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x567 [0214.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x56f) returned 0x259e70 [0214.379] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x567, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x567, lpOverlapped=0x0) returned 1 [0214.381] CloseHandle (hObject=0xe4) returned 1 [0214.381] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0214.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.382] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.382] GetTickCount () returned 0x452ff [0214.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.382] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.383] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391\\....\\temporaryfile")) returned 0 [0214.383] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391\\temporaryfile")) returned 1 [0214.384] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.384] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.384] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.384] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.384] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.384] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.384] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.384] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391\\temporaryfile")) returned 1 [0214.385] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.385] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.385] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391")) returned 1 [0214.385] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 0 [0214.385] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.386] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x570, lpOverlapped=0x0) returned 1 [0214.386] CloseHandle (hObject=0xe4) returned 1 [0214.387] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.387] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x93a [0214.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x942) returned 0x2649f0 [0214.387] ReadFile (in: hFile=0xe4, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x93a, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdb0*=0x93a, lpOverlapped=0x0) returned 1 [0214.388] CloseHandle (hObject=0xe4) returned 1 [0214.388] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0214.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.389] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.389] GetTickCount () returned 0x452ff [0214.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.391] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.392] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391\\....\\temporaryfile")) returned 0 [0214.392] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391\\temporaryfile")) returned 1 [0214.393] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.393] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.393] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.393] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.393] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.394] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.394] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.394] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391\\temporaryfile")) returned 1 [0214.394] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bad2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bad2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bad2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.394] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.394] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283391" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283391")) returned 1 [0214.395] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 0 [0214.395] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.396] WriteFile (in: hFile=0xe4, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fd98*=0x940, lpOverlapped=0x0) returned 1 [0214.397] CloseHandle (hObject=0xe4) returned 1 [0214.397] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.397] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x84bd3420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bd3420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0214.397] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.397] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22200730, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.398] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x22200730, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.398] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x22200730, dwReserved1=0x1d301bf, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0214.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x256198 [0214.398] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.399] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x10b2 [0214.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10ba) returned 0x299460 [0214.399] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x10b2, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x10b2, lpOverlapped=0x0) returned 1 [0214.400] CloseHandle (hObject=0xe4) returned 1 [0214.400] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0214.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.401] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.401] GetTickCount () returned 0x4530f [0214.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.401] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283407\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283407\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283407\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283407\\....\\temporaryfile")) returned 0 [0214.402] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283407\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283407\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283407\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283407\\temporaryfile")) returned 1 [0214.403] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283407\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bd3420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bd3420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bd3420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.403] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bd3420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bd3420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bd3420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.403] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bd3420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bd3420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bd3420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.403] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283407\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bd3420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bd3420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bd3420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.403] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bd3420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bd3420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bd3420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.403] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bd3420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bd3420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bd3420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.403] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.403] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283407\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283407\\temporaryfile")) returned 1 [0214.404] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bd3420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bd3420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bd3420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.404] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.404] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283407" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283407")) returned 1 [0214.404] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 0 [0214.404] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.405] WriteFile (in: hFile=0xe4, lpBuffer=0x29a530*, nNumberOfBytesToWrite=0x10b8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x29a530*, lpNumberOfBytesWritten=0x18fd98*=0x10b8, lpOverlapped=0x0) returned 1 [0214.405] CloseHandle (hObject=0xe4) returned 1 [0214.406] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.406] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x84bd3420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bd3420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0214.406] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.406] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc840bb0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.407] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc840bb0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.407] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0xc840bb0, dwReserved1=0x1d301bf, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0214.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x256210 [0214.407] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.408] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x646 [0214.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x64e) returned 0x259e70 [0214.408] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x646, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x646, lpOverlapped=0x0) returned 1 [0214.409] CloseHandle (hObject=0xe4) returned 1 [0214.409] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0214.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.410] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.410] GetTickCount () returned 0x4531e [0214.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.411] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422\\....\\temporaryfile")) returned 0 [0214.411] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422\\temporaryfile")) returned 1 [0214.412] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.412] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.412] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.412] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.412] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.412] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.412] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.412] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422\\temporaryfile")) returned 1 [0214.413] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.413] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.413] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422")) returned 1 [0214.413] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 0 [0214.413] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.413] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x650, lpOverlapped=0x0) returned 1 [0214.414] CloseHandle (hObject=0xe4) returned 1 [0214.415] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.415] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x7c4 [0214.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7cc) returned 0x2649f0 [0214.415] ReadFile (in: hFile=0xe4, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x7c4, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdb0*=0x7c4, lpOverlapped=0x0) returned 1 [0214.417] CloseHandle (hObject=0xe4) returned 1 [0214.417] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0214.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.418] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.418] GetTickCount () returned 0x4531e [0214.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.418] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422\\....\\temporaryfile")) returned 0 [0214.419] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422\\temporaryfile")) returned 1 [0214.420] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.420] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.420] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.420] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.420] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.420] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.420] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.420] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422\\temporaryfile")) returned 1 [0214.420] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84bf9580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.420] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.421] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283422" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283422")) returned 1 [0214.421] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 0 [0214.421] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.421] WriteFile (in: hFile=0xe4, lpBuffer=0x2651d0*, nNumberOfBytesToWrite=0x7c8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2651d0*, lpNumberOfBytesWritten=0x18fd98*=0x7c8, lpOverlapped=0x0) returned 1 [0214.422] CloseHandle (hObject=0xe4) returned 1 [0214.422] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.422] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x84bf9580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84bf9580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0214.423] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.423] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14af010, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.424] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14af010, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.424] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x14af010, dwReserved1=0x1d301bf, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0214.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x256198 [0214.424] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.424] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xc72 [0214.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc7a) returned 0x2649f0 [0214.424] ReadFile (in: hFile=0xe4, lpBuffer=0x2649f8, nNumberOfBytesToRead=0xc72, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdb0*=0xc72, lpOverlapped=0x0) returned 1 [0214.426] CloseHandle (hObject=0xe4) returned 1 [0214.426] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0214.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.427] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.427] GetTickCount () returned 0x4532e [0214.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.427] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438\\....\\temporaryfile")) returned 0 [0214.428] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438\\temporaryfile")) returned 1 [0214.429] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.429] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.429] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.429] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.429] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.429] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.429] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438\\temporaryfile")) returned 1 [0214.429] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.429] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438")) returned 1 [0214.430] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 0 [0214.430] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.430] WriteFile (in: hFile=0xe4, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xc78, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fd98*=0xc78, lpOverlapped=0x0) returned 1 [0214.431] CloseHandle (hObject=0xe4) returned 1 [0214.431] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.432] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x106f [0214.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1077) returned 0x299460 [0214.432] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x106f, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x106f, lpOverlapped=0x0) returned 1 [0214.434] CloseHandle (hObject=0xe4) returned 1 [0214.434] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0214.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.435] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.435] GetTickCount () returned 0x4532e [0214.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.435] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438\\....\\temporaryfile")) returned 0 [0214.436] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438\\temporaryfile")) returned 1 [0214.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.437] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.437] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.437] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.437] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.437] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.437] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438\\temporaryfile")) returned 1 [0214.437] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c1f6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.438] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283438" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283438")) returned 1 [0214.438] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 0 [0214.438] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.439] WriteFile (in: hFile=0xe4, lpBuffer=0x29a4e8*, nNumberOfBytesToWrite=0x1078, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x29a4e8*, lpNumberOfBytesWritten=0x18fd98*=0x1078, lpOverlapped=0x0) returned 1 [0214.440] CloseHandle (hObject=0xe4) returned 1 [0214.440] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.440] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x84c1f6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c1f6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0214.440] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.440] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf5db14d0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.441] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf5db14d0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0214.441] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0xf5db14d0, dwReserved1=0x1d301be, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0214.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25ce30 [0214.441] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.442] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x5aa [0214.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b2) returned 0x259e70 [0214.442] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x5aa, lpOverlapped=0x0) returned 1 [0214.443] CloseHandle (hObject=0xe4) returned 1 [0214.443] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0214.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.444] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.444] GetTickCount () returned 0x4533d [0214.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0214.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.445] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453\\....\\temporaryfile")) returned 0 [0214.445] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453\\temporaryfile")) returned 1 [0214.446] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.446] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.446] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.446] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.446] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.447] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.447] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.447] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453\\temporaryfile")) returned 1 [0214.447] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.447] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.447] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453")) returned 1 [0214.447] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 0 [0214.447] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.448] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x5b0, lpOverlapped=0x0) returned 1 [0214.449] CloseHandle (hObject=0xe4) returned 1 [0214.449] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.450] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x75e [0214.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x766) returned 0x2649f0 [0214.450] ReadFile (in: hFile=0xe4, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x75e, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdb0*=0x75e, lpOverlapped=0x0) returned 1 [0214.451] CloseHandle (hObject=0xe4) returned 1 [0214.452] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0214.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.452] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.452] GetTickCount () returned 0x4533d [0214.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0214.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.453] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453\\....\\temporaryfile")) returned 0 [0214.454] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453\\temporaryfile")) returned 1 [0214.455] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.455] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.455] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.455] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.455] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.455] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.455] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.455] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453\\temporaryfile")) returned 1 [0214.455] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c45840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.455] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.455] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283453" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283453")) returned 1 [0214.456] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 0 [0214.456] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.456] WriteFile (in: hFile=0xe4, lpBuffer=0x265168*, nNumberOfBytesToWrite=0x768, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x265168*, lpNumberOfBytesWritten=0x18fd98*=0x768, lpOverlapped=0x0) returned 1 [0214.457] CloseHandle (hObject=0xe4) returned 1 [0214.458] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.458] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x84c45840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c45840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0214.458] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.458] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe2e8f80, dwReserved1=0x1d305f1, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.458] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe2e8f80, dwReserved1=0x1d305f1, cFileName="..", cAlternateFileName="")) returned 1 [0214.458] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0xbe2e8f80, dwReserved1=0x1d305f1, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0214.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x256228 [0214.459] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.459] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x1915 [0214.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x191d) returned 0x299460 [0214.459] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x1915, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x1915, lpOverlapped=0x0) returned 1 [0214.460] CloseHandle (hObject=0xe4) returned 1 [0214.460] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0214.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.461] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.461] GetTickCount () returned 0x4534d [0214.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0214.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.462] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469\\....\\temporaryfile")) returned 0 [0214.462] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469\\temporaryfile")) returned 1 [0214.463] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.463] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="..", cAlternateFileName="")) returned 1 [0214.464] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.464] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.464] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.464] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.464] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.464] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469\\temporaryfile")) returned 1 [0214.464] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.464] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.464] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469")) returned 1 [0214.464] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 0 [0214.465] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.465] WriteFile (in: hFile=0xe4, lpBuffer=0x29ad90*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x29ad90*, lpNumberOfBytesWritten=0x18fd98*=0x1920, lpOverlapped=0x0) returned 1 [0214.466] CloseHandle (hObject=0xe4) returned 1 [0214.466] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.467] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x412b [0214.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4133) returned 0x2a0a70 [0214.467] ReadFile (in: hFile=0xe4, lpBuffer=0x2a0a78, nNumberOfBytesToRead=0x412b, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a78*, lpNumberOfBytesRead=0x18fdb0*=0x412b, lpOverlapped=0x0) returned 1 [0214.468] CloseHandle (hObject=0xe4) returned 1 [0214.468] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0214.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.469] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.469] GetTickCount () returned 0x4534d [0214.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0214.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.470] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469\\....\\temporaryfile")) returned 0 [0214.470] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469\\temporaryfile")) returned 1 [0214.471] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.471] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.471] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.471] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.472] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.472] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.472] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.472] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469\\temporaryfile")) returned 1 [0214.472] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c6b9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c6b9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c6b9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.472] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.472] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283469" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283469")) returned 1 [0214.472] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 0 [0214.473] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.473] WriteFile (in: hFile=0xe4, lpBuffer=0x2a4bb8*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a4bb8*, lpNumberOfBytesWritten=0x18fd98*=0x4130, lpOverlapped=0x0) returned 1 [0214.474] CloseHandle (hObject=0xe4) returned 1 [0214.474] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.474] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x84c91b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c91b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0214.475] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.475] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaf551ba0, dwReserved1=0x1d305f1, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.480] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaf551ba0, dwReserved1=0x1d305f1, cFileName="..", cAlternateFileName="")) returned 1 [0214.480] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xaf551ba0, dwReserved1=0x1d305f1, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0214.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x256228 [0214.480] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.481] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x5ac [0214.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b4) returned 0x259e70 [0214.481] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x5ac, lpOverlapped=0x0) returned 1 [0214.482] CloseHandle (hObject=0xe4) returned 1 [0214.482] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0214.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.483] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.483] GetTickCount () returned 0x4535d [0214.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.487] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283485\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283485\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283485\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283485\\....\\temporaryfile")) returned 0 [0214.487] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283485\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283485\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283485\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283485\\temporaryfile")) returned 1 [0214.488] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283485\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c91b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cb7c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cb7c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.489] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c91b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cb7c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cb7c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="..", cAlternateFileName="")) returned 1 [0214.489] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c91b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c91b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c91b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.489] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283485\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c91b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c91b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c91b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.489] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c91b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c91b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c91b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.489] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c91b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c91b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c91b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.489] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283485\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283485\\temporaryfile")) returned 1 [0214.489] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84c91b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84c91b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84c91b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.489] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283485" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283485")) returned 1 [0214.489] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 0 [0214.490] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.490] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x5b0, lpOverlapped=0x0) returned 1 [0214.492] CloseHandle (hObject=0xe4) returned 1 [0214.492] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.493] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x750 [0214.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x758) returned 0x2649f0 [0214.493] ReadFile (in: hFile=0xe4, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x750, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdb0*=0x750, lpOverlapped=0x0) returned 1 [0214.494] CloseHandle (hObject=0xe4) returned 1 [0214.494] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0214.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.495] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.495] GetTickCount () returned 0x4536c [0214.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.496] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283500\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283500\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283500\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283500\\....\\temporaryfile")) returned 0 [0214.496] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283500\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283500\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283500\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283500\\temporaryfile")) returned 1 [0214.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283500\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cb7c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cb7c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cb7c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.497] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cb7c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cb7c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cb7c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.498] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cb7c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cb7c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cb7c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.498] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283500\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cb7c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cb7c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cb7c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.498] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cb7c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cb7c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cb7c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.498] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cb7c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cb7c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cb7c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.498] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.498] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283500\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283500\\temporaryfile")) returned 1 [0214.498] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cb7c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cb7c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cb7c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.498] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.498] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283500" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283500")) returned 1 [0214.498] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 0 [0214.498] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.499] WriteFile (in: hFile=0xe4, lpBuffer=0x265158*, nNumberOfBytesToWrite=0x758, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x265158*, lpNumberOfBytesWritten=0x18fd98*=0x758, lpOverlapped=0x0) returned 1 [0214.500] CloseHandle (hObject=0xe4) returned 1 [0214.500] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.500] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x84cb7c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cb7c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0214.500] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.501] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x99177d0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.501] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x99177d0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.501] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x99177d0, dwReserved1=0x1d301bf, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0214.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256210 [0214.502] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.502] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x543 [0214.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54b) returned 0x259e70 [0214.502] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x543, lpOverlapped=0x0) returned 1 [0214.503] CloseHandle (hObject=0xe4) returned 1 [0214.503] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0214.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.504] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.504] GetTickCount () returned 0x4537c [0214.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.505] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516\\....\\temporaryfile")) returned 0 [0214.505] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516\\temporaryfile")) returned 1 [0214.506] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.506] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.507] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.507] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.507] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.507] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.507] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516\\temporaryfile")) returned 1 [0214.507] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.507] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516")) returned 1 [0214.507] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 0 [0214.508] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.508] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x548, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x548, lpOverlapped=0x0) returned 1 [0214.509] CloseHandle (hObject=0xe4) returned 1 [0214.509] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.509] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0214.509] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.509] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5b7fe90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.510] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5b7fe90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.510] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x5b7fe90, dwReserved1=0x1d301bf, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0214.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256198 [0214.510] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.511] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x5b1 [0214.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b9) returned 0x259e70 [0214.511] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x5b1, lpOverlapped=0x0) returned 1 [0214.513] CloseHandle (hObject=0xe4) returned 1 [0214.513] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0214.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.514] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.514] GetTickCount () returned 0x4537c [0214.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.514] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.515] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516\\....\\temporaryfile")) returned 0 [0214.515] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516\\temporaryfile")) returned 1 [0214.516] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.516] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.516] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.516] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.516] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.516] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.516] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.516] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516\\temporaryfile")) returned 1 [0214.517] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84cdddc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.517] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.517] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283516" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283516")) returned 1 [0214.517] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 0 [0214.517] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.517] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x5b8, lpOverlapped=0x0) returned 1 [0214.519] CloseHandle (hObject=0xe4) returned 1 [0214.519] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.519] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x84cdddc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84cdddc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0214.519] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.519] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7941190, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.520] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7941190, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.520] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x7941190, dwReserved1=0x1d301bf, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0214.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256210 [0214.521] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.521] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x5b2 [0214.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5ba) returned 0x259e70 [0214.521] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5b2, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x5b2, lpOverlapped=0x0) returned 1 [0214.522] CloseHandle (hObject=0xe4) returned 1 [0214.522] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0214.523] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.523] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.523] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.523] GetTickCount () returned 0x4538b [0214.523] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.523] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.524] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531\\....\\temporaryfile")) returned 0 [0214.524] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531\\temporaryfile")) returned 1 [0214.525] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.525] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.526] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.526] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.526] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.526] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.526] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.526] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531\\temporaryfile")) returned 1 [0214.526] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.526] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.526] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531")) returned 1 [0214.526] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 0 [0214.527] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.527] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x5b8, lpOverlapped=0x0) returned 1 [0214.528] CloseHandle (hObject=0xe4) returned 1 [0214.528] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.528] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0214.528] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.528] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xab640f0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.529] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xab640f0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.529] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0xab640f0, dwReserved1=0x1d301bf, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0214.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256198 [0214.529] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.529] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x32b [0214.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x333) returned 0x259e70 [0214.529] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x32b, lpOverlapped=0x0) returned 1 [0214.531] CloseHandle (hObject=0xe4) returned 1 [0214.531] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0214.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.532] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.532] GetTickCount () returned 0x4538b [0214.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.532] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531\\....\\temporaryfile")) returned 0 [0214.533] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531\\temporaryfile")) returned 1 [0214.534] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.534] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.534] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.534] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.534] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.534] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.534] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531\\temporaryfile")) returned 1 [0214.534] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d03f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d03f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d03f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.534] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.535] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283531" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283531")) returned 1 [0214.535] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 0 [0214.535] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.535] WriteFile (in: hFile=0xe4, lpBuffer=0x2a0a90*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a0a90*, lpNumberOfBytesWritten=0x18fd98*=0x330, lpOverlapped=0x0) returned 1 [0214.536] CloseHandle (hObject=0xe4) returned 1 [0214.536] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.537] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x16fc [0214.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1704) returned 0x299460 [0214.537] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x16fc, lpOverlapped=0x0) returned 1 [0214.538] CloseHandle (hObject=0xe4) returned 1 [0214.538] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0214.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.539] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.539] GetTickCount () returned 0x4539b [0214.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.540] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283547\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283547\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283547\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283547\\....\\temporaryfile")) returned 0 [0214.540] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283547\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283547\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283547\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283547\\temporaryfile")) returned 1 [0214.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283547\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d2a080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d2a080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d2a080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.541] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d2a080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d2a080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d2a080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.541] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d2a080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d2a080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d2a080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283547\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d2a080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d2a080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d2a080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.542] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d2a080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d2a080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d2a080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.542] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d2a080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d2a080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d2a080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.542] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.542] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283547\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283547\\temporaryfile")) returned 1 [0214.542] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d2a080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d2a080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d2a080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.542] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.542] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283547" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283547")) returned 1 [0214.542] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 0 [0214.542] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.543] WriteFile (in: hFile=0xe4, lpBuffer=0x29ab78*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x29ab78*, lpNumberOfBytesWritten=0x18fd98*=0x1700, lpOverlapped=0x0) returned 1 [0214.544] CloseHandle (hObject=0xe4) returned 1 [0214.544] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.544] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x84d2a080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d2a080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0214.544] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.544] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a95a430, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.549] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a95a430, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.549] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x5a95a430, dwReserved1=0x1d301bf, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0214.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x256210 [0214.549] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.549] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x41d4 [0214.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x41dc) returned 0x2a4a70 [0214.550] ReadFile (in: hFile=0xe4, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x41d4, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdb0*=0x41d4, lpOverlapped=0x0) returned 1 [0214.551] CloseHandle (hObject=0xe4) returned 1 [0214.551] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0214.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.552] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.552] GetTickCount () returned 0x453ab [0214.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.553] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563\\....\\temporaryfile")) returned 0 [0214.553] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563\\temporaryfile")) returned 1 [0214.554] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.554] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.554] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.554] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.554] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.554] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.554] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.554] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563\\temporaryfile")) returned 1 [0214.555] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.555] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.555] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563")) returned 1 [0214.555] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 0 [0214.556] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.556] WriteFile (in: hFile=0xe4, lpBuffer=0x2a8c60*, nNumberOfBytesToWrite=0x41d8, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a8c60*, lpNumberOfBytesWritten=0x18fd98*=0x41d8, lpOverlapped=0x0) returned 1 [0214.557] CloseHandle (hObject=0xe4) returned 1 [0214.557] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.558] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x7976 [0214.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x797e) returned 0x2a4a70 [0214.558] ReadFile (in: hFile=0xe4, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x7976, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdb0*=0x7976, lpOverlapped=0x0) returned 1 [0214.559] CloseHandle (hObject=0xe4) returned 1 [0214.559] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0214.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.560] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.560] GetTickCount () returned 0x453ab [0214.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.561] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563\\....\\temporaryfile")) returned 0 [0214.562] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563\\temporaryfile")) returned 1 [0214.563] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.563] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.563] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.563] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.563] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.563] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.563] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.563] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563\\temporaryfile")) returned 1 [0214.563] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d501e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.563] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.564] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283563" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283563")) returned 1 [0214.564] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 0 [0214.564] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.565] WriteFile (in: hFile=0xe4, lpBuffer=0x2ac400*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2ac400*, lpNumberOfBytesWritten=0x18fd98*=0x7980, lpOverlapped=0x0) returned 1 [0214.566] CloseHandle (hObject=0xe4) returned 1 [0214.566] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.566] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x84d501e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d501e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0214.567] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.567] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba9ab90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.568] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba9ab90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.568] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x1ba9ab90, dwReserved1=0x1d301bf, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0214.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11) returned 0x25ce10 [0214.568] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.568] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x5aa [0214.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b2) returned 0x259e70 [0214.568] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5aa, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x5aa, lpOverlapped=0x0) returned 1 [0214.569] CloseHandle (hObject=0xe4) returned 1 [0214.569] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0214.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.580] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.580] GetTickCount () returned 0x453ba [0214.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0214.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.581] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283578\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283578\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283578\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283578\\....\\temporaryfile")) returned 0 [0214.581] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283578\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283578\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283578\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283578\\temporaryfile")) returned 1 [0214.582] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283578\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d76340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.583] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d76340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.583] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.583] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283578\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.583] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.583] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.583] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.583] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283578\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283578\\temporaryfile")) returned 1 [0214.583] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.583] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.583] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283578" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283578")) returned 1 [0214.583] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 0 [0214.584] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.584] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x5b0, lpOverlapped=0x0) returned 1 [0214.585] CloseHandle (hObject=0xe4) returned 1 [0214.585] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.586] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x648 [0214.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x650) returned 0x259e70 [0214.586] ReadFile (in: hFile=0xe4, lpBuffer=0x259e78, nNumberOfBytesToRead=0x648, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdb0*=0x648, lpOverlapped=0x0) returned 1 [0214.587] CloseHandle (hObject=0xe4) returned 1 [0214.588] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0214.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.588] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.588] GetTickCount () returned 0x453ca [0214.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.589] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283594\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283594\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.590] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283594\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283594\\....\\temporaryfile")) returned 0 [0214.590] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283594\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283594\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283594\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283594\\temporaryfile")) returned 1 [0214.591] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283594\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.591] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.591] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.591] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283594\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.591] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.591] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.591] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.591] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283594\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283594\\temporaryfile")) returned 1 [0214.592] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84d9c4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.592] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.592] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283594" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283594")) returned 1 [0214.592] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 0 [0214.592] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.593] WriteFile (in: hFile=0xe4, lpBuffer=0x2649f8*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesWritten=0x18fd98*=0x650, lpOverlapped=0x0) returned 1 [0214.594] CloseHandle (hObject=0xe4) returned 1 [0214.594] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.594] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x84d9c4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84d9c4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0214.594] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.594] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50b66320, dwReserved1=0x1d305eb, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.596] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50b66320, dwReserved1=0x1d305eb, cFileName="..", cAlternateFileName="")) returned 1 [0214.596] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x50b66320, dwReserved1=0x1d305eb, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0214.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256198 [0214.596] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.691] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x1861 [0214.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1869) returned 0x299460 [0214.691] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x1861, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x1861, lpOverlapped=0x0) returned 1 [0214.692] CloseHandle (hObject=0xe4) returned 1 [0214.692] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0214.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.693] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.693] GetTickCount () returned 0x45437 [0214.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.694] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703\\....\\temporaryfile")) returned 0 [0214.695] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703\\temporaryfile")) returned 1 [0214.696] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.696] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.696] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.696] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.696] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.696] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.696] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.696] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703\\temporaryfile")) returned 1 [0214.696] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.696] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703")) returned 1 [0214.697] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 0 [0214.697] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.698] WriteFile (in: hFile=0xe4, lpBuffer=0x29ace0*, nNumberOfBytesToWrite=0x1868, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x29ace0*, lpNumberOfBytesWritten=0x18fd98*=0x1868, lpOverlapped=0x0) returned 1 [0214.698] CloseHandle (hObject=0xe4) returned 1 [0214.699] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.700] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x251f [0214.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2527) returned 0x299460 [0214.700] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x251f, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x251f, lpOverlapped=0x0) returned 1 [0214.701] CloseHandle (hObject=0xe4) returned 1 [0214.701] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0214.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.702] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.702] GetTickCount () returned 0x45437 [0214.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.703] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703\\....\\temporaryfile")) returned 0 [0214.703] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703\\temporaryfile")) returned 1 [0214.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.705] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.705] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.705] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.705] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.705] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.705] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.705] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703\\temporaryfile")) returned 1 [0214.705] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ea6e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ea6e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ea6e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.705] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.705] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283703" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283703")) returned 1 [0214.705] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 0 [0214.713] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.713] WriteFile (in: hFile=0xe4, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x2528, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fd98*=0x2528, lpOverlapped=0x0) returned 1 [0214.714] CloseHandle (hObject=0xe4) returned 1 [0214.714] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.715] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84eccfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84eccfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0214.715] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.715] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x83258520, dwReserved1=0x1d305eb, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.716] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x83258520, dwReserved1=0x1d305eb, cFileName="..", cAlternateFileName="")) returned 1 [0214.716] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x83258520, dwReserved1=0x1d305eb, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0214.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256228 [0214.716] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.717] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x5061 [0214.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5069) returned 0x2a4a70 [0214.717] ReadFile (in: hFile=0xe4, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x5061, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdb0*=0x5061, lpOverlapped=0x0) returned 1 [0214.719] CloseHandle (hObject=0xe4) returned 1 [0214.719] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0214.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.720] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.720] GetTickCount () returned 0x45447 [0214.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0214.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.720] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283719\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283719\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283719\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283719\\....\\temporaryfile")) returned 0 [0214.721] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283719\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283719\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283719\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283719\\temporaryfile")) returned 1 [0214.722] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283719\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84eccfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84eccfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84eccfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.722] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84eccfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84eccfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84eccfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="..", cAlternateFileName="")) returned 1 [0214.723] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84eccfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84eccfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84eccfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.723] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283719\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84eccfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84eccfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84eccfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.723] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84eccfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84eccfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84eccfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.723] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84eccfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84eccfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84eccfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.723] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283719\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283719\\temporaryfile")) returned 1 [0214.723] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84eccfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84eccfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84eccfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.723] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283719" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283719")) returned 1 [0214.723] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 0 [0214.724] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.724] WriteFile (in: hFile=0xe4, lpBuffer=0x2a9af0*, nNumberOfBytesToWrite=0x5068, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a9af0*, lpNumberOfBytesWritten=0x18fd98*=0x5068, lpOverlapped=0x0) returned 1 [0214.725] CloseHandle (hObject=0xe4) returned 1 [0214.726] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.726] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2213 [0214.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x221b) returned 0x299460 [0214.726] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x2213, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x2213, lpOverlapped=0x0) returned 1 [0214.727] CloseHandle (hObject=0xe4) returned 1 [0214.727] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0214.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.728] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.728] GetTickCount () returned 0x45456 [0214.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0214.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.729] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283734\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283734\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283734\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283734\\....\\temporaryfile")) returned 0 [0214.730] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283734\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283734\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283734\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283734\\temporaryfile")) returned 1 [0214.731] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283734\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ef3100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ef3100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ef3100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.731] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ef3100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ef3100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ef3100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.731] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ef3100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ef3100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ef3100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.731] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283734\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ef3100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ef3100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ef3100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.731] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ef3100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ef3100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ef3100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.731] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ef3100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ef3100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ef3100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.731] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.731] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283734\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283734\\temporaryfile")) returned 1 [0214.745] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84ef3100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84ef3100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84ef3100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.745] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283734" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283734")) returned 1 [0214.745] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 0 [0214.746] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.746] WriteFile (in: hFile=0xe4, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x2218, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fd98*=0x2218, lpOverlapped=0x0) returned 1 [0214.747] CloseHandle (hObject=0xe4) returned 1 [0214.747] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.748] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84f19260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f19260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0214.748] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.748] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e501370, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.749] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e501370, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.749] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x1e501370, dwReserved1=0x1d301bf, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0214.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256228 [0214.749] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.750] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x978 [0214.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x980) returned 0x2649f0 [0214.750] ReadFile (in: hFile=0xe4, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x978, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdb0*=0x978, lpOverlapped=0x0) returned 1 [0214.751] CloseHandle (hObject=0xe4) returned 1 [0214.751] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0214.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0214.752] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.752] GetTickCount () returned 0x45466 [0214.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.753] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283750\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283750\\...."), lpSecurityAttributes=0x256198) returned 1 [0214.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283750\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283750\\....\\temporaryfile")) returned 0 [0214.753] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283750\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283750\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283750\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283750\\temporaryfile")) returned 1 [0214.754] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283750\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f19260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.754] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f19260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="..", cAlternateFileName="")) returned 1 [0214.754] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.754] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283750\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.754] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.754] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.754] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283750\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283750\\temporaryfile")) returned 1 [0214.755] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x18, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.755] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283750" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283750")) returned 1 [0214.755] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 0 [0214.755] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.756] WriteFile (in: hFile=0xe4, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fd98*=0x980, lpOverlapped=0x0) returned 1 [0214.757] CloseHandle (hObject=0xe4) returned 1 [0214.757] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.757] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x708 [0214.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x710) returned 0x2649f0 [0214.757] ReadFile (in: hFile=0xe4, lpBuffer=0x2649f8, nNumberOfBytesToRead=0x708, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2649f8*, lpNumberOfBytesRead=0x18fdb0*=0x708, lpOverlapped=0x0) returned 1 [0214.758] CloseHandle (hObject=0xe4) returned 1 [0214.759] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0214.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0214.759] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0214.759] GetTickCount () returned 0x45475 [0214.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0214.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0214.760] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283765\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283765\\...."), lpSecurityAttributes=0x256228) returned 1 [0214.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283765\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283765\\....\\temporaryfile")) returned 0 [0214.761] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283765\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283765\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283765\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283765\\temporaryfile")) returned 1 [0214.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283765\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0214.762] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.762] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283765\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0214.762] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.762] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.762] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0214.762] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283765\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283765\\temporaryfile")) returned 1 [0214.762] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f3f3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.762] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0214.762] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283765" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283765")) returned 1 [0214.763] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 0 [0214.763] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0214.763] WriteFile (in: hFile=0xe4, lpBuffer=0x265110*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x265110*, lpNumberOfBytesWritten=0x18fd98*=0x710, lpOverlapped=0x0) returned 1 [0214.764] CloseHandle (hObject=0xe4) returned 1 [0214.764] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.764] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x84f3f3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f3f3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0214.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0214.764] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0214.765] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0214.765] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0214.765] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50e54b70, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0214.767] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50e54b70, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0214.767] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x50e54b70, dwReserved1=0x1d301bf, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0214.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x2561c8 [0214.767] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0214.768] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x24500 [0214.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24508) returned 0x2a4a70 [0214.768] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x24500, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x24500, lpOverlapped=0x0) returned 1 [0214.770] CloseHandle (hObject=0xdc) returned 1 [0214.770] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 1 [0214.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.772] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0214.772] GetTickCount () returned 0x45485 [0214.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0214.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0214.772] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283781\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283781\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283781\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283781\\....\\temporaryfile")) returned 0 [0214.773] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283781\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283781\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283781\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283781\\temporaryfile")) returned 1 [0214.774] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283781\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f65520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f65520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f65520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x16, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0214.774] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f65520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f65520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f65520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x16, cFileName="..", cAlternateFileName="")) returned 1 [0214.774] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f65520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f65520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f65520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.774] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283781\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f65520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f65520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f65520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0214.774] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f65520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f65520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f65520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.774] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f65520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f65520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f65520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.774] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0214.774] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283781\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283781\\temporaryfile")) returned 1 [0214.774] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84f65520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84f65520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84f65520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.774] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0214.774] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283781" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283781")) returned 1 [0214.774] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 0 [0214.777] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0214.777] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8f88*, nNumberOfBytesToWrite=0x24508, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8f88*, lpNumberOfBytesWritten=0x18fdd8*=0x24508, lpOverlapped=0x0) returned 1 [0214.780] CloseHandle (hObject=0xdc) returned 1 [0214.780] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0214.781] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1be700 [0214.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1be708) returned 0x2650020 [0214.781] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1be700, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x1be700, lpOverlapped=0x0) returned 1 [0214.821] CloseHandle (hObject=0xdc) returned 1 [0214.821] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll")) returned 1 [0214.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0214.827] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0214.827] GetTickCount () returned 0x454b4 [0214.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0214.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0214.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0214.828] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283828\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0214.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283828\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283828\\....\\temporaryfile")) returned 0 [0214.828] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283828\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283828\\temporaryfile")) returned 1 [0214.829] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283828\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84fd7940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84fd7940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84fd7940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0214.829] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84fd7940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84fd7940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84fd7940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.830] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84fd7940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84fd7940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84fd7940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.830] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283828\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84fd7940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84fd7940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84fd7940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0214.830] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84fd7940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84fd7940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84fd7940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.830] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84fd7940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84fd7940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84fd7940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.830] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0214.830] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283828\\temporaryfile")) returned 1 [0214.830] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84fd7940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x84fd7940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x84fd7940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.830] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0214.830] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283828" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283828")) returned 1 [0214.830] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 0 [0214.933] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0214.934] WriteFile (in: hFile=0xdc, lpBuffer=0x29d0028*, nNumberOfBytesToWrite=0x1be708, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29d0028*, lpNumberOfBytesWritten=0x18fdd8*=0x1be708, lpOverlapped=0x0) returned 1 [0214.961] CloseHandle (hObject=0xdc) returned 1 [0214.976] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0214.977] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2d7e [0214.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d86) returned 0x299460 [0214.977] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2d7e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2d7e, lpOverlapped=0x0) returned 1 [0214.978] CloseHandle (hObject=0xdc) returned 1 [0214.978] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 1 [0214.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0214.979] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0214.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0214.979] GetTickCount () returned 0x45550 [0214.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0214.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea80 [0214.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0214.980] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283984\\...."), lpSecurityAttributes=0x256210) returned 1 [0214.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283984\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283984\\....\\temporaryfile")) returned 0 [0214.980] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283984\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283984\\temporaryfile")) returned 1 [0214.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283984\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85154700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85154700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85154700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0214.981] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85154700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85154700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85154700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.981] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85154700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85154700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85154700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0214.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283984\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85154700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85154700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85154700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0214.982] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85154700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85154700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85154700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.982] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85154700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85154700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85154700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.982] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0214.982] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283984\\temporaryfile")) returned 1 [0214.982] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85154700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85154700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85154700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0214.982] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0214.982] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18283984" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18283984")) returned 1 [0214.982] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 0 [0214.982] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0214.983] WriteFile (in: hFile=0xdc, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x2d88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2d88, lpOverlapped=0x0) returned 1 [0214.984] CloseHandle (hObject=0xdc) returned 1 [0214.984] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0214.984] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x212b00 [0214.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x212b08) returned 0x2650020 [0214.985] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x212b00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x212b00, lpOverlapped=0x0) returned 1 [0215.039] CloseHandle (hObject=0xdc) returned 1 [0215.039] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll")) returned 1 [0215.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0215.040] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0215.040] GetTickCount () returned 0x4558e [0215.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0215.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0215.041] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284046\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284046\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0215.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284046\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284046\\....\\temporaryfile")) returned 0 [0215.041] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284046\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284046\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284046\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284046\\temporaryfile")) returned 1 [0215.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284046\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851ecc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x851ecc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x851ecc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.042] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851ecc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x851ecc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x851ecc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.042] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851ecc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x851ecc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x851ecc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284046\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851ecc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x851ecc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x851ecc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851ecc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x851ecc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x851ecc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851ecc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x851ecc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x851ecc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.042] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.043] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284046\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284046\\temporaryfile")) returned 1 [0215.043] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851ecc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x851ecc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x851ecc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.043] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.043] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284046" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284046")) returned 1 [0215.043] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 0 [0215.142] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.142] WriteFile (in: hFile=0xdc, lpBuffer=0x2a90028*, nNumberOfBytesToWrite=0x212b08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a90028*, lpNumberOfBytesWritten=0x18fdd8*=0x212b08, lpOverlapped=0x0) returned 1 [0215.187] CloseHandle (hObject=0xdc) returned 1 [0215.206] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.206] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d60 [0215.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d68) returned 0x2a4a70 [0215.206] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x3d60, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3d60, lpOverlapped=0x0) returned 1 [0215.208] CloseHandle (hObject=0xdc) returned 1 [0215.208] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 1 [0215.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0215.209] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0215.209] GetTickCount () returned 0x4563a [0215.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0215.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0215.209] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284218\\...."), lpSecurityAttributes=0x256210) returned 1 [0215.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284218\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284218\\....\\temporaryfile")) returned 0 [0215.210] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284218\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284218\\temporaryfile")) returned 1 [0215.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284218\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8538fba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8538fba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8538fba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.211] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8538fba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8538fba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8538fba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.211] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8538fba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8538fba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8538fba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284218\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8538fba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8538fba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8538fba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8538fba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8538fba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8538fba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8538fba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8538fba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8538fba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.211] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284218\\temporaryfile")) returned 1 [0215.212] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8538fba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8538fba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8538fba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.212] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284218" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284218")) returned 1 [0215.212] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 0 [0215.212] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.213] WriteFile (in: hFile=0xdc, lpBuffer=0x2a87e8*, nNumberOfBytesToWrite=0x3d68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a87e8*, lpNumberOfBytesWritten=0x18fdd8*=0x3d68, lpOverlapped=0x0) returned 1 [0215.214] CloseHandle (hObject=0xdc) returned 1 [0215.214] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.214] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4b2700 [0215.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4b2708) returned 0x2650020 [0215.215] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x4b2700, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x4b2700, lpOverlapped=0x0) returned 1 [0215.345] CloseHandle (hObject=0xdc) returned 1 [0215.345] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe")) returned 1 [0215.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0215.351] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0215.351] GetTickCount () returned 0x456c6 [0215.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0215.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0215.352] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284358\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284358\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0215.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284358\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284358\\....\\temporaryfile")) returned 0 [0215.352] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284358\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284358\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284358\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284358\\temporaryfile")) returned 1 [0215.353] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284358\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x854e6800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x854e6800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x854e6800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.354] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x854e6800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x854e6800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x854e6800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.354] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x854e6800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x854e6800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x854e6800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.354] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284358\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x854e6800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x854e6800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x854e6800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.354] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x854e6800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x854e6800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x854e6800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.354] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x854e6800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x854e6800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x854e6800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.354] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.354] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284358\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284358\\temporaryfile")) returned 1 [0215.354] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x854e6800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x854e6800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x854e6800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.354] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.354] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284358" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284358")) returned 1 [0215.354] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 0 [0215.577] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.578] WriteFile (in: hFile=0xdc, lpBuffer=0x2fd0028*, nNumberOfBytesToWrite=0x4b2708, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2fd0028*, lpNumberOfBytesWritten=0x18fdd8*=0x4b2708, lpOverlapped=0x0) returned 1 [0215.663] CloseHandle (hObject=0xdc) returned 1 [0215.703] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.704] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x23b10 [0215.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23b18) returned 0x2a4a70 [0215.704] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x23b10, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x23b10, lpOverlapped=0x0) returned 1 [0215.713] CloseHandle (hObject=0xdc) returned 1 [0215.713] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 1 [0215.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0215.715] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0215.715] GetTickCount () returned 0x4582d [0215.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0215.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0215.716] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284717\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284717\\...."), lpSecurityAttributes=0x256210) returned 1 [0215.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284717\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284717\\....\\temporaryfile")) returned 0 [0215.716] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284717\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284717\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284717\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284717\\temporaryfile")) returned 1 [0215.717] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284717\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858527a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858527a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858527a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.718] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858527a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858527a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858527a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.718] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858527a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858527a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858527a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.718] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284717\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858527a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858527a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858527a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.718] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858527a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858527a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858527a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.718] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858527a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858527a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858527a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.718] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.718] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284717\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284717\\temporaryfile")) returned 1 [0215.718] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858527a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858527a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858527a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.718] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.718] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284717" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284717")) returned 1 [0215.718] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 0 [0215.721] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.721] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8598*, nNumberOfBytesToWrite=0x23b18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8598*, lpNumberOfBytesWritten=0x18fdd8*=0x23b18, lpOverlapped=0x0) returned 1 [0215.724] CloseHandle (hObject=0xdc) returned 1 [0215.724] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.724] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xba5e [0215.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xba66) returned 0x2a4a70 [0215.724] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0xba5e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0xba5e, lpOverlapped=0x0) returned 1 [0215.726] CloseHandle (hObject=0xdc) returned 1 [0215.726] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 1 [0215.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0215.727] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0215.727] GetTickCount () returned 0x4583d [0215.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0215.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0215.728] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284733\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284733\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0215.728] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284733\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284733\\....\\temporaryfile")) returned 0 [0215.728] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284733\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284733\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284733\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284733\\temporaryfile")) returned 1 [0215.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284733\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85878900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85878900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85878900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.730] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85878900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85878900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85878900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.730] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85878900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85878900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85878900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.730] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284733\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85878900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85878900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85878900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.730] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85878900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85878900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85878900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.730] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85878900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85878900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85878900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.730] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.730] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284733\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284733\\temporaryfile")) returned 1 [0215.730] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85878900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85878900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85878900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.730] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.730] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284733" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284733")) returned 1 [0215.730] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 0 [0215.731] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.732] WriteFile (in: hFile=0xdc, lpBuffer=0x2b04e8*, nNumberOfBytesToWrite=0xba68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b04e8*, lpNumberOfBytesWritten=0x18fdd8*=0xba68, lpOverlapped=0x0) returned 1 [0215.733] CloseHandle (hObject=0xdc) returned 1 [0215.733] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0215.733] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x85878900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85878900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0215.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0215.734] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0215.734] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5b0da70, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.735] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5b0da70, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0215.735] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x5b0da70, dwReserved1=0x1d301bf, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0215.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256210 [0215.735] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.735] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x90540 [0215.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x90548) returned 0x1d70020 [0215.736] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x90540, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0x90540, lpOverlapped=0x0) returned 1 [0215.747] CloseHandle (hObject=0xdc) returned 1 [0215.747] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 1 [0215.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0215.752] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0215.752] GetTickCount () returned 0x4585c [0215.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0215.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0215.753] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284764\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0215.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284764\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284764\\....\\temporaryfile")) returned 0 [0215.754] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284764\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284764\\temporaryfile")) returned 1 [0215.755] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284764\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858c4bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858c4bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858c4bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x16, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.755] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858c4bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858c4bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858c4bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x16, cFileName="..", cAlternateFileName="")) returned 1 [0215.755] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858c4bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858c4bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858c4bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.755] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284764\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858c4bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858c4bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858c4bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0215.755] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858c4bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858c4bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858c4bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.755] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858c4bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858c4bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858c4bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.755] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0215.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284764\\temporaryfile")) returned 1 [0215.755] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x858c4bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x858c4bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x858c4bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x16, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.755] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.756] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284764" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284764")) returned 1 [0215.756] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 0 [0215.792] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.792] WriteFile (in: hFile=0xdc, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x90548, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdd8*=0x90548, lpOverlapped=0x0) returned 1 [0215.801] CloseHandle (hObject=0xdc) returned 1 [0215.806] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.808] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6c67b [0215.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6c683) returned 0x2a4a70 [0215.808] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x6c67b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x6c67b, lpOverlapped=0x0) returned 1 [0215.812] CloseHandle (hObject=0xdc) returned 1 [0215.812] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 1 [0215.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0215.816] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0215.816] GetTickCount () returned 0x4589a [0215.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0215.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0215.816] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284826\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284826\\...."), lpSecurityAttributes=0x256210) returned 1 [0215.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284826\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284826\\....\\temporaryfile")) returned 0 [0215.817] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284826\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284826\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284826\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284826\\temporaryfile")) returned 1 [0215.818] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284826\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8595d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8595d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8595d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.818] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8595d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8595d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8595d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.818] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8595d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8595d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8595d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.818] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284826\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8595d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8595d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8595d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0215.818] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8595d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8595d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8595d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.819] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8595d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8595d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8595d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.819] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0215.819] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284826\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284826\\temporaryfile")) returned 1 [0215.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8595d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8595d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8595d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.819] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.819] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284826" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284826")) returned 1 [0215.819] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 0 [0215.836] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.838] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x6c680, lpOverlapped=0x0) returned 1 [0215.845] CloseHandle (hObject=0xdc) returned 1 [0215.845] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.846] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x60983 [0215.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6098b) returned 0x2a4a70 [0215.846] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x60983, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x60983, lpOverlapped=0x0) returned 1 [0215.849] CloseHandle (hObject=0xdc) returned 1 [0215.849] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 1 [0215.852] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0215.852] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.852] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0215.853] GetTickCount () returned 0x458b9 [0215.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0215.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0215.853] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284857\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284857\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0215.853] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284857\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284857\\....\\temporaryfile")) returned 0 [0215.854] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284857\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284857\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284857\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284857\\temporaryfile")) returned 1 [0215.855] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284857\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859a9400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859a9400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859a9400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.855] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859a9400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859a9400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859a9400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.855] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859a9400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859a9400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859a9400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.855] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284857\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859a9400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859a9400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859a9400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0215.855] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859a9400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859a9400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859a9400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.855] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859a9400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859a9400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859a9400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.855] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0215.855] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284857\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284857\\temporaryfile")) returned 1 [0215.856] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859a9400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859a9400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859a9400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.856] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.856] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284857" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284857")) returned 1 [0215.856] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 0 [0215.866] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.867] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x60988, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x60988, lpOverlapped=0x0) returned 1 [0215.873] CloseHandle (hObject=0xdc) returned 1 [0215.873] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.874] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x482ef [0215.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x482f7) returned 0x2a4a70 [0215.874] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x482ef, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x482ef, lpOverlapped=0x0) returned 1 [0215.877] CloseHandle (hObject=0xdc) returned 1 [0215.877] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 1 [0215.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0215.880] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0215.880] GetTickCount () returned 0x458d9 [0215.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0215.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0215.881] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284889\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284889\\...."), lpSecurityAttributes=0x256210) returned 1 [0215.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284889\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284889\\....\\temporaryfile")) returned 0 [0215.881] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284889\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284889\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284889\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284889\\temporaryfile")) returned 1 [0215.883] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284889\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f56c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859f56c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859f56c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.883] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f56c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859f56c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859f56c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.883] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f56c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859f56c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859f56c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.883] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284889\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f56c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859f56c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859f56c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0215.883] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f56c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859f56c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859f56c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.883] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f56c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859f56c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859f56c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.883] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0215.883] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284889\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284889\\temporaryfile")) returned 1 [0215.883] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f56c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x859f56c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859f56c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.883] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.883] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284889" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284889")) returned 1 [0215.884] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 0 [0215.888] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.892] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x482f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x482f8, lpOverlapped=0x0) returned 1 [0215.897] CloseHandle (hObject=0xdc) returned 1 [0215.897] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.897] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x859f56c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x859f56c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0215.897] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.897] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed123f0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0215.899] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed123f0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0215.899] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed123f0, dwReserved1=0x1d301be, cFileName="1033", cAlternateFileName="")) returned 1 [0215.900] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0xeed123f0, dwReserved1=0x1d301be, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0215.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0215.900] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.900] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e380 [0215.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e388) returned 0x2a4a70 [0215.901] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x1e380, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1e380, lpOverlapped=0x0) returned 1 [0215.902] CloseHandle (hObject=0xdc) returned 1 [0215.902] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 1 [0215.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0215.904] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0215.904] GetTickCount () returned 0x458e8 [0215.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0215.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0215.905] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284904\\...."), lpSecurityAttributes=0x256198) returned 1 [0215.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284904\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284904\\....\\temporaryfile")) returned 0 [0215.905] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284904\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284904\\temporaryfile")) returned 1 [0215.906] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284904\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1b820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a1b820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a1b820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.906] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1b820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a1b820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a1b820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0215.907] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1b820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a1b820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a1b820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.907] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284904\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1b820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a1b820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a1b820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.907] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1b820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a1b820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a1b820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.907] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1b820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a1b820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a1b820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.907] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.907] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284904\\temporaryfile")) returned 1 [0215.907] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1b820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a1b820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a1b820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.907] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.907] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284904" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284904")) returned 1 [0215.907] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 0 [0215.909] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.910] WriteFile (in: hFile=0xdc, lpBuffer=0x2c2e08*, nNumberOfBytesToWrite=0x1e388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c2e08*, lpNumberOfBytesWritten=0x18fdd8*=0x1e388, lpOverlapped=0x0) returned 1 [0215.912] CloseHandle (hObject=0xdc) returned 1 [0215.912] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.913] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17f80 [0215.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17f88) returned 0x2a4a70 [0215.913] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x17f80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x17f80, lpOverlapped=0x0) returned 1 [0215.915] CloseHandle (hObject=0xdc) returned 1 [0215.915] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 1 [0215.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0215.916] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0215.916] GetTickCount () returned 0x458f8 [0215.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0215.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0215.917] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284920\\...."), lpSecurityAttributes=0x256210) returned 1 [0215.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284920\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284920\\....\\temporaryfile")) returned 0 [0215.918] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284920\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284920\\temporaryfile")) returned 1 [0215.919] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284920\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a41980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a41980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a41980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.919] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a41980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a41980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a41980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.919] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a41980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a41980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a41980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.919] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284920\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a41980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a41980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a41980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.919] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a41980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a41980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a41980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.919] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a41980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a41980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a41980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.919] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.919] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284920\\temporaryfile")) returned 1 [0215.919] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a41980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a41980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a41980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.919] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.919] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284920" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284920")) returned 1 [0215.920] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 0 [0215.921] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.922] WriteFile (in: hFile=0xdc, lpBuffer=0x2bca08*, nNumberOfBytesToWrite=0x17f88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bca08*, lpNumberOfBytesWritten=0x18fdd8*=0x17f88, lpOverlapped=0x0) returned 1 [0215.924] CloseHandle (hObject=0xdc) returned 1 [0215.924] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.925] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x35380 [0215.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x35388) returned 0x2a4a70 [0215.925] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x35380, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x35380, lpOverlapped=0x0) returned 1 [0215.928] CloseHandle (hObject=0xdc) returned 1 [0215.928] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 1 [0215.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0215.930] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0215.930] GetTickCount () returned 0x45907 [0215.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0215.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0215.930] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284935\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284935\\...."), lpSecurityAttributes=0x256198) returned 1 [0215.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284935\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284935\\....\\temporaryfile")) returned 0 [0215.931] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284935\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284935\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284935\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284935\\temporaryfile")) returned 1 [0215.932] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284935\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a67ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a67ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a67ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.932] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a67ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a67ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a67ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.932] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a67ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a67ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a67ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.932] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284935\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a67ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a67ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a67ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.932] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a67ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a67ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a67ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.932] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a67ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a67ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a67ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.933] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.933] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284935\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284935\\temporaryfile")) returned 1 [0215.933] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a67ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a67ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a67ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.933] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.933] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284935" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284935")) returned 1 [0215.933] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 0 [0215.936] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.937] WriteFile (in: hFile=0xdc, lpBuffer=0x2d9e08*, nNumberOfBytesToWrite=0x35388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d9e08*, lpNumberOfBytesWritten=0x18fdd8*=0x35388, lpOverlapped=0x0) returned 1 [0215.940] CloseHandle (hObject=0xdc) returned 1 [0215.940] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.941] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2c380 [0215.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c388) returned 0x2a4a70 [0215.941] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x2c380, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2c380, lpOverlapped=0x0) returned 1 [0215.943] CloseHandle (hObject=0xdc) returned 1 [0215.943] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 1 [0215.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0215.945] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0215.945] GetTickCount () returned 0x45917 [0215.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0215.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0215.946] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284951\\...."), lpSecurityAttributes=0x256210) returned 1 [0215.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284951\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284951\\....\\temporaryfile")) returned 0 [0215.947] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284951\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284951\\temporaryfile")) returned 1 [0215.948] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284951\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8dc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a8dc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a8dc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.948] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8dc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a8dc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a8dc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.948] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8dc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a8dc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a8dc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.948] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284951\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8dc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a8dc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a8dc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.948] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8dc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a8dc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a8dc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.948] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8dc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a8dc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a8dc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.948] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.948] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284951\\temporaryfile")) returned 1 [0215.948] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8dc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85a8dc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85a8dc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.948] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.948] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284951" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284951")) returned 1 [0215.949] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 0 [0215.951] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.952] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0e08*, nNumberOfBytesToWrite=0x2c388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0e08*, lpNumberOfBytesWritten=0x18fdd8*=0x2c388, lpOverlapped=0x0) returned 1 [0215.955] CloseHandle (hObject=0xdc) returned 1 [0215.955] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.956] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x26d80 [0215.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26d88) returned 0x2a4a70 [0215.956] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x26d80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x26d80, lpOverlapped=0x0) returned 1 [0215.958] CloseHandle (hObject=0xdc) returned 1 [0215.958] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 1 [0215.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0215.960] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0215.960] GetTickCount () returned 0x45927 [0215.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0215.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0215.961] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284967\\...."), lpSecurityAttributes=0x256198) returned 1 [0215.961] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284967\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284967\\....\\temporaryfile")) returned 0 [0215.961] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284967\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284967\\temporaryfile")) returned 1 [0215.962] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284967\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab3da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ab3da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ab3da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.963] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab3da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ab3da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ab3da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.963] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab3da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ab3da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ab3da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.963] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284967\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab3da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ab3da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ab3da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.963] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab3da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ab3da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ab3da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.963] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab3da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ab3da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ab3da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.963] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.963] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284967\\temporaryfile")) returned 1 [0215.963] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab3da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ab3da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ab3da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.963] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.963] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284967" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284967")) returned 1 [0215.963] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 0 [0215.966] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.966] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb808*, nNumberOfBytesToWrite=0x26d88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb808*, lpNumberOfBytesWritten=0x18fdd8*=0x26d88, lpOverlapped=0x0) returned 1 [0215.969] CloseHandle (hObject=0xdc) returned 1 [0215.969] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.971] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x39580 [0215.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x39588) returned 0x2a4a70 [0215.971] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x39580, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x39580, lpOverlapped=0x0) returned 1 [0215.974] CloseHandle (hObject=0xdc) returned 1 [0215.974] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 1 [0215.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0215.976] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0215.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0215.976] GetTickCount () returned 0x45936 [0215.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0215.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0215.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0215.976] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284982\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284982\\...."), lpSecurityAttributes=0x256210) returned 1 [0215.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284982\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284982\\....\\temporaryfile")) returned 0 [0215.977] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284982\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284982\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284982\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284982\\temporaryfile")) returned 1 [0215.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284982\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ad9f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ad9f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ad9f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0215.978] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ad9f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ad9f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ad9f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.978] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ad9f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ad9f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ad9f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0215.979] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284982\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ad9f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ad9f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ad9f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0215.979] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ad9f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ad9f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ad9f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.979] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ad9f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ad9f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ad9f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.979] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0215.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284982\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284982\\temporaryfile")) returned 1 [0215.979] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ad9f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ad9f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ad9f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0215.979] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0215.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18284982" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18284982")) returned 1 [0215.979] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 0 [0215.983] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.983] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x39588, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x39588, lpOverlapped=0x0) returned 1 [0215.998] CloseHandle (hObject=0xdc) returned 1 [0215.998] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0215.999] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18b80 [0215.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18b88) returned 0x2a4a70 [0215.999] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x18b80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x18b80, lpOverlapped=0x0) returned 1 [0216.002] CloseHandle (hObject=0xdc) returned 1 [0216.002] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 1 [0216.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.003] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.004] GetTickCount () returned 0x45955 [0216.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.004] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285013\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285013\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285013\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285013\\....\\temporaryfile")) returned 0 [0216.005] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285013\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285013\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285013\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285013\\temporaryfile")) returned 1 [0216.006] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285013\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b261c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b261c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b261c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.006] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b261c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b261c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b261c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.006] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b261c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b261c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b261c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.006] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285013\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b261c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b261c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b261c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.006] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b261c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b261c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b261c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.006] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b261c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b261c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b261c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.006] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.006] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285013\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285013\\temporaryfile")) returned 1 [0216.006] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b261c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b261c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b261c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.006] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.006] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285013" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285013")) returned 1 [0216.007] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 0 [0216.008] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.009] WriteFile (in: hFile=0xdc, lpBuffer=0x2bd608*, nNumberOfBytesToWrite=0x18b88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bd608*, lpNumberOfBytesWritten=0x18fdd8*=0x18b88, lpOverlapped=0x0) returned 1 [0216.011] CloseHandle (hObject=0xdc) returned 1 [0216.011] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.012] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b180 [0216.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b188) returned 0x2a4a70 [0216.012] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x1b180, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b180, lpOverlapped=0x0) returned 1 [0216.033] CloseHandle (hObject=0xdc) returned 1 [0216.033] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 1 [0216.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.037] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.037] GetTickCount () returned 0x45975 [0216.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.038] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285045\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285045\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285045\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285045\\....\\temporaryfile")) returned 0 [0216.039] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285045\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285045\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285045\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285045\\temporaryfile")) returned 1 [0216.040] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285045\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b72480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b72480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b72480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.040] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b72480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b72480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b72480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.040] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b72480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b72480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b72480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.040] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285045\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b72480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b72480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b72480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.040] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b72480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b72480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b72480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.040] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b72480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b72480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b72480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.040] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.040] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285045\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285045\\temporaryfile")) returned 1 [0216.041] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b72480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85b72480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85b72480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.041] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.041] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285045" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285045")) returned 1 [0216.041] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 0 [0216.043] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.043] WriteFile (in: hFile=0xdc, lpBuffer=0x2bfc08*, nNumberOfBytesToWrite=0x1b188, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bfc08*, lpNumberOfBytesWritten=0x18fdd8*=0x1b188, lpOverlapped=0x0) returned 1 [0216.045] CloseHandle (hObject=0xdc) returned 1 [0216.045] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.046] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x120eb8 [0216.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x120ec0) returned 0x2650020 [0216.047] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x120eb8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x120eb8, lpOverlapped=0x0) returned 1 [0216.077] CloseHandle (hObject=0xdc) returned 1 [0216.077] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0216.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.079] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.079] GetTickCount () returned 0x459a3 [0216.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.080] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285091\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285091\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.080] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285091\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285091\\....\\temporaryfile")) returned 0 [0216.080] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285091\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285091\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285091\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285091\\temporaryfile")) returned 1 [0216.081] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285091\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85be48a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85be48a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85be48a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.082] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85be48a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85be48a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85be48a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.082] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85be48a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85be48a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85be48a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.082] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285091\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85be48a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85be48a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85be48a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.082] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85be48a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85be48a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85be48a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.082] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85be48a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85be48a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85be48a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.082] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.082] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285091\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285091\\temporaryfile")) returned 1 [0216.082] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85be48a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85be48a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85be48a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.082] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.082] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285091" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285091")) returned 1 [0216.082] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 0 [0216.132] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.133] WriteFile (in: hFile=0xdc, lpBuffer=0x28b0028*, nNumberOfBytesToWrite=0x120ec0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28b0028*, lpNumberOfBytesWritten=0x18fdd8*=0x120ec0, lpOverlapped=0x0) returned 1 [0216.163] CloseHandle (hObject=0xdc) returned 1 [0216.174] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.175] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x59180 [0216.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x59188) returned 0x2a4a70 [0216.175] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x59180, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x59180, lpOverlapped=0x0) returned 1 [0216.179] CloseHandle (hObject=0xdc) returned 1 [0216.179] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 1 [0216.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.182] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.182] GetTickCount () returned 0x45a01 [0216.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.183] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285185\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285185\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285185\\....\\temporaryfile")) returned 0 [0216.184] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285185\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285185\\temporaryfile")) returned 1 [0216.185] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285185\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cc90e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cc90e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cc90e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.185] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cc90e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cc90e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cc90e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.185] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cc90e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cc90e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cc90e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.185] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285185\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cc90e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cc90e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cc90e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.185] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cc90e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cc90e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cc90e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.185] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cc90e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cc90e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cc90e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.185] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.185] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285185\\temporaryfile")) returned 1 [0216.185] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cc90e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cc90e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cc90e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.185] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.186] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285185" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285185")) returned 1 [0216.186] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 0 [0216.191] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.192] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x59188, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x59188, lpOverlapped=0x0) returned 1 [0216.198] CloseHandle (hObject=0xdc) returned 1 [0216.198] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.199] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3574 [0216.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x357c) returned 0x299460 [0216.199] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x3574, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x3574, lpOverlapped=0x0) returned 1 [0216.201] CloseHandle (hObject=0xdc) returned 1 [0216.201] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 1 [0216.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.202] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.202] GetTickCount () returned 0x45a11 [0216.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.202] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285201\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285201\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285201\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285201\\....\\temporaryfile")) returned 0 [0216.203] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285201\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285201\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285201\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285201\\temporaryfile")) returned 1 [0216.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285201\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cef240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cef240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cef240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.204] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cef240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cef240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cef240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.204] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cef240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cef240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cef240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285201\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cef240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cef240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cef240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.204] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cef240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cef240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cef240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.204] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cef240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cef240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cef240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.204] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285201\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285201\\temporaryfile")) returned 1 [0216.205] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cef240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85cef240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85cef240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.205] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285201" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285201")) returned 1 [0216.205] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 0 [0216.205] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.206] WriteFile (in: hFile=0xdc, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x3578, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x3578, lpOverlapped=0x0) returned 1 [0216.207] CloseHandle (hObject=0xdc) returned 1 [0216.207] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.208] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d80 [0216.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d88) returned 0x2a4a70 [0216.208] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x3d80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3d80, lpOverlapped=0x0) returned 1 [0216.209] CloseHandle (hObject=0xdc) returned 1 [0216.209] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 1 [0216.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.210] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.210] GetTickCount () returned 0x45a20 [0216.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.211] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285216\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285216\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285216\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285216\\....\\temporaryfile")) returned 0 [0216.212] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285216\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285216\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285216\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285216\\temporaryfile")) returned 1 [0216.213] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285216\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d153a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d153a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d153a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.213] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d153a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d153a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d153a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.213] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d153a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d153a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d153a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.213] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285216\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d153a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d153a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d153a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.213] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d153a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d153a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d153a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.213] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d153a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d153a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d153a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.213] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.213] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285216\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285216\\temporaryfile")) returned 1 [0216.214] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d153a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d153a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d153a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.214] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.214] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285216" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285216")) returned 1 [0216.214] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 0 [0216.214] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.215] WriteFile (in: hFile=0xdc, lpBuffer=0x2a8808*, nNumberOfBytesToWrite=0x3d88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a8808*, lpNumberOfBytesWritten=0x18fdd8*=0x3d88, lpOverlapped=0x0) returned 1 [0216.216] CloseHandle (hObject=0xdc) returned 1 [0216.216] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0216.216] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x85d153a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d153a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0216.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0216.216] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeee1cd90, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.217] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeee1cd90, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0216.217] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0xeee1cd90, dwReserved1=0x1d301be, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0216.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0216.217] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.218] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2cc7 [0216.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ccf) returned 0x299460 [0216.218] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x2cc7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x2cc7, lpOverlapped=0x0) returned 1 [0216.219] CloseHandle (hObject=0xe0) returned 1 [0216.219] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0216.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.220] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.220] GetTickCount () returned 0x45a30 [0216.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0216.221] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.221] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232\\....\\temporaryfile")) returned 0 [0216.221] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232\\temporaryfile")) returned 1 [0216.222] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.222] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0216.222] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.222] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.223] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.223] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.223] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.223] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232\\temporaryfile")) returned 1 [0216.223] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.223] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.223] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232")) returned 1 [0216.223] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 0 [0216.224] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.224] WriteFile (in: hFile=0xe0, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fdb8*=0x2cd0, lpOverlapped=0x0) returned 1 [0216.225] CloseHandle (hObject=0xe0) returned 1 [0216.225] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.226] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4380 [0216.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4388) returned 0x2a4a70 [0216.226] ReadFile (in: hFile=0xe0, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x4380, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4380, lpOverlapped=0x0) returned 1 [0216.228] CloseHandle (hObject=0xe0) returned 1 [0216.228] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 1 [0216.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.229] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.229] GetTickCount () returned 0x45a30 [0216.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0216.230] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232\\....\\temporaryfile")) returned 0 [0216.230] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232\\temporaryfile")) returned 1 [0216.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.232] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.232] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.232] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.232] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232\\temporaryfile")) returned 1 [0216.232] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d3b500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d3b500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d3b500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.232] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.232] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285232" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285232")) returned 1 [0216.232] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 0 [0216.233] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.235] WriteFile (in: hFile=0xe0, lpBuffer=0x2a8e08*, nNumberOfBytesToWrite=0x4388, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a8e08*, lpNumberOfBytesWritten=0x18fdb8*=0x4388, lpOverlapped=0x0) returned 1 [0216.236] CloseHandle (hObject=0xe0) returned 1 [0216.236] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.237] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3580 [0216.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3588) returned 0x299460 [0216.237] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x3580, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x3580, lpOverlapped=0x0) returned 1 [0216.238] CloseHandle (hObject=0xe0) returned 1 [0216.238] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 1 [0216.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.242] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.242] GetTickCount () returned 0x45a3f [0216.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0216.243] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285247\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285247\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285247\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285247\\....\\temporaryfile")) returned 0 [0216.244] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285247\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285247\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285247\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285247\\temporaryfile")) returned 1 [0216.244] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285247\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d61660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d61660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d61660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.245] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d61660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d61660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d61660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.245] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d61660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d61660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d61660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.245] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285247\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d61660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d61660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d61660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.245] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d61660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d61660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d61660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.245] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d61660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d61660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d61660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.245] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.245] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285247\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285247\\temporaryfile")) returned 1 [0216.245] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d61660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d61660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d61660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.245] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.245] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285247" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285247")) returned 1 [0216.245] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 0 [0216.246] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.246] WriteFile (in: hFile=0xe0, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x3588, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fdb8*=0x3588, lpOverlapped=0x0) returned 1 [0216.247] CloseHandle (hObject=0xe0) returned 1 [0216.247] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.248] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x85d61660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d61660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0216.248] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.248] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed123f0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed123f0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0216.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed123f0, dwReserved1=0x1d301be, cFileName="1033", cAlternateFileName="")) returned 1 [0216.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0xeed123f0, dwReserved1=0x1d301be, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0216.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256198 [0216.249] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.251] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x377ef [0216.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x377f7) returned 0x2a4a70 [0216.251] ReadFile (in: hFile=0xe0, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x377ef, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdd0*=0x377ef, lpOverlapped=0x0) returned 1 [0216.253] CloseHandle (hObject=0xe0) returned 1 [0216.253] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0216.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.255] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.255] GetTickCount () returned 0x45a4f [0216.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0216.256] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285263\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285263\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285263\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285263\\....\\temporaryfile")) returned 0 [0216.256] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285263\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285263\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285263\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285263\\temporaryfile")) returned 1 [0216.257] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285263\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d877c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d877c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d877c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.257] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d877c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d877c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d877c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0216.257] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d877c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d877c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d877c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.257] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285263\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d877c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d877c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d877c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.257] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d877c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d877c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d877c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.257] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d877c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d877c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d877c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.257] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.257] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285263\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285263\\temporaryfile")) returned 1 [0216.258] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85d877c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85d877c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d877c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.258] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.258] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285263" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285263")) returned 1 [0216.258] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 0 [0216.261] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.262] WriteFile (in: hFile=0xe0, lpBuffer=0x2dc278*, nNumberOfBytesToWrite=0x377f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2dc278*, lpNumberOfBytesWritten=0x18fdb8*=0x377f8, lpOverlapped=0x0) returned 1 [0216.265] CloseHandle (hObject=0xe0) returned 1 [0216.265] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.265] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x85d877c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85d877c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0216.266] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed123f0, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeed123f0, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0216.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0xeed123f0, dwReserved1=0x1d301be, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0216.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256198 [0216.266] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0216.267] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x22d6 [0216.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22de) returned 0x299460 [0216.267] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x22d6, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x22d6, lpOverlapped=0x0) returned 1 [0216.268] CloseHandle (hObject=0xe4) returned 1 [0216.268] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0216.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.269] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.269] GetTickCount () returned 0x45a5f [0216.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.270] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279\\....\\temporaryfile")) returned 0 [0216.270] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279\\temporaryfile")) returned 1 [0216.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.271] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.271] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.271] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.271] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.271] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.271] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279\\temporaryfile")) returned 1 [0216.272] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.272] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279")) returned 1 [0216.272] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 0 [0216.272] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0216.273] WriteFile (in: hFile=0xe4, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fd98*=0x22e0, lpOverlapped=0x0) returned 1 [0216.273] CloseHandle (hObject=0xe4) returned 1 [0216.274] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0216.274] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x734 [0216.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x73c) returned 0x25f580 [0216.274] ReadFile (in: hFile=0xe4, lpBuffer=0x25f588, nNumberOfBytesToRead=0x734, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdb0*=0x734, lpOverlapped=0x0) returned 1 [0216.275] CloseHandle (hObject=0xe4) returned 1 [0216.275] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0216.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.276] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.276] GetTickCount () returned 0x45a5f [0216.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.277] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.277] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279\\....\\temporaryfile")) returned 0 [0216.278] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279\\temporaryfile")) returned 1 [0216.279] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.279] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.279] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.279] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.279] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.279] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.279] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.279] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279\\temporaryfile")) returned 1 [0216.279] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dad920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dad920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dad920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.279] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.279] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285279" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285279")) returned 1 [0216.279] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 0 [0216.280] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0216.281] WriteFile (in: hFile=0xe4, lpBuffer=0x25fcd0*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25fcd0*, lpNumberOfBytesWritten=0x18fd98*=0x738, lpOverlapped=0x0) returned 1 [0216.282] CloseHandle (hObject=0xe4) returned 1 [0216.282] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0216.283] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x9869 [0216.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9871) returned 0x2a4a70 [0216.283] ReadFile (in: hFile=0xe4, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x9869, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdb0*=0x9869, lpOverlapped=0x0) returned 1 [0216.284] CloseHandle (hObject=0xe4) returned 1 [0216.284] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0216.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.286] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.286] GetTickCount () returned 0x45a6e [0216.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.286] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294\\....\\temporaryfile")) returned 0 [0216.287] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294\\temporaryfile")) returned 1 [0216.288] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.288] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.288] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.288] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.288] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.288] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.288] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.288] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294\\temporaryfile")) returned 1 [0216.288] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.288] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.288] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294")) returned 1 [0216.289] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 0 [0216.289] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0216.290] WriteFile (in: hFile=0xe4, lpBuffer=0x2ae2f8*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2ae2f8*, lpNumberOfBytesWritten=0x18fd98*=0x9870, lpOverlapped=0x0) returned 1 [0216.291] CloseHandle (hObject=0xe4) returned 1 [0216.291] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0216.292] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xa7f [0216.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa87) returned 0x25f580 [0216.292] ReadFile (in: hFile=0xe4, lpBuffer=0x25f588, nNumberOfBytesToRead=0xa7f, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdb0*=0xa7f, lpOverlapped=0x0) returned 1 [0216.293] CloseHandle (hObject=0xe4) returned 1 [0216.293] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0216.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.294] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.294] GetTickCount () returned 0x45a6e [0216.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.295] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294\\....\\temporaryfile")) returned 0 [0216.295] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294\\temporaryfile")) returned 1 [0216.296] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.296] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.296] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.296] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.296] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.297] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.297] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.297] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294\\temporaryfile")) returned 1 [0216.298] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd3a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85dd3a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85dd3a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.298] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.298] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285294" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285294")) returned 1 [0216.319] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 0 [0216.324] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0216.324] WriteFile (in: hFile=0xe4, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xa88, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fd98*=0xa88, lpOverlapped=0x0) returned 1 [0216.325] CloseHandle (hObject=0xe4) returned 1 [0216.325] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0216.326] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2174 [0216.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x217c) returned 0x299460 [0216.326] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x2174, lpOverlapped=0x0) returned 1 [0216.327] CloseHandle (hObject=0xe4) returned 1 [0216.327] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0216.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.328] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.328] GetTickCount () returned 0x45a9d [0216.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.329] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341\\....\\temporaryfile")) returned 0 [0216.329] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341\\temporaryfile")) returned 1 [0216.330] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.330] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.330] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.331] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.331] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.331] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.331] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.331] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341\\temporaryfile")) returned 1 [0216.331] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.331] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.331] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341")) returned 1 [0216.331] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 0 [0216.332] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0216.332] WriteFile (in: hFile=0xe4, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x2178, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fd98*=0x2178, lpOverlapped=0x0) returned 1 [0216.333] CloseHandle (hObject=0xe4) returned 1 [0216.333] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.333] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0216.333] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.333] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.334] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0216.334] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeef4d890, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0216.335] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeef4d890, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0216.335] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0xeef4d890, dwReserved1=0x1d301be, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0216.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9a0 [0216.335] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.335] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a968 [0216.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a970) returned 0x2a4a70 [0216.335] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x2a968, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2a968, lpOverlapped=0x0) returned 1 [0216.337] CloseHandle (hObject=0xdc) returned 1 [0216.337] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0216.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0216.339] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.339] GetTickCount () returned 0x45a9d [0216.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.340] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0216.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341\\....\\temporaryfile")) returned 0 [0216.340] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341\\temporaryfile")) returned 1 [0216.341] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.341] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0216.341] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.341] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.341] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.342] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.342] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.342] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341\\temporaryfile")) returned 1 [0216.342] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e45ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e45ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e45ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.342] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.342] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285341" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285341")) returned 1 [0216.342] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 0 [0216.345] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.345] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf3f0*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf3f0*, lpNumberOfBytesWritten=0x18fdd8*=0x2a970, lpOverlapped=0x0) returned 1 [0216.348] CloseHandle (hObject=0xdc) returned 1 [0216.348] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0216.348] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x85e6c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e6c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0216.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0216.348] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0216.349] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0216.351] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0216.351] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0216.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256198 [0216.351] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.352] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xff [0216.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x107) returned 0x28f1f8 [0216.352] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0xff, lpOverlapped=0x0) returned 1 [0216.353] CloseHandle (hObject=0xdc) returned 1 [0216.353] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0 [0216.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.353] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.353] GetTickCount () returned 0x45aad [0216.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.353] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285357\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285357\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285357\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285357\\....\\temporaryfile")) returned 0 [0216.354] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285357\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285357\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285357\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285357\\temporaryfile")) returned 1 [0216.355] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285357\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e6c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e6c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.355] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e6c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e6c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0216.355] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e6c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e6c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.355] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285357\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e6c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e6c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.355] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e6c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e6c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.355] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e6c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e6c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.355] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.356] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285357\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285357\\temporaryfile")) returned 1 [0216.356] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e6c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e6c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.356] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.356] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285357" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285357")) returned 1 [0216.356] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 1 [0216.356] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.357] WriteFile (in: hFile=0xdc, lpBuffer=0x29ea90*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29ea90*, lpNumberOfBytesWritten=0x18fdd8*=0x108, lpOverlapped=0x0) returned 1 [0216.357] CloseHandle (hObject=0xdc) returned 1 [0216.358] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.358] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x432 [0216.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x43a) returned 0x262590 [0216.358] ReadFile (in: hFile=0xdc, lpBuffer=0x262598, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesRead=0x18fdf0*=0x432, lpOverlapped=0x0) returned 1 [0216.359] CloseHandle (hObject=0xdc) returned 1 [0216.360] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0 [0216.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.360] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.360] GetTickCount () returned 0x45abc [0216.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.360] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\....\\temporaryfile")) returned 0 [0216.361] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\temporaryfile")) returned 1 [0216.362] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.362] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.362] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.362] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.362] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\temporaryfile")) returned 1 [0216.362] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.362] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.363] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372")) returned 1 [0216.363] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 1 [0216.363] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.363] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x438, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x438, lpOverlapped=0x0) returned 1 [0216.364] CloseHandle (hObject=0xdc) returned 1 [0216.364] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.365] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa0f [0216.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa17) returned 0x25f580 [0216.365] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xa0f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xa0f, lpOverlapped=0x0) returned 1 [0216.367] CloseHandle (hObject=0xdc) returned 1 [0216.367] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0 [0216.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.367] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.367] GetTickCount () returned 0x45abc [0216.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.368] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\....\\temporaryfile")) returned 0 [0216.368] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\temporaryfile")) returned 1 [0216.369] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.369] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.369] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.369] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.369] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.370] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.370] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.370] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\temporaryfile")) returned 1 [0216.370] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85e92160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85e92160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.370] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.370] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372")) returned 1 [0216.370] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 1 [0216.370] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.371] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xa18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xa18, lpOverlapped=0x0) returned 1 [0216.372] CloseHandle (hObject=0xdc) returned 1 [0216.372] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.372] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x11eb [0216.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11f3) returned 0x25b528 [0216.372] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11eb, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x11eb, lpOverlapped=0x0) returned 1 [0216.373] CloseHandle (hObject=0xdc) returned 1 [0216.374] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0 [0216.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.374] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.374] GetTickCount () returned 0x45abc [0216.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.374] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\....\\temporaryfile")) returned 0 [0216.378] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\temporaryfile")) returned 1 [0216.379] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e92160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.380] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372\\temporaryfile")) returned 1 [0216.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.380] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285372" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285372")) returned 1 [0216.380] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 1 [0216.381] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.381] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x11f0, lpOverlapped=0x0) returned 1 [0216.382] CloseHandle (hObject=0xdc) returned 1 [0216.382] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.382] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x90f [0216.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x917) returned 0x25f580 [0216.382] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0x90f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0x90f, lpOverlapped=0x0) returned 1 [0216.384] CloseHandle (hObject=0xdc) returned 1 [0216.384] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0 [0216.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.384] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.384] GetTickCount () returned 0x45acc [0216.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.385] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285388\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285388\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.385] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285388\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285388\\....\\temporaryfile")) returned 0 [0216.385] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285388\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285388\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285388\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285388\\temporaryfile")) returned 1 [0216.386] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285388\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.386] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.386] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.386] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285388\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.387] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.387] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.387] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.387] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285388\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285388\\temporaryfile")) returned 1 [0216.387] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85eb82c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85eb82c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85eb82c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.387] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.387] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285388" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285388")) returned 1 [0216.387] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 1 [0216.387] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.388] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x918, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0x918, lpOverlapped=0x0) returned 1 [0216.392] CloseHandle (hObject=0xdc) returned 1 [0216.392] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.392] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x285 [0216.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28d) returned 0x262590 [0216.392] ReadFile (in: hFile=0xdc, lpBuffer=0x262598, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesRead=0x18fdf0*=0x285, lpOverlapped=0x0) returned 1 [0216.393] CloseHandle (hObject=0xdc) returned 1 [0216.393] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0216.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.394] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.394] GetTickCount () returned 0x45adb [0216.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.395] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403\\....\\temporaryfile")) returned 0 [0216.395] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403\\temporaryfile")) returned 1 [0216.396] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.396] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.396] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.396] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.396] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.396] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.397] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.397] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403\\temporaryfile")) returned 1 [0216.397] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.397] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.397] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403")) returned 1 [0216.397] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 0 [0216.397] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.398] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x290, lpOverlapped=0x0) returned 1 [0216.398] CloseHandle (hObject=0xdc) returned 1 [0216.399] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.399] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xed0 [0216.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xed8) returned 0x25f580 [0216.399] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xed0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xed0, lpOverlapped=0x0) returned 1 [0216.400] CloseHandle (hObject=0xdc) returned 1 [0216.400] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0 [0216.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.400] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.401] GetTickCount () returned 0x45adb [0216.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.401] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403\\....\\temporaryfile")) returned 0 [0216.402] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403\\temporaryfile")) returned 1 [0216.403] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.403] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.403] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.403] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.403] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.403] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.403] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.403] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403\\temporaryfile")) returned 1 [0216.403] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ede420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85ede420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85ede420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.403] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.404] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285403" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285403")) returned 1 [0216.404] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 1 [0216.404] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.404] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xed8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xed8, lpOverlapped=0x0) returned 1 [0216.405] CloseHandle (hObject=0xdc) returned 1 [0216.405] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.406] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe7 [0216.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xef) returned 0x28f1f8 [0216.406] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0xe7, lpOverlapped=0x0) returned 1 [0216.407] CloseHandle (hObject=0xdc) returned 1 [0216.407] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0 [0216.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.407] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.407] GetTickCount () returned 0x45aeb [0216.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.407] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419\\....\\temporaryfile")) returned 0 [0216.408] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419\\temporaryfile")) returned 1 [0216.409] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.409] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.409] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.409] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.409] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.409] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.409] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.409] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419\\temporaryfile")) returned 1 [0216.410] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.410] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.410] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419")) returned 1 [0216.410] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 1 [0216.410] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.410] WriteFile (in: hFile=0xdc, lpBuffer=0x293480*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x293480*, lpNumberOfBytesWritten=0x18fdd8*=0xf0, lpOverlapped=0x0) returned 1 [0216.411] CloseHandle (hObject=0xdc) returned 1 [0216.411] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.412] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5d3f [0216.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5d47) returned 0x2a4a70 [0216.412] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x5d3f, lpOverlapped=0x0) returned 1 [0216.413] CloseHandle (hObject=0xdc) returned 1 [0216.413] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0 [0216.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.413] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.414] GetTickCount () returned 0x45aeb [0216.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.414] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419\\....\\temporaryfile")) returned 0 [0216.419] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419\\temporaryfile")) returned 1 [0216.420] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.420] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.421] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.421] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.421] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.421] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.421] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.421] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419\\temporaryfile")) returned 1 [0216.421] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f04580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f04580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f04580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.421] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.421] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285419" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285419")) returned 1 [0216.421] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 1 [0216.422] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.423] WriteFile (in: hFile=0xdc, lpBuffer=0x2aa7c8*, nNumberOfBytesToWrite=0x5d48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2aa7c8*, lpNumberOfBytesWritten=0x18fdd8*=0x5d48, lpOverlapped=0x0) returned 1 [0216.424] CloseHandle (hObject=0xdc) returned 1 [0216.424] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.425] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1594 [0216.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x159c) returned 0x299460 [0216.425] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x1594, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x1594, lpOverlapped=0x0) returned 1 [0216.426] CloseHandle (hObject=0xdc) returned 1 [0216.426] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0 [0216.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.426] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.426] GetTickCount () returned 0x45afb [0216.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.427] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435\\....\\temporaryfile")) returned 0 [0216.428] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435\\temporaryfile")) returned 1 [0216.429] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.429] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.429] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.429] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.429] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.429] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.429] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435\\temporaryfile")) returned 1 [0216.429] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.429] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435")) returned 1 [0216.430] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 1 [0216.430] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.431] WriteFile (in: hFile=0xdc, lpBuffer=0x29aa10*, nNumberOfBytesToWrite=0x1598, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29aa10*, lpNumberOfBytesWritten=0x18fdd8*=0x1598, lpOverlapped=0x0) returned 1 [0216.432] CloseHandle (hObject=0xdc) returned 1 [0216.432] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.432] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2864 [0216.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x286c) returned 0x299460 [0216.432] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2864, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2864, lpOverlapped=0x0) returned 1 [0216.434] CloseHandle (hObject=0xdc) returned 1 [0216.434] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0 [0216.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.434] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.434] GetTickCount () returned 0x45afb [0216.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.435] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435\\....\\temporaryfile")) returned 0 [0216.436] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435\\temporaryfile")) returned 1 [0216.436] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.437] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.437] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.437] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.437] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.437] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.437] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435\\temporaryfile")) returned 1 [0216.437] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2a6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f2a6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f2a6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.437] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.437] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285435" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285435")) returned 1 [0216.438] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 1 [0216.438] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.438] WriteFile (in: hFile=0xdc, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x2868, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2868, lpOverlapped=0x0) returned 1 [0216.439] CloseHandle (hObject=0xdc) returned 1 [0216.439] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.443] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c7f4 [0216.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c7fc) returned 0x2a4a70 [0216.443] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x1c7f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1c7f4, lpOverlapped=0x0) returned 1 [0216.445] CloseHandle (hObject=0xdc) returned 1 [0216.445] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0 [0216.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.445] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.445] GetTickCount () returned 0x45b0a [0216.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.446] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285450\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.446] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285450\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285450\\....\\temporaryfile")) returned 0 [0216.446] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285450\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285450\\temporaryfile")) returned 1 [0216.447] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285450\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f50840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f50840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f50840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.447] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f50840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f50840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f50840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.447] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f50840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f50840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f50840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.447] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285450\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f50840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f50840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f50840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.447] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f50840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f50840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f50840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.447] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f50840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f50840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f50840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.447] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.447] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285450\\temporaryfile")) returned 1 [0216.448] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f50840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f50840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f50840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.448] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.448] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285450" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285450")) returned 1 [0216.448] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 1 [0216.450] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.450] WriteFile (in: hFile=0xdc, lpBuffer=0x2c1280*, nNumberOfBytesToWrite=0x1c7f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c1280*, lpNumberOfBytesWritten=0x18fdd8*=0x1c7f8, lpOverlapped=0x0) returned 1 [0216.452] CloseHandle (hObject=0xdc) returned 1 [0216.453] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.454] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xed [0216.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf5) returned 0x293478 [0216.454] ReadFile (in: hFile=0xdc, lpBuffer=0x293480, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x293480*, lpNumberOfBytesRead=0x18fdf0*=0xed, lpOverlapped=0x0) returned 1 [0216.454] CloseHandle (hObject=0xdc) returned 1 [0216.454] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0 [0216.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.455] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.455] GetTickCount () returned 0x45b1a [0216.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.455] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466\\....\\temporaryfile")) returned 0 [0216.456] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466\\temporaryfile")) returned 1 [0216.457] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.457] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.457] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.457] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.457] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.457] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466\\temporaryfile")) returned 1 [0216.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.457] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.457] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466")) returned 1 [0216.458] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 1 [0216.458] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.458] WriteFile (in: hFile=0xdc, lpBuffer=0x28f200*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesWritten=0x18fdd8*=0xf8, lpOverlapped=0x0) returned 1 [0216.459] CloseHandle (hObject=0xdc) returned 1 [0216.459] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.459] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1906 [0216.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x190e) returned 0x299460 [0216.460] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x1906, lpOverlapped=0x0) returned 1 [0216.461] CloseHandle (hObject=0xdc) returned 1 [0216.461] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0 [0216.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.461] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.461] GetTickCount () returned 0x45b1a [0216.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.462] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466\\....\\temporaryfile")) returned 0 [0216.463] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466\\temporaryfile")) returned 1 [0216.464] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.464] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.464] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.464] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.464] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.464] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.464] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.464] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466\\temporaryfile")) returned 1 [0216.464] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f769a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f769a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f769a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.464] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.464] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285466" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285466")) returned 1 [0216.464] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 1 [0216.465] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.465] WriteFile (in: hFile=0xdc, lpBuffer=0x29ad80*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29ad80*, lpNumberOfBytesWritten=0x18fdd8*=0x1910, lpOverlapped=0x0) returned 1 [0216.466] CloseHandle (hObject=0xdc) returned 1 [0216.466] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.467] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb68 [0216.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb70) returned 0x25f580 [0216.467] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xb68, lpOverlapped=0x0) returned 1 [0216.468] CloseHandle (hObject=0xdc) returned 1 [0216.468] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0 [0216.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.468] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.468] GetTickCount () returned 0x45b29 [0216.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.469] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\....\\temporaryfile")) returned 0 [0216.470] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\temporaryfile")) returned 1 [0216.470] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.471] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.471] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.471] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.471] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.471] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.471] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.471] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\temporaryfile")) returned 1 [0216.471] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.471] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.471] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481")) returned 1 [0216.471] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 1 [0216.472] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.472] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xb70, lpOverlapped=0x0) returned 1 [0216.473] CloseHandle (hObject=0xdc) returned 1 [0216.473] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.473] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d4a [0216.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d52) returned 0x299460 [0216.473] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x1d4a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x1d4a, lpOverlapped=0x0) returned 1 [0216.475] CloseHandle (hObject=0xdc) returned 1 [0216.475] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0 [0216.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.475] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.475] GetTickCount () returned 0x45b29 [0216.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.476] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.476] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\....\\temporaryfile")) returned 0 [0216.476] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\temporaryfile")) returned 1 [0216.477] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.478] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.478] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.478] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.478] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.478] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.478] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.478] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\temporaryfile")) returned 1 [0216.478] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.478] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.478] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481")) returned 1 [0216.478] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 1 [0216.479] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.479] WriteFile (in: hFile=0xdc, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1d50, lpOverlapped=0x0) returned 1 [0216.480] CloseHandle (hObject=0xdc) returned 1 [0216.480] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.481] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xeb [0216.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf3) returned 0x293478 [0216.481] ReadFile (in: hFile=0xdc, lpBuffer=0x293480, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x293480*, lpNumberOfBytesRead=0x18fdf0*=0xeb, lpOverlapped=0x0) returned 1 [0216.482] CloseHandle (hObject=0xdc) returned 1 [0216.482] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0 [0216.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.482] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.482] GetTickCount () returned 0x45b29 [0216.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.483] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\....\\temporaryfile")) returned 0 [0216.484] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\temporaryfile")) returned 1 [0216.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.485] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.485] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.485] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.485] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481\\temporaryfile")) returned 1 [0216.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f9cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85f9cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85f9cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.485] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.485] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285481" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285481")) returned 1 [0216.485] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 1 [0216.486] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.486] WriteFile (in: hFile=0xdc, lpBuffer=0x293580*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x293580*, lpNumberOfBytesWritten=0x18fdd8*=0xf0, lpOverlapped=0x0) returned 1 [0216.487] CloseHandle (hObject=0xdc) returned 1 [0216.487] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.487] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x107e [0216.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1086) returned 0x25b528 [0216.487] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x107e, lpOverlapped=0x0) returned 1 [0216.489] CloseHandle (hObject=0xdc) returned 1 [0216.489] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0 [0216.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.489] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.489] GetTickCount () returned 0x45b39 [0216.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.490] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285497\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285497\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.490] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285497\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285497\\....\\temporaryfile")) returned 0 [0216.490] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285497\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285497\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285497\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285497\\temporaryfile")) returned 1 [0216.491] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285497\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc2c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fc2c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fc2c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.492] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc2c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fc2c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fc2c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.492] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc2c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fc2c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fc2c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285497\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc2c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fc2c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fc2c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc2c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fc2c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fc2c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc2c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fc2c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fc2c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.492] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.492] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285497\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285497\\temporaryfile")) returned 1 [0216.499] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc2c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fc2c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fc2c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.499] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.499] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285497" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285497")) returned 1 [0216.499] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 1 [0216.499] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.500] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1088, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x1088, lpOverlapped=0x0) returned 1 [0216.501] CloseHandle (hObject=0xdc) returned 1 [0216.501] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.502] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x252ec [0216.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x252f4) returned 0x2a4a70 [0216.502] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x252ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x252ec, lpOverlapped=0x0) returned 1 [0216.504] CloseHandle (hObject=0xdc) returned 1 [0216.504] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0 [0216.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.504] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.504] GetTickCount () returned 0x45b49 [0216.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.505] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513\\....\\temporaryfile")) returned 0 [0216.505] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513\\temporaryfile")) returned 1 [0216.506] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fe8dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fe8dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fe8dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.506] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fe8dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fe8dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fe8dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.506] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fe8dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fe8dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fe8dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.506] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fe8dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fe8dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fe8dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.507] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fe8dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fe8dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fe8dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.507] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fe8dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fe8dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fe8dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.507] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513\\temporaryfile")) returned 1 [0216.507] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fe8dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x85fe8dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x85fe8dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.507] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513")) returned 1 [0216.507] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 1 [0216.509] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.510] WriteFile (in: hFile=0xdc, lpBuffer=0x2c9d78*, nNumberOfBytesToWrite=0x252f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c9d78*, lpNumberOfBytesWritten=0x18fdd8*=0x252f0, lpOverlapped=0x0) returned 1 [0216.512] CloseHandle (hObject=0xdc) returned 1 [0216.513] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.513] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8a1 [0216.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8a9) returned 0x25f580 [0216.513] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0x8a1, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0x8a1, lpOverlapped=0x0) returned 1 [0216.514] CloseHandle (hObject=0xdc) returned 1 [0216.514] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg")) returned 0 [0216.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.514] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.515] GetTickCount () returned 0x45b49 [0216.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.515] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513\\....\\temporaryfile")) returned 0 [0216.516] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513\\temporaryfile")) returned 1 [0216.517] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fe8dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.517] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fe8dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.517] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.517] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.517] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.517] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.517] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.517] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513\\temporaryfile")) returned 1 [0216.518] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.518] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.518] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285513" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285513")) returned 1 [0216.518] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned 1 [0216.518] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.519] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x8a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0x8a8, lpOverlapped=0x0) returned 1 [0216.520] CloseHandle (hObject=0xdc) returned 1 [0216.520] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.521] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1060 [0216.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1068) returned 0x25b528 [0216.521] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1060, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1060, lpOverlapped=0x0) returned 1 [0216.522] CloseHandle (hObject=0xdc) returned 1 [0216.522] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf")) returned 0 [0216.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.522] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.522] GetTickCount () returned 0x45b58 [0216.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.523] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.523] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528\\....\\temporaryfile")) returned 0 [0216.524] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528\\temporaryfile")) returned 1 [0216.525] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.525] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.525] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.525] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.525] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.525] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.525] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.525] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528\\temporaryfile")) returned 1 [0216.525] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8600ef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8600ef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.525] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.525] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528")) returned 1 [0216.525] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 1 [0216.526] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.526] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1068, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x1068, lpOverlapped=0x0) returned 1 [0216.527] CloseHandle (hObject=0xdc) returned 1 [0216.527] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.528] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x65b4 [0216.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x65bc) returned 0x2a4a70 [0216.528] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x65b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x65b4, lpOverlapped=0x0) returned 1 [0216.530] CloseHandle (hObject=0xdc) returned 1 [0216.530] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf")) returned 0 [0216.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.530] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.530] GetTickCount () returned 0x45b58 [0216.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.531] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528\\....\\temporaryfile")) returned 0 [0216.532] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528\\temporaryfile")) returned 1 [0216.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8600ef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.533] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528\\temporaryfile")) returned 1 [0216.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.533] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285528" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285528")) returned 1 [0216.533] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 1 [0216.534] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.535] WriteFile (in: hFile=0xdc, lpBuffer=0x2ab040*, nNumberOfBytesToWrite=0x65b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ab040*, lpNumberOfBytesWritten=0x18fdd8*=0x65b8, lpOverlapped=0x0) returned 1 [0216.536] CloseHandle (hObject=0xdc) returned 1 [0216.536] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.537] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb86 [0216.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb8e) returned 0x25f580 [0216.537] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb86, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xb86, lpOverlapped=0x0) returned 1 [0216.538] CloseHandle (hObject=0xdc) returned 1 [0216.538] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0 [0216.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.538] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.539] GetTickCount () returned 0x45b68 [0216.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.539] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544\\....\\temporaryfile")) returned 0 [0216.540] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544\\temporaryfile")) returned 1 [0216.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.541] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.541] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.541] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544\\temporaryfile")) returned 1 [0216.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.541] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544")) returned 1 [0216.542] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 1 [0216.542] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.542] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xb90, lpOverlapped=0x0) returned 1 [0216.543] CloseHandle (hObject=0xdc) returned 1 [0216.543] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.543] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xed [0216.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf5) returned 0x293478 [0216.544] ReadFile (in: hFile=0xdc, lpBuffer=0x293480, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x293480*, lpNumberOfBytesRead=0x18fdf0*=0xed, lpOverlapped=0x0) returned 1 [0216.544] CloseHandle (hObject=0xdc) returned 1 [0216.544] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0 [0216.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.545] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.545] GetTickCount () returned 0x45b68 [0216.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.545] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544\\....\\temporaryfile")) returned 0 [0216.546] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544\\temporaryfile")) returned 1 [0216.547] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.547] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.547] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.547] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.547] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.547] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.547] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.547] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544\\temporaryfile")) returned 1 [0216.548] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86035080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86035080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86035080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.548] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.548] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285544" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285544")) returned 1 [0216.548] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 1 [0216.548] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.549] WriteFile (in: hFile=0xdc, lpBuffer=0x28f200*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesWritten=0x18fdd8*=0xf8, lpOverlapped=0x0) returned 1 [0216.549] CloseHandle (hObject=0xdc) returned 1 [0216.549] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.550] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18ed [0216.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18f5) returned 0x299460 [0216.550] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x18ed, lpOverlapped=0x0) returned 1 [0216.551] CloseHandle (hObject=0xdc) returned 1 [0216.551] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0 [0216.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.551] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.551] GetTickCount () returned 0x45b77 [0216.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.552] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559\\....\\temporaryfile")) returned 0 [0216.552] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559\\temporaryfile")) returned 1 [0216.553] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.554] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.554] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.554] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.554] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.554] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559\\temporaryfile")) returned 1 [0216.554] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.554] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.554] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559")) returned 1 [0216.554] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 1 [0216.554] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.555] WriteFile (in: hFile=0xdc, lpBuffer=0x29ad68*, nNumberOfBytesToWrite=0x18f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29ad68*, lpNumberOfBytesWritten=0x18fdd8*=0x18f8, lpOverlapped=0x0) returned 1 [0216.556] CloseHandle (hObject=0xdc) returned 1 [0216.556] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.557] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe8 [0216.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf0) returned 0x28f1f8 [0216.557] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0xe8, lpOverlapped=0x0) returned 1 [0216.558] CloseHandle (hObject=0xdc) returned 1 [0216.558] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0 [0216.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.558] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.558] GetTickCount () returned 0x45b77 [0216.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.558] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559\\....\\temporaryfile")) returned 0 [0216.559] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559\\temporaryfile")) returned 1 [0216.560] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.560] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.560] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.560] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.560] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.561] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.561] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559\\temporaryfile")) returned 1 [0216.561] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8605b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8605b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8605b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.561] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285559" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285559")) returned 1 [0216.561] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 1 [0216.561] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.562] WriteFile (in: hFile=0xdc, lpBuffer=0x293480*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x293480*, lpNumberOfBytesWritten=0x18fdd8*=0xf0, lpOverlapped=0x0) returned 1 [0216.563] CloseHandle (hObject=0xdc) returned 1 [0216.563] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.564] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13fb [0216.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1403) returned 0x25b528 [0216.564] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13fb, lpOverlapped=0x0) returned 1 [0216.565] CloseHandle (hObject=0xdc) returned 1 [0216.565] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0 [0216.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.565] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.565] GetTickCount () returned 0x45b87 [0216.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.566] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575\\....\\temporaryfile")) returned 0 [0216.566] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575\\temporaryfile")) returned 1 [0216.567] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.568] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.568] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.568] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.568] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.568] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.568] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.568] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575\\temporaryfile")) returned 1 [0216.568] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.568] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.568] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575")) returned 1 [0216.568] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 1 [0216.569] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.569] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x1400, lpOverlapped=0x0) returned 1 [0216.570] CloseHandle (hObject=0xdc) returned 1 [0216.570] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.570] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf8d [0216.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf95) returned 0x25f580 [0216.570] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xf8d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xf8d, lpOverlapped=0x0) returned 1 [0216.573] CloseHandle (hObject=0xdc) returned 1 [0216.573] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0 [0216.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.573] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.573] GetTickCount () returned 0x45b87 [0216.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.573] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.574] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575\\....\\temporaryfile")) returned 0 [0216.574] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575\\temporaryfile")) returned 1 [0216.575] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.575] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.575] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.575] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.576] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.576] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.576] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.576] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575\\temporaryfile")) returned 1 [0216.576] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86081340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86081340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86081340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.576] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.576] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285575" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285575")) returned 1 [0216.576] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 1 [0216.576] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.578] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xf98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xf98, lpOverlapped=0x0) returned 1 [0216.579] CloseHandle (hObject=0xdc) returned 1 [0216.579] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.579] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13fb [0216.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1403) returned 0x25b528 [0216.579] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13fb, lpOverlapped=0x0) returned 1 [0216.581] CloseHandle (hObject=0xdc) returned 1 [0216.581] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0 [0216.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.581] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.581] GetTickCount () returned 0x45b97 [0216.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.582] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591\\....\\temporaryfile")) returned 0 [0216.582] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591\\temporaryfile")) returned 1 [0216.583] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.583] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.583] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.583] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.583] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.583] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.583] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.583] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591\\temporaryfile")) returned 1 [0216.584] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.584] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.584] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591")) returned 1 [0216.584] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 1 [0216.584] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.585] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x1400, lpOverlapped=0x0) returned 1 [0216.585] CloseHandle (hObject=0xdc) returned 1 [0216.586] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.590] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x36e1 [0216.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36e9) returned 0x2a4a70 [0216.590] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x36e1, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x36e1, lpOverlapped=0x0) returned 1 [0216.592] CloseHandle (hObject=0xdc) returned 1 [0216.592] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0 [0216.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.592] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.592] GetTickCount () returned 0x45b97 [0216.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.592] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591\\....\\temporaryfile")) returned 0 [0216.593] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591\\temporaryfile")) returned 1 [0216.598] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860cd600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860cd600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.598] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860cd600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860cd600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.598] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.598] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.598] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.598] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.598] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.599] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591\\temporaryfile")) returned 1 [0216.599] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860a74a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860a74a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860a74a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.599] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.599] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285591" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285591")) returned 1 [0216.599] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 1 [0216.599] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.600] WriteFile (in: hFile=0xdc, lpBuffer=0x2a8170*, nNumberOfBytesToWrite=0x36e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a8170*, lpNumberOfBytesWritten=0x18fdd8*=0x36e8, lpOverlapped=0x0) returned 1 [0216.601] CloseHandle (hObject=0xdc) returned 1 [0216.601] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.602] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe9 [0216.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf1) returned 0x293478 [0216.602] ReadFile (in: hFile=0xdc, lpBuffer=0x293480, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x293480*, lpNumberOfBytesRead=0x18fdf0*=0xe9, lpOverlapped=0x0) returned 1 [0216.603] CloseHandle (hObject=0xdc) returned 1 [0216.603] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0 [0216.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.603] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.603] GetTickCount () returned 0x45ba6 [0216.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.604] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285606\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285606\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285606\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285606\\....\\temporaryfile")) returned 0 [0216.604] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285606\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285606\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285606\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285606\\temporaryfile")) returned 1 [0216.605] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285606\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860cd600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860cd600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860cd600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.605] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860cd600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860cd600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860cd600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.606] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860cd600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860cd600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860cd600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.606] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285606\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860cd600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860cd600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860cd600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.606] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860cd600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860cd600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860cd600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.606] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860cd600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860cd600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860cd600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.606] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.606] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285606\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285606\\temporaryfile")) returned 1 [0216.606] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860cd600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860cd600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860cd600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.606] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.606] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285606" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285606")) returned 1 [0216.606] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 1 [0216.606] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.607] WriteFile (in: hFile=0xdc, lpBuffer=0x293580*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x293580*, lpNumberOfBytesWritten=0x18fdd8*=0xf0, lpOverlapped=0x0) returned 1 [0216.608] CloseHandle (hObject=0xdc) returned 1 [0216.608] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.609] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x780 [0216.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x788) returned 0x25f580 [0216.609] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0x780, lpOverlapped=0x0) returned 1 [0216.610] CloseHandle (hObject=0xdc) returned 1 [0216.610] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0 [0216.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.611] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.611] GetTickCount () returned 0x45bb6 [0216.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.611] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622\\....\\temporaryfile")) returned 0 [0216.612] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622\\temporaryfile")) returned 1 [0216.613] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.613] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.613] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.613] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.613] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.613] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.613] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.613] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622\\temporaryfile")) returned 1 [0216.613] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.613] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.614] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622")) returned 1 [0216.614] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 1 [0216.614] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.614] WriteFile (in: hFile=0xdc, lpBuffer=0x25fd18*, nNumberOfBytesToWrite=0x788, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25fd18*, lpNumberOfBytesWritten=0x18fdd8*=0x788, lpOverlapped=0x0) returned 1 [0216.615] CloseHandle (hObject=0xdc) returned 1 [0216.615] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.616] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3da0 [0216.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3da8) returned 0x2a4a70 [0216.616] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x3da0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3da0, lpOverlapped=0x0) returned 1 [0216.617] CloseHandle (hObject=0xdc) returned 1 [0216.617] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0 [0216.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.617] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.617] GetTickCount () returned 0x45bb6 [0216.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.618] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622\\....\\temporaryfile")) returned 0 [0216.619] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622\\temporaryfile")) returned 1 [0216.623] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.623] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.623] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.623] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.623] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.623] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.623] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.623] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622\\temporaryfile")) returned 1 [0216.623] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x860f3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x860f3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x860f3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.623] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.623] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285622" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285622")) returned 1 [0216.624] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 1 [0216.624] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.625] WriteFile (in: hFile=0xdc, lpBuffer=0x2a8828*, nNumberOfBytesToWrite=0x3da8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a8828*, lpNumberOfBytesWritten=0x18fdd8*=0x3da8, lpOverlapped=0x0) returned 1 [0216.626] CloseHandle (hObject=0xdc) returned 1 [0216.626] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.626] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x91c4 [0216.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x91cc) returned 0x2a4a70 [0216.626] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x91c4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x91c4, lpOverlapped=0x0) returned 1 [0216.628] CloseHandle (hObject=0xdc) returned 1 [0216.628] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0 [0216.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.628] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.628] GetTickCount () returned 0x45bc5 [0216.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.629] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637\\....\\temporaryfile")) returned 0 [0216.629] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637\\temporaryfile")) returned 1 [0216.630] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.631] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.631] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.631] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.631] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.631] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.631] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.631] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637\\temporaryfile")) returned 1 [0216.631] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.631] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.631] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637")) returned 1 [0216.631] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 1 [0216.632] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.632] WriteFile (in: hFile=0xdc, lpBuffer=0x2adc50*, nNumberOfBytesToWrite=0x91c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2adc50*, lpNumberOfBytesWritten=0x18fdd8*=0x91c8, lpOverlapped=0x0) returned 1 [0216.634] CloseHandle (hObject=0xdc) returned 1 [0216.634] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.634] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xed [0216.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf5) returned 0x293478 [0216.634] ReadFile (in: hFile=0xdc, lpBuffer=0x293480, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x293480*, lpNumberOfBytesRead=0x18fdf0*=0xed, lpOverlapped=0x0) returned 1 [0216.635] CloseHandle (hObject=0xdc) returned 1 [0216.635] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0 [0216.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.635] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.635] GetTickCount () returned 0x45bc5 [0216.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.636] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637\\....\\temporaryfile")) returned 0 [0216.636] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637\\temporaryfile")) returned 1 [0216.637] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.638] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.638] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.638] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.638] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.638] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.638] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.638] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637\\temporaryfile")) returned 1 [0216.638] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861198c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861198c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861198c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.638] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.638] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285637" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285637")) returned 1 [0216.638] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 1 [0216.638] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.639] WriteFile (in: hFile=0xdc, lpBuffer=0x28f200*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesWritten=0x18fdd8*=0xf8, lpOverlapped=0x0) returned 1 [0216.640] CloseHandle (hObject=0xdc) returned 1 [0216.640] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.641] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x127e [0216.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1286) returned 0x25b528 [0216.641] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x127e, lpOverlapped=0x0) returned 1 [0216.642] CloseHandle (hObject=0xdc) returned 1 [0216.642] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0 [0216.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.642] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.643] GetTickCount () returned 0x45bd5 [0216.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0216.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.643] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653\\....\\temporaryfile")) returned 0 [0216.644] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653\\temporaryfile")) returned 1 [0216.645] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.645] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.645] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.645] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.645] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.645] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.645] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.645] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653\\temporaryfile")) returned 1 [0216.646] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.646] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.646] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653")) returned 1 [0216.646] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 1 [0216.646] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.646] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1288, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x1288, lpOverlapped=0x0) returned 1 [0216.647] CloseHandle (hObject=0xdc) returned 1 [0216.647] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.648] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d8c [0216.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d94) returned 0x2a4a70 [0216.648] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x13d8c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x13d8c, lpOverlapped=0x0) returned 1 [0216.650] CloseHandle (hObject=0xdc) returned 1 [0216.650] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0 [0216.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.651] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.651] GetTickCount () returned 0x45bd5 [0216.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.651] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653\\....\\temporaryfile")) returned 0 [0216.652] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653\\temporaryfile")) returned 1 [0216.653] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.653] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.653] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.653] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.653] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.653] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.653] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.653] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653\\temporaryfile")) returned 1 [0216.654] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8613fa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8613fa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8613fa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.654] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.654] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285653" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285653")) returned 1 [0216.654] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 1 [0216.655] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.656] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8818*, nNumberOfBytesToWrite=0x13d90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8818*, lpNumberOfBytesWritten=0x18fdd8*=0x13d90, lpOverlapped=0x0) returned 1 [0216.657] CloseHandle (hObject=0xdc) returned 1 [0216.657] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.658] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c6 [0216.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce) returned 0x25f580 [0216.658] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0x7c6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0x7c6, lpOverlapped=0x0) returned 1 [0216.659] CloseHandle (hObject=0xdc) returned 1 [0216.659] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0 [0216.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.660] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.660] GetTickCount () returned 0x45be5 [0216.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.660] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669\\....\\temporaryfile")) returned 0 [0216.661] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669\\temporaryfile")) returned 1 [0216.662] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.662] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.662] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.662] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.662] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.662] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.662] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.662] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669\\temporaryfile")) returned 1 [0216.662] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.662] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.662] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669")) returned 1 [0216.663] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 1 [0216.663] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.663] WriteFile (in: hFile=0xdc, lpBuffer=0x25fd60*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25fd60*, lpNumberOfBytesWritten=0x18fdd8*=0x7d0, lpOverlapped=0x0) returned 1 [0216.664] CloseHandle (hObject=0xdc) returned 1 [0216.664] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.665] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe8 [0216.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf0) returned 0x28f1f8 [0216.665] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0xe8, lpOverlapped=0x0) returned 1 [0216.666] CloseHandle (hObject=0xdc) returned 1 [0216.666] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0 [0216.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.666] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.666] GetTickCount () returned 0x45be5 [0216.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.667] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669\\....\\temporaryfile")) returned 0 [0216.668] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669\\temporaryfile")) returned 1 [0216.668] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.669] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.669] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.669] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.669] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.669] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.669] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669\\temporaryfile")) returned 1 [0216.669] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86165b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86165b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86165b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.669] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.669] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285669" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285669")) returned 1 [0216.669] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 1 [0216.670] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.671] WriteFile (in: hFile=0xdc, lpBuffer=0x293480*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x293480*, lpNumberOfBytesWritten=0x18fdd8*=0xf0, lpOverlapped=0x0) returned 1 [0216.671] CloseHandle (hObject=0xdc) returned 1 [0216.672] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.673] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2949 [0216.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2951) returned 0x299460 [0216.673] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2949, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2949, lpOverlapped=0x0) returned 1 [0216.674] CloseHandle (hObject=0xdc) returned 1 [0216.674] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0 [0216.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.674] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.674] GetTickCount () returned 0x45bf4 [0216.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.675] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684\\....\\temporaryfile")) returned 0 [0216.675] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684\\temporaryfile")) returned 1 [0216.676] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.677] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.677] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.677] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.677] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.677] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.677] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.677] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684\\temporaryfile")) returned 1 [0216.677] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.677] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.677] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684")) returned 1 [0216.677] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 1 [0216.678] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.678] WriteFile (in: hFile=0xdc, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2950, lpOverlapped=0x0) returned 1 [0216.679] CloseHandle (hObject=0xdc) returned 1 [0216.679] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.680] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe6 [0216.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xee) returned 0x28f1f8 [0216.680] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0xe6, lpOverlapped=0x0) returned 1 [0216.680] CloseHandle (hObject=0xdc) returned 1 [0216.680] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0 [0216.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.681] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.681] GetTickCount () returned 0x45bf4 [0216.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.681] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684\\....\\temporaryfile")) returned 0 [0216.682] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684\\temporaryfile")) returned 1 [0216.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.683] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.683] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.683] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.683] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684\\temporaryfile")) returned 1 [0216.683] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8618bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8618bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8618bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.684] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.684] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285684" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285684")) returned 1 [0216.684] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 1 [0216.684] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.684] WriteFile (in: hFile=0xdc, lpBuffer=0x293480*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x293480*, lpNumberOfBytesWritten=0x18fdd8*=0xf0, lpOverlapped=0x0) returned 1 [0216.685] CloseHandle (hObject=0xdc) returned 1 [0216.685] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.686] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d51 [0216.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d59) returned 0x299460 [0216.686] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x1d51, lpOverlapped=0x0) returned 1 [0216.688] CloseHandle (hObject=0xdc) returned 1 [0216.688] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0 [0216.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.688] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.688] GetTickCount () returned 0x45c04 [0216.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.688] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700\\....\\temporaryfile")) returned 0 [0216.689] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700\\temporaryfile")) returned 1 [0216.690] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.690] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.690] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.690] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.690] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.690] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.690] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.690] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700\\temporaryfile")) returned 1 [0216.690] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.690] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.691] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700")) returned 1 [0216.691] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 1 [0216.691] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.691] WriteFile (in: hFile=0xdc, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x1d58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1d58, lpOverlapped=0x0) returned 1 [0216.692] CloseHandle (hObject=0xdc) returned 1 [0216.692] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.693] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x748 [0216.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x750) returned 0x25f580 [0216.693] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0x748, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0x748, lpOverlapped=0x0) returned 1 [0216.694] CloseHandle (hObject=0xdc) returned 1 [0216.694] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0 [0216.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.695] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.695] GetTickCount () returned 0x45c04 [0216.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.695] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700\\....\\temporaryfile")) returned 0 [0216.696] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700\\temporaryfile")) returned 1 [0216.697] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.697] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.697] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.697] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.697] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700\\temporaryfile")) returned 1 [0216.697] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861b1e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861b1e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861b1e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.697] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285700" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285700")) returned 1 [0216.698] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 1 [0216.698] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.698] WriteFile (in: hFile=0xdc, lpBuffer=0x25fce0*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25fce0*, lpNumberOfBytesWritten=0x18fdd8*=0x750, lpOverlapped=0x0) returned 1 [0216.699] CloseHandle (hObject=0xdc) returned 1 [0216.699] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.703] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe42 [0216.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe4a) returned 0x25f580 [0216.703] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xe42, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xe42, lpOverlapped=0x0) returned 1 [0216.704] CloseHandle (hObject=0xdc) returned 1 [0216.704] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0 [0216.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.704] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.704] GetTickCount () returned 0x45c13 [0216.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.705] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285715\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285715\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285715\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285715\\....\\temporaryfile")) returned 0 [0216.705] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285715\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285715\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285715\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285715\\temporaryfile")) returned 1 [0216.706] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285715\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861d7fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861d7fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861d7fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.706] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861d7fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861d7fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861d7fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.707] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861d7fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861d7fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861d7fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.707] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285715\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861d7fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861d7fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861d7fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.707] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861d7fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861d7fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861d7fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.707] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861d7fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861d7fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861d7fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.707] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.707] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285715\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285715\\temporaryfile")) returned 1 [0216.707] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861d7fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861d7fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861d7fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.707] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.707] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285715" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285715")) returned 1 [0216.707] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 1 [0216.708] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.708] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xe48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xe48, lpOverlapped=0x0) returned 1 [0216.709] CloseHandle (hObject=0xdc) returned 1 [0216.709] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.709] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x121e [0216.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1226) returned 0x25b528 [0216.709] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x121e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x121e, lpOverlapped=0x0) returned 1 [0216.718] CloseHandle (hObject=0xdc) returned 1 [0216.718] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0 [0216.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.718] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.718] GetTickCount () returned 0x45c23 [0216.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.719] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731\\....\\temporaryfile")) returned 0 [0216.719] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731\\temporaryfile")) returned 1 [0216.720] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.720] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.721] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.721] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.721] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.721] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.721] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731\\temporaryfile")) returned 1 [0216.721] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.721] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.721] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731")) returned 1 [0216.721] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 1 [0216.722] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.722] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1228, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x1228, lpOverlapped=0x0) returned 1 [0216.723] CloseHandle (hObject=0xdc) returned 1 [0216.723] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.724] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6860 [0216.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6868) returned 0x2a4a70 [0216.724] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x6860, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x6860, lpOverlapped=0x0) returned 1 [0216.725] CloseHandle (hObject=0xdc) returned 1 [0216.725] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0 [0216.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.726] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.726] GetTickCount () returned 0x45c23 [0216.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.726] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731\\....\\temporaryfile")) returned 0 [0216.727] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731\\temporaryfile")) returned 1 [0216.728] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.728] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.728] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.728] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.728] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.728] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.728] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.728] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731\\temporaryfile")) returned 1 [0216.729] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x861fe100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x861fe100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x861fe100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.729] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285731" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285731")) returned 1 [0216.729] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 1 [0216.729] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.730] WriteFile (in: hFile=0xdc, lpBuffer=0x2ab2e8*, nNumberOfBytesToWrite=0x6868, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ab2e8*, lpNumberOfBytesWritten=0x18fdd8*=0x6868, lpOverlapped=0x0) returned 1 [0216.731] CloseHandle (hObject=0xdc) returned 1 [0216.731] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.732] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc60 [0216.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc68) returned 0x25f580 [0216.732] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc60, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xc60, lpOverlapped=0x0) returned 1 [0216.734] CloseHandle (hObject=0xdc) returned 1 [0216.734] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0 [0216.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.734] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.734] GetTickCount () returned 0x45c33 [0216.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.735] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747\\....\\temporaryfile")) returned 0 [0216.735] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747\\temporaryfile")) returned 1 [0216.736] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.736] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.736] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.736] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.737] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.737] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747\\temporaryfile")) returned 1 [0216.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.737] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747")) returned 1 [0216.737] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 1 [0216.737] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.738] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xc68, lpOverlapped=0x0) returned 1 [0216.739] CloseHandle (hObject=0xdc) returned 1 [0216.739] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.739] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3ad7 [0216.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3adf) returned 0x2a4a70 [0216.739] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x3ad7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3ad7, lpOverlapped=0x0) returned 1 [0216.741] CloseHandle (hObject=0xdc) returned 1 [0216.741] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0 [0216.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.741] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.741] GetTickCount () returned 0x45c33 [0216.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0216.742] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747\\....\\temporaryfile")) returned 0 [0216.743] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747\\temporaryfile")) returned 1 [0216.743] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.744] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.744] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.744] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.744] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.744] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.744] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747\\temporaryfile")) returned 1 [0216.744] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86224260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.744] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.744] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285747" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285747")) returned 1 [0216.748] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 1 [0216.748] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.749] WriteFile (in: hFile=0xdc, lpBuffer=0x2a8560*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a8560*, lpNumberOfBytesWritten=0x18fdd8*=0x3ae0, lpOverlapped=0x0) returned 1 [0216.751] CloseHandle (hObject=0xdc) returned 1 [0216.751] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0216.751] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x86224260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86224260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0216.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0216.751] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0216.751] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80020c30, dwReserved1=0x1ca0444, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.751] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80020c30, dwReserved1=0x1ca0444, cFileName="..", cAlternateFileName="")) returned 1 [0216.751] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80020c30, dwReserved1=0x1ca0444, cFileName="en-US", cAlternateFileName="")) returned 1 [0216.751] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x80020c30, dwReserved1=0x1ca0444, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0216.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561c8 [0216.752] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.753] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x23d78 [0216.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23d80) returned 0x2a4a70 [0216.753] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x23d78, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x23d78, lpOverlapped=0x0) returned 1 [0216.755] CloseHandle (hObject=0xdc) returned 1 [0216.755] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 1 [0216.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.756] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.757] GetTickCount () returned 0x45c42 [0216.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0216.757] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285762\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285762\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285762\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285762\\....\\temporaryfile")) returned 0 [0216.758] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285762\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285762\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285762\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285762\\temporaryfile")) returned 1 [0216.759] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285762\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8624a3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8624a3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8624a3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.759] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8624a3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8624a3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8624a3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0216.759] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8624a3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8624a3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8624a3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.759] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285762\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8624a3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8624a3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8624a3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.759] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8624a3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8624a3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8624a3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.759] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8624a3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8624a3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8624a3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.759] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.759] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285762\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285762\\temporaryfile")) returned 1 [0216.759] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8624a3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8624a3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8624a3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.759] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.759] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285762" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285762")) returned 1 [0216.760] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 0 [0216.762] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.764] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8800*, nNumberOfBytesToWrite=0x23d80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8800*, lpNumberOfBytesWritten=0x18fdd8*=0x23d80, lpOverlapped=0x0) returned 1 [0216.766] CloseHandle (hObject=0xdc) returned 1 [0216.766] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.767] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8f68 [0216.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8f70) returned 0x2a4a70 [0216.767] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x8f68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x8f68, lpOverlapped=0x0) returned 1 [0216.768] CloseHandle (hObject=0xdc) returned 1 [0216.768] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 1 [0216.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0216.769] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.770] GetTickCount () returned 0x45c52 [0216.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0216.770] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0216.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778\\....\\temporaryfile")) returned 0 [0216.771] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778\\temporaryfile")) returned 1 [0216.772] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.772] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.772] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.772] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.772] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778\\temporaryfile")) returned 1 [0216.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.772] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778")) returned 1 [0216.772] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 0 [0216.773] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.774] WriteFile (in: hFile=0xdc, lpBuffer=0x2ad9f0*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ad9f0*, lpNumberOfBytesWritten=0x18fdd8*=0x8f70, lpOverlapped=0x0) returned 1 [0216.775] CloseHandle (hObject=0xdc) returned 1 [0216.775] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.776] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdfa0 [0216.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdfa8) returned 0x2a4a70 [0216.776] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0xdfa0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0xdfa0, lpOverlapped=0x0) returned 1 [0216.778] CloseHandle (hObject=0xdc) returned 1 [0216.778] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 1 [0216.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.779] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.779] GetTickCount () returned 0x45c52 [0216.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0216.780] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.780] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778\\....\\temporaryfile")) returned 0 [0216.780] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778\\temporaryfile")) returned 1 [0216.781] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86296680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86296680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86296680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86296680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.781] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.782] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.782] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.782] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.782] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778\\temporaryfile")) returned 1 [0216.782] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86270520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86270520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86270520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.782] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.782] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285778" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285778")) returned 1 [0216.782] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 0 [0216.783] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.784] WriteFile (in: hFile=0xdc, lpBuffer=0x2b2a28*, nNumberOfBytesToWrite=0xdfa8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b2a28*, lpNumberOfBytesWritten=0x18fdd8*=0xdfa8, lpOverlapped=0x0) returned 1 [0216.785] CloseHandle (hObject=0xdc) returned 1 [0216.785] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.786] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30170 [0216.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30178) returned 0x2a4a70 [0216.786] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x30170, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x30170, lpOverlapped=0x0) returned 1 [0216.788] CloseHandle (hObject=0xdc) returned 1 [0216.788] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 1 [0216.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0216.789] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.790] GetTickCount () returned 0x45c61 [0216.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0216.790] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285793\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285793\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0216.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285793\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285793\\....\\temporaryfile")) returned 0 [0216.791] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285793\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285793\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285793\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285793\\temporaryfile")) returned 1 [0216.792] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285793\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86296680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86296680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86296680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.792] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86296680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86296680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86296680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.792] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86296680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86296680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86296680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.792] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285793\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86296680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86296680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86296680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.792] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86296680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86296680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86296680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.792] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86296680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86296680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86296680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.792] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285793\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285793\\temporaryfile")) returned 1 [0216.792] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86296680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86296680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86296680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.792] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.793] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285793" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285793")) returned 1 [0216.793] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 0 [0216.796] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.796] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4bf8*, nNumberOfBytesToWrite=0x30178, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4bf8*, lpNumberOfBytesWritten=0x18fdd8*=0x30178, lpOverlapped=0x0) returned 1 [0216.799] CloseHandle (hObject=0xdc) returned 1 [0216.799] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.800] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x46b70 [0216.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x46b78) returned 0x2a4a70 [0216.800] ReadFile (in: hFile=0xdc, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x46b70, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdf0*=0x46b70, lpOverlapped=0x0) returned 1 [0216.803] CloseHandle (hObject=0xdc) returned 1 [0216.803] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 1 [0216.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.806] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.806] GetTickCount () returned 0x45c71 [0216.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0216.807] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285809\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285809\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285809\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285809\\....\\temporaryfile")) returned 0 [0216.807] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285809\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285809\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285809\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285809\\temporaryfile")) returned 1 [0216.808] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285809\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862bc7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x862bc7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x862bc7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.808] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862bc7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x862bc7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x862bc7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.808] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862bc7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x862bc7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x862bc7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.808] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285809\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862bc7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x862bc7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x862bc7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.809] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862bc7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x862bc7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x862bc7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.809] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862bc7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x862bc7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x862bc7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.809] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.809] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285809\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285809\\temporaryfile")) returned 1 [0216.809] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862bc7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x862bc7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x862bc7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.809] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.809] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285809" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285809")) returned 1 [0216.809] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 0 [0216.813] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.814] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x46b78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x46b78, lpOverlapped=0x0) returned 1 [0216.819] CloseHandle (hObject=0xdc) returned 1 [0216.819] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.819] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x862e2940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x862e2940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0216.819] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 1 [0216.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 0 [0216.820] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.820] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0216.820] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.820] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.820] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.822] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="AXIS", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="CANYON", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="ECHO", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="EDGE", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="ICE", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="INDUST", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="IRIS", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0216.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="QUAD", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="REFINED", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="SATIN", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="SKY", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="SLATE", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="SONORA", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="SPRING", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0216.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0216.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256198 [0216.824] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.825] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c6c [0216.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c74) returned 0x299460 [0216.825] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x1c6c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x1c6c, lpOverlapped=0x0) returned 1 [0216.826] CloseHandle (hObject=0xdc) returned 1 [0216.826] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf")) returned 1 [0216.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.827] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.827] GetTickCount () returned 0x45c81 [0216.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0216.828] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285825\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285825\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285825\\....\\temporaryfile")) returned 0 [0216.828] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285825\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285825\\temporaryfile")) returned 1 [0216.829] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285825\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.829] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName="..", cAlternateFileName="")) returned 1 [0216.829] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.829] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285825\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.829] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.829] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.829] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.830] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285825\\temporaryfile")) returned 1 [0216.830] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.830] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.830] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285825" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285825")) returned 1 [0216.830] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 0 [0216.830] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0216.831] WriteFile (in: hFile=0xdc, lpBuffer=0x2a4a78*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1c70, lpOverlapped=0x0) returned 1 [0216.832] CloseHandle (hObject=0xdc) returned 1 [0216.832] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0216.832] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0216.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0216.832] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.832] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0216.832] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0216.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0216.833] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.834] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe58e [0216.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe596) returned 0x2a4a70 [0216.834] ReadFile (in: hFile=0xe0, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0xe58e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdd0*=0xe58e, lpOverlapped=0x0) returned 1 [0216.835] CloseHandle (hObject=0xe0) returned 1 [0216.835] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 1 [0216.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0216.836] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.836] GetTickCount () returned 0x45c90 [0216.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0216.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.837] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285840\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285840\\...."), lpSecurityAttributes=0x256228) returned 1 [0216.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285840\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285840\\....\\temporaryfile")) returned 0 [0216.840] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285840\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285840\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285840\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285840\\temporaryfile")) returned 1 [0216.841] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285840\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.842] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.842] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.842] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285840\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.842] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.842] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.842] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.842] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285840\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285840\\temporaryfile")) returned 1 [0216.842] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86308aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86308aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86308aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.842] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.842] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285840" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285840")) returned 1 [0216.842] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 0 [0216.843] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.844] WriteFile (in: hFile=0xe0, lpBuffer=0x2b3018*, nNumberOfBytesToWrite=0xe598, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b3018*, lpNumberOfBytesWritten=0x18fdb8*=0xe598, lpOverlapped=0x0) returned 1 [0216.845] CloseHandle (hObject=0xe0) returned 1 [0216.846] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.846] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x22b [0216.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x233) returned 0x28f1f8 [0216.846] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x22b, lpOverlapped=0x0) returned 1 [0216.847] CloseHandle (hObject=0xe0) returned 1 [0216.847] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 1 [0216.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.848] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.848] GetTickCount () returned 0x45ca0 [0216.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0216.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.848] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856\\....\\temporaryfile")) returned 0 [0216.849] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856\\temporaryfile")) returned 1 [0216.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.850] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.850] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.850] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.850] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.850] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856\\temporaryfile")) returned 1 [0216.850] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.850] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856")) returned 1 [0216.851] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 0 [0216.851] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.853] WriteFile (in: hFile=0xe0, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdb8*=0x230, lpOverlapped=0x0) returned 1 [0216.853] CloseHandle (hObject=0xe0) returned 1 [0216.854] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.855] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x621 [0216.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x629) returned 0x259e70 [0216.855] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x621, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x621, lpOverlapped=0x0) returned 1 [0216.856] CloseHandle (hObject=0xe0) returned 1 [0216.856] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0216.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0216.857] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.857] GetTickCount () returned 0x45ca0 [0216.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0216.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.857] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856\\...."), lpSecurityAttributes=0x256228) returned 1 [0216.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856\\....\\temporaryfile")) returned 0 [0216.858] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856\\temporaryfile")) returned 1 [0216.859] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.859] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.859] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.859] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.859] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.860] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.860] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.860] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856\\temporaryfile")) returned 1 [0216.860] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8632ec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8632ec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8632ec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.860] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.860] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285856" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285856")) returned 1 [0216.860] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 0 [0216.860] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.861] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x628, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x628, lpOverlapped=0x0) returned 1 [0216.862] CloseHandle (hObject=0xe0) returned 1 [0216.862] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.863] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6292 [0216.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x629a) returned 0x2a4a70 [0216.863] ReadFile (in: hFile=0xe0, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x6292, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdd0*=0x6292, lpOverlapped=0x0) returned 1 [0216.864] CloseHandle (hObject=0xe0) returned 1 [0216.864] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0216.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.865] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.865] GetTickCount () returned 0x45caf [0216.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0216.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.866] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285871\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285871\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285871\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285871\\....\\temporaryfile")) returned 0 [0216.866] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285871\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285871\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285871\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285871\\temporaryfile")) returned 1 [0216.867] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285871\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86354d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86354d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86354d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.868] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86354d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86354d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86354d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.868] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86354d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86354d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86354d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.868] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285871\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86354d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86354d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86354d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.868] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86354d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86354d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86354d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.868] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86354d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86354d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86354d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.868] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.868] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285871\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285871\\temporaryfile")) returned 1 [0216.868] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86354d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86354d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86354d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.868] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.868] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285871" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285871")) returned 1 [0216.868] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 0 [0216.869] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.869] WriteFile (in: hFile=0xe0, lpBuffer=0x2aad20*, nNumberOfBytesToWrite=0x6298, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2aad20*, lpNumberOfBytesWritten=0x18fdb8*=0x6298, lpOverlapped=0x0) returned 1 [0216.870] CloseHandle (hObject=0xe0) returned 1 [0216.871] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.871] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86354d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86354d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0216.872] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.872] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5146e3d0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.873] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5146e3d0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0216.873] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x5146e3d0, dwReserved1=0x1d301bf, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0216.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256198 [0216.873] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.874] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x10fc7 [0216.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10fcf) returned 0x2a4a70 [0216.874] ReadFile (in: hFile=0xe0, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x10fc7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdd0*=0x10fc7, lpOverlapped=0x0) returned 1 [0216.876] CloseHandle (hObject=0xe0) returned 1 [0216.876] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 1 [0216.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0216.877] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.877] GetTickCount () returned 0x45cbf [0216.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.878] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887\\...."), lpSecurityAttributes=0x256228) returned 1 [0216.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887\\....\\temporaryfile")) returned 0 [0216.878] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887\\temporaryfile")) returned 1 [0216.879] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.880] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0216.880] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.880] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.880] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.880] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.880] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887\\temporaryfile")) returned 1 [0216.880] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.880] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.880] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887")) returned 1 [0216.880] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 0 [0216.882] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.882] WriteFile (in: hFile=0xe0, lpBuffer=0x2b5a50*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b5a50*, lpNumberOfBytesWritten=0x18fdb8*=0x10fd0, lpOverlapped=0x0) returned 1 [0216.884] CloseHandle (hObject=0xe0) returned 1 [0216.884] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.884] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x201 [0216.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x209) returned 0x28f1f8 [0216.884] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x201, lpOverlapped=0x0) returned 1 [0216.885] CloseHandle (hObject=0xe0) returned 1 [0216.885] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 1 [0216.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.886] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.886] GetTickCount () returned 0x45cbf [0216.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.886] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887\\....\\temporaryfile")) returned 0 [0216.887] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887\\temporaryfile")) returned 1 [0216.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.888] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.888] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.888] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.888] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.888] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.889] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887\\temporaryfile")) returned 1 [0216.889] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8637aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8637aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8637aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.889] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.889] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285887" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285887")) returned 1 [0216.889] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 0 [0216.889] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.890] WriteFile (in: hFile=0xe0, lpBuffer=0x262598*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x262598*, lpNumberOfBytesWritten=0x18fdb8*=0x208, lpOverlapped=0x0) returned 1 [0216.891] CloseHandle (hObject=0xe0) returned 1 [0216.891] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.892] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xba9 [0216.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbb1) returned 0x25f580 [0216.892] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xba9, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xba9, lpOverlapped=0x0) returned 1 [0216.893] CloseHandle (hObject=0xe0) returned 1 [0216.893] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0216.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0216.894] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.894] GetTickCount () returned 0x45ccf [0216.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.895] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.895] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903\\...."), lpSecurityAttributes=0x256228) returned 1 [0216.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903\\....\\temporaryfile")) returned 0 [0216.895] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903\\temporaryfile")) returned 1 [0216.896] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.896] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.896] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.896] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.896] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.896] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.896] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.897] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903\\temporaryfile")) returned 1 [0216.897] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.897] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.897] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903")) returned 1 [0216.897] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 0 [0216.897] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.899] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xbb0, lpOverlapped=0x0) returned 1 [0216.900] CloseHandle (hObject=0xe0) returned 1 [0216.900] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.901] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4d44 [0216.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4d4c) returned 0x2a4a70 [0216.901] ReadFile (in: hFile=0xe0, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x4d44, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4d44, lpOverlapped=0x0) returned 1 [0216.902] CloseHandle (hObject=0xe0) returned 1 [0216.902] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0216.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.903] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.903] GetTickCount () returned 0x45ccf [0216.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.904] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903\\....\\temporaryfile")) returned 0 [0216.905] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903\\temporaryfile")) returned 1 [0216.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863c7180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863c7180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.914] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863c7180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863c7180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.914] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.914] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.914] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.914] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903\\temporaryfile")) returned 1 [0216.914] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863a1020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863a1020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863a1020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.914] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285903" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285903")) returned 1 [0216.915] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 0 [0216.915] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.916] WriteFile (in: hFile=0xe0, lpBuffer=0x2a97d0*, nNumberOfBytesToWrite=0x4d48, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a97d0*, lpNumberOfBytesWritten=0x18fdb8*=0x4d48, lpOverlapped=0x0) returned 1 [0216.917] CloseHandle (hObject=0xe0) returned 1 [0216.917] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.917] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x863c7180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863c7180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0216.917] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.917] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51767f50, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51767f50, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0216.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x51767f50, dwReserved1=0x1d301bf, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0216.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0216.918] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.919] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x189be [0216.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x189c6) returned 0x2a4a70 [0216.919] ReadFile (in: hFile=0xe0, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x189be, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdd0*=0x189be, lpOverlapped=0x0) returned 1 [0216.920] CloseHandle (hObject=0xe0) returned 1 [0216.920] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 1 [0216.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.922] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.922] GetTickCount () returned 0x45cee [0216.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.922] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934\\....\\temporaryfile")) returned 0 [0216.923] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934\\temporaryfile")) returned 1 [0216.924] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.924] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0216.924] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.924] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.924] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.924] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.924] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.924] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934\\temporaryfile")) returned 1 [0216.925] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.925] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.925] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934")) returned 1 [0216.925] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 0 [0216.926] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.927] WriteFile (in: hFile=0xe0, lpBuffer=0x2bd448*, nNumberOfBytesToWrite=0x189c8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd448*, lpNumberOfBytesWritten=0x18fdb8*=0x189c8, lpOverlapped=0x0) returned 1 [0216.929] CloseHandle (hObject=0xe0) returned 1 [0216.929] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.930] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x211 [0216.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x219) returned 0x285c38 [0216.930] ReadFile (in: hFile=0xe0, lpBuffer=0x285c40, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x285c40*, lpNumberOfBytesRead=0x18fdd0*=0x211, lpOverlapped=0x0) returned 1 [0216.931] CloseHandle (hObject=0xe0) returned 1 [0216.931] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 1 [0216.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0216.932] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.932] GetTickCount () returned 0x45cee [0216.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.932] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934\\...."), lpSecurityAttributes=0x256228) returned 1 [0216.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934\\....\\temporaryfile")) returned 0 [0216.933] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934\\temporaryfile")) returned 1 [0216.934] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.934] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.934] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.934] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.934] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.934] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.934] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.934] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934\\temporaryfile")) returned 1 [0216.935] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x863ed2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x863ed2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x863ed2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.935] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.935] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285934" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285934")) returned 1 [0216.935] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 0 [0216.935] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.935] WriteFile (in: hFile=0xe0, lpBuffer=0x285e68*, nNumberOfBytesToWrite=0x218, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x285e68*, lpNumberOfBytesWritten=0x18fdb8*=0x218, lpOverlapped=0x0) returned 1 [0216.936] CloseHandle (hObject=0xe0) returned 1 [0216.937] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.937] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb20 [0216.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb28) returned 0x25f580 [0216.937] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb20, lpOverlapped=0x0) returned 1 [0216.938] CloseHandle (hObject=0xe0) returned 1 [0216.938] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0216.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.939] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.939] GetTickCount () returned 0x45cfd [0216.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.940] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949\\....\\temporaryfile")) returned 0 [0216.940] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949\\temporaryfile")) returned 1 [0216.941] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.941] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.941] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.941] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.941] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.942] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.942] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.942] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949\\temporaryfile")) returned 1 [0216.942] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.942] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.942] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949")) returned 1 [0216.942] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 0 [0216.942] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.944] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb28, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb28, lpOverlapped=0x0) returned 1 [0216.945] CloseHandle (hObject=0xe0) returned 1 [0216.945] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.945] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8864 [0216.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x886c) returned 0x2a4a70 [0216.945] ReadFile (in: hFile=0xe0, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x8864, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdd0*=0x8864, lpOverlapped=0x0) returned 1 [0216.947] CloseHandle (hObject=0xe0) returned 1 [0216.947] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0216.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0216.948] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.948] GetTickCount () returned 0x45cfd [0216.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.949] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949\\...."), lpSecurityAttributes=0x256228) returned 1 [0216.949] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949\\....\\temporaryfile")) returned 0 [0216.949] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949\\temporaryfile")) returned 1 [0216.950] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.950] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.950] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.950] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.951] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.951] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.951] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.951] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949\\temporaryfile")) returned 1 [0216.951] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86413440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86413440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86413440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.951] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.951] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285949" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285949")) returned 1 [0216.951] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 0 [0216.952] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.952] WriteFile (in: hFile=0xe0, lpBuffer=0x2ad2f0*, nNumberOfBytesToWrite=0x8868, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ad2f0*, lpNumberOfBytesWritten=0x18fdb8*=0x8868, lpOverlapped=0x0) returned 1 [0216.954] CloseHandle (hObject=0xe0) returned 1 [0216.954] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.954] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x864395a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864395a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0216.954] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.954] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.955] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0216.955] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0216.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256198 [0216.955] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.956] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x10db7 [0216.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10dbf) returned 0x2a4a70 [0216.956] ReadFile (in: hFile=0xe0, lpBuffer=0x2a4a78, nNumberOfBytesToRead=0x10db7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a78*, lpNumberOfBytesRead=0x18fdd0*=0x10db7, lpOverlapped=0x0) returned 1 [0216.957] CloseHandle (hObject=0xe0) returned 1 [0216.957] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 1 [0216.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0216.958] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.959] GetTickCount () returned 0x45d0d [0216.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.959] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285965\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285965\\...."), lpSecurityAttributes=0x256228) returned 1 [0216.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285965\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285965\\....\\temporaryfile")) returned 0 [0216.960] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285965\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285965\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285965\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285965\\temporaryfile")) returned 1 [0216.960] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285965\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864395a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864395a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864395a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.961] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864395a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864395a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864395a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0216.961] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864395a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864395a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864395a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.961] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285965\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864395a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864395a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864395a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.961] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864395a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864395a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864395a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.961] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864395a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864395a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864395a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.961] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.961] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285965\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285965\\temporaryfile")) returned 1 [0216.961] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864395a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864395a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864395a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.961] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.961] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285965" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285965")) returned 1 [0216.961] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 0 [0216.963] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.963] WriteFile (in: hFile=0xe0, lpBuffer=0x2b5840*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b5840*, lpNumberOfBytesWritten=0x18fdb8*=0x10dc0, lpOverlapped=0x0) returned 1 [0216.965] CloseHandle (hObject=0xe0) returned 1 [0216.965] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.966] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x216 [0216.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x21e) returned 0x285e60 [0216.966] ReadFile (in: hFile=0xe0, lpBuffer=0x285e68, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x285e68*, lpNumberOfBytesRead=0x18fdd0*=0x216, lpOverlapped=0x0) returned 1 [0216.967] CloseHandle (hObject=0xe0) returned 1 [0216.967] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 1 [0216.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.968] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.968] GetTickCount () returned 0x45d1d [0216.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.969] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981\\....\\temporaryfile")) returned 0 [0216.969] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981\\temporaryfile")) returned 1 [0216.970] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.970] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.970] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.970] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.970] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.970] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.971] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.971] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981\\temporaryfile")) returned 1 [0216.971] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.971] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.971] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981")) returned 1 [0216.971] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 0 [0216.971] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.972] WriteFile (in: hFile=0xe0, lpBuffer=0x2a4a90*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a4a90*, lpNumberOfBytesWritten=0x18fdb8*=0x220, lpOverlapped=0x0) returned 1 [0216.973] CloseHandle (hObject=0xe0) returned 1 [0216.973] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.974] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x885 [0216.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x88d) returned 0x25f580 [0216.974] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x885, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x885, lpOverlapped=0x0) returned 1 [0216.975] CloseHandle (hObject=0xe0) returned 1 [0216.975] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0216.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0216.976] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.976] GetTickCount () returned 0x45d1d [0216.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.977] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981\\...."), lpSecurityAttributes=0x256228) returned 1 [0216.978] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981\\....\\temporaryfile")) returned 0 [0216.978] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981\\temporaryfile")) returned 1 [0216.979] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.979] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.979] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.979] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.979] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.979] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.979] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981\\temporaryfile")) returned 1 [0216.979] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8645f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8645f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8645f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.979] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285981" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285981")) returned 1 [0216.980] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 0 [0216.980] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.982] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x890, lpOverlapped=0x0) returned 1 [0216.982] CloseHandle (hObject=0xe0) returned 1 [0216.983] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.983] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5093 [0216.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x509b) returned 0x2a8a70 [0216.983] ReadFile (in: hFile=0xe0, lpBuffer=0x2a8a78, nNumberOfBytesToRead=0x5093, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a8a78*, lpNumberOfBytesRead=0x18fdd0*=0x5093, lpOverlapped=0x0) returned 1 [0216.985] CloseHandle (hObject=0xe0) returned 1 [0216.985] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0216.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0216.986] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.986] GetTickCount () returned 0x45d2c [0216.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0216.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.986] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996\\...."), lpSecurityAttributes=0x256198) returned 1 [0216.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996\\....\\temporaryfile")) returned 0 [0216.987] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996\\temporaryfile")) returned 1 [0216.988] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.988] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.988] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.988] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.988] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.988] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.988] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.988] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996\\temporaryfile")) returned 1 [0216.988] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.988] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.988] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996")) returned 1 [0216.989] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 0 [0216.989] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.990] WriteFile (in: hFile=0xe0, lpBuffer=0x2adb20*, nNumberOfBytesToWrite=0x5098, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2adb20*, lpNumberOfBytesWritten=0x18fdb8*=0x5098, lpOverlapped=0x0) returned 1 [0216.991] CloseHandle (hObject=0xe0) returned 1 [0216.991] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.991] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0216.991] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0216.991] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0216.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0216.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0216.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256198 [0216.992] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0216.992] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2ba [0216.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc2c2) returned 0x2a8a70 [0216.992] ReadFile (in: hFile=0xe0, lpBuffer=0x2a8a78, nNumberOfBytesToRead=0xc2ba, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a8a78*, lpNumberOfBytesRead=0x18fdd0*=0xc2ba, lpOverlapped=0x0) returned 1 [0216.994] CloseHandle (hObject=0xe0) returned 1 [0216.994] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 1 [0216.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0216.995] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0216.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0216.995] GetTickCount () returned 0x45d2c [0216.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0216.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0216.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0216.995] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996\\...."), lpSecurityAttributes=0x256210) returned 1 [0216.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996\\....\\temporaryfile")) returned 0 [0216.996] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996\\temporaryfile")) returned 1 [0216.997] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0216.997] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0216.997] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0216.997] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0216.997] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.997] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.998] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0216.998] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996\\temporaryfile")) returned 1 [0216.998] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86485860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86485860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86485860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0216.998] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0216.998] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18285996" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18285996")) returned 1 [0216.998] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 0 [0216.999] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.000] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4d48*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4d48*, lpNumberOfBytesWritten=0x18fdb8*=0xc2c0, lpOverlapped=0x0) returned 1 [0217.001] CloseHandle (hObject=0xe0) returned 1 [0217.001] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.002] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x227 [0217.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22f) returned 0x28f1f8 [0217.002] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x227, lpOverlapped=0x0) returned 1 [0217.003] CloseHandle (hObject=0xe0) returned 1 [0217.003] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 1 [0217.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.003] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.003] GetTickCount () returned 0x45d3c [0217.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.004] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012\\....\\temporaryfile")) returned 0 [0217.005] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012\\temporaryfile")) returned 1 [0217.005] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.006] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.006] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.006] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.006] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.006] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.006] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.006] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012\\temporaryfile")) returned 1 [0217.006] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.006] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.006] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012")) returned 1 [0217.006] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 0 [0217.007] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.008] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x230, lpOverlapped=0x0) returned 1 [0217.009] CloseHandle (hObject=0xe0) returned 1 [0217.009] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.010] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x618 [0217.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x620) returned 0x259e70 [0217.010] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x618, lpOverlapped=0x0) returned 1 [0217.011] CloseHandle (hObject=0xe0) returned 1 [0217.011] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0217.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.012] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.012] GetTickCount () returned 0x45d3c [0217.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.013] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012\\....\\temporaryfile")) returned 0 [0217.013] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012\\temporaryfile")) returned 1 [0217.014] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.015] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.015] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.015] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.015] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.015] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.015] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.015] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012\\temporaryfile")) returned 1 [0217.015] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ab9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864ab9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864ab9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.015] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.015] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286012" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286012")) returned 1 [0217.015] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 0 [0217.016] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.016] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x620, lpOverlapped=0x0) returned 1 [0217.017] CloseHandle (hObject=0xe0) returned 1 [0217.017] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.017] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x80f1 [0217.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80f9) returned 0x2a8a70 [0217.017] ReadFile (in: hFile=0xe0, lpBuffer=0x2a8a78, nNumberOfBytesToRead=0x80f1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a8a78*, lpNumberOfBytesRead=0x18fdd0*=0x80f1, lpOverlapped=0x0) returned 1 [0217.019] CloseHandle (hObject=0xe0) returned 1 [0217.019] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0217.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.020] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.020] GetTickCount () returned 0x45d4b [0217.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.021] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286027\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286027\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286027\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286027\\....\\temporaryfile")) returned 0 [0217.021] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286027\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286027\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286027\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286027\\temporaryfile")) returned 1 [0217.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286027\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864d1b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864d1b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864d1b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.022] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864d1b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864d1b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864d1b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.022] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864d1b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864d1b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864d1b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286027\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864d1b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864d1b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864d1b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.022] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864d1b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864d1b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864d1b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.022] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864d1b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864d1b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864d1b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.022] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286027\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286027\\temporaryfile")) returned 1 [0217.023] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864d1b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864d1b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864d1b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.023] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286027" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286027")) returned 1 [0217.023] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 0 [0217.024] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.024] WriteFile (in: hFile=0xe0, lpBuffer=0x2b0b80*, nNumberOfBytesToWrite=0x80f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b0b80*, lpNumberOfBytesWritten=0x18fdb8*=0x80f8, lpOverlapped=0x0) returned 1 [0217.025] CloseHandle (hObject=0xe0) returned 1 [0217.025] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.025] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x864d1b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864d1b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0217.026] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.026] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.027] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.027] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0217.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256228 [0217.027] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.027] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xda86 [0217.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xda8e) returned 0x2a8a70 [0217.027] ReadFile (in: hFile=0xe0, lpBuffer=0x2a8a78, nNumberOfBytesToRead=0xda86, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a8a78*, lpNumberOfBytesRead=0x18fdd0*=0xda86, lpOverlapped=0x0) returned 1 [0217.029] CloseHandle (hObject=0xe0) returned 1 [0217.029] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 1 [0217.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.030] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.030] GetTickCount () returned 0x45d5b [0217.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.031] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043\\....\\temporaryfile")) returned 0 [0217.031] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043\\temporaryfile")) returned 1 [0217.032] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.032] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.032] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.032] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.033] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.033] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.033] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.033] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043\\temporaryfile")) returned 1 [0217.033] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.033] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.033] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043")) returned 1 [0217.033] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 0 [0217.034] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.035] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6510*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6510*, lpNumberOfBytesWritten=0x18fdb8*=0xda90, lpOverlapped=0x0) returned 1 [0217.036] CloseHandle (hObject=0xe0) returned 1 [0217.036] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.037] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x225 [0217.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22d) returned 0x28f1f8 [0217.037] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x225, lpOverlapped=0x0) returned 1 [0217.038] CloseHandle (hObject=0xe0) returned 1 [0217.038] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 1 [0217.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.039] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.039] GetTickCount () returned 0x45d5b [0217.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.040] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043\\....\\temporaryfile")) returned 0 [0217.040] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043\\temporaryfile")) returned 1 [0217.041] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.041] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.041] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.041] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.041] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.042] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.042] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.042] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043\\temporaryfile")) returned 1 [0217.042] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864f7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x864f7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x864f7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.042] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.042] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286043" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286043")) returned 1 [0217.042] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 0 [0217.042] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.047] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x230, lpOverlapped=0x0) returned 1 [0217.048] CloseHandle (hObject=0xe0) returned 1 [0217.048] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.048] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x785 [0217.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78d) returned 0x25f580 [0217.048] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x785, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x785, lpOverlapped=0x0) returned 1 [0217.050] CloseHandle (hObject=0xe0) returned 1 [0217.050] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0217.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.051] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.051] GetTickCount () returned 0x45d6b [0217.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.051] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059\\....\\temporaryfile")) returned 0 [0217.052] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059\\temporaryfile")) returned 1 [0217.053] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.053] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.053] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.053] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.053] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.053] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.053] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.053] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059\\temporaryfile")) returned 1 [0217.053] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.053] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.053] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059")) returned 1 [0217.054] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 0 [0217.054] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.054] WriteFile (in: hFile=0xe0, lpBuffer=0x25fd20*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25fd20*, lpNumberOfBytesWritten=0x18fdb8*=0x790, lpOverlapped=0x0) returned 1 [0217.055] CloseHandle (hObject=0xe0) returned 1 [0217.055] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.056] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6b0f [0217.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6b17) returned 0x2a8a70 [0217.056] ReadFile (in: hFile=0xe0, lpBuffer=0x2a8a78, nNumberOfBytesToRead=0x6b0f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a8a78*, lpNumberOfBytesRead=0x18fdd0*=0x6b0f, lpOverlapped=0x0) returned 1 [0217.058] CloseHandle (hObject=0xe0) returned 1 [0217.058] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0217.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.059] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.059] GetTickCount () returned 0x45d6b [0217.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.059] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.060] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059\\....\\temporaryfile")) returned 0 [0217.060] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059\\temporaryfile")) returned 1 [0217.061] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.061] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.061] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.061] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.061] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.061] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.061] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.061] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059\\temporaryfile")) returned 1 [0217.062] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8651dde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8651dde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8651dde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.062] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.062] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286059" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286059")) returned 1 [0217.062] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 0 [0217.062] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.063] WriteFile (in: hFile=0xe0, lpBuffer=0x2af598*, nNumberOfBytesToWrite=0x6b18, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2af598*, lpNumberOfBytesWritten=0x18fdb8*=0x6b18, lpOverlapped=0x0) returned 1 [0217.064] CloseHandle (hObject=0xe0) returned 1 [0217.064] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.064] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86543f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86543f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0217.064] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.065] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.065] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.065] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x51a15810, dwReserved1=0x1d301bf, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0217.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0217.066] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.066] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xeafa [0217.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xeb02) returned 0x2a8a70 [0217.066] ReadFile (in: hFile=0xe0, lpBuffer=0x2a8a78, nNumberOfBytesToRead=0xeafa, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a8a78*, lpNumberOfBytesRead=0x18fdd0*=0xeafa, lpOverlapped=0x0) returned 1 [0217.067] CloseHandle (hObject=0xe0) returned 1 [0217.067] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 1 [0217.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.069] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.069] GetTickCount () returned 0x45d7a [0217.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.069] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286074\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286074\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286074\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286074\\....\\temporaryfile")) returned 0 [0217.070] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286074\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286074\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286074\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286074\\temporaryfile")) returned 1 [0217.071] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286074\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86543f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86543f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86543f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.071] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86543f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86543f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86543f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.071] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86543f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86543f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86543f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.071] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286074\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86543f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86543f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86543f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.071] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86543f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86543f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86543f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.071] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86543f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86543f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86543f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.071] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.071] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286074\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286074\\temporaryfile")) returned 1 [0217.071] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86543f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86543f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86543f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.071] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.071] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286074" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286074")) returned 1 [0217.072] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 0 [0217.073] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.073] WriteFile (in: hFile=0xe0, lpBuffer=0x2b7588*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b7588*, lpNumberOfBytesWritten=0x18fdb8*=0xeb00, lpOverlapped=0x0) returned 1 [0217.075] CloseHandle (hObject=0xe0) returned 1 [0217.075] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.075] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x254 [0217.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25c) returned 0x28f1f8 [0217.075] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x254, lpOverlapped=0x0) returned 1 [0217.076] CloseHandle (hObject=0xe0) returned 1 [0217.076] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 1 [0217.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.077] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.077] GetTickCount () returned 0x45d8a [0217.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.078] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090\\....\\temporaryfile")) returned 0 [0217.078] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090\\temporaryfile")) returned 1 [0217.079] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.079] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.079] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.079] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.080] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.080] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.080] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090\\temporaryfile")) returned 1 [0217.080] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.080] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090")) returned 1 [0217.080] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 0 [0217.080] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.082] WriteFile (in: hFile=0xe0, lpBuffer=0x2a8a90*, nNumberOfBytesToWrite=0x258, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a8a90*, lpNumberOfBytesWritten=0x18fdb8*=0x258, lpOverlapped=0x0) returned 1 [0217.083] CloseHandle (hObject=0xe0) returned 1 [0217.083] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.084] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd97 [0217.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd9f) returned 0x25f580 [0217.084] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xd97, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xd97, lpOverlapped=0x0) returned 1 [0217.086] CloseHandle (hObject=0xe0) returned 1 [0217.086] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0217.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.087] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.087] GetTickCount () returned 0x45d8a [0217.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.087] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090\\....\\temporaryfile")) returned 0 [0217.088] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090\\temporaryfile")) returned 1 [0217.089] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.089] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.089] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.089] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.089] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.089] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.090] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090\\temporaryfile")) returned 1 [0217.090] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8656a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8656a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8656a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.090] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286090" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286090")) returned 1 [0217.090] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 0 [0217.090] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.091] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xda0, lpOverlapped=0x0) returned 1 [0217.094] CloseHandle (hObject=0xe0) returned 1 [0217.094] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.094] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7c5d [0217.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c65) returned 0x2aca70 [0217.094] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x7c5d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x7c5d, lpOverlapped=0x0) returned 1 [0217.101] CloseHandle (hObject=0xe0) returned 1 [0217.101] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0217.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.102] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.102] GetTickCount () returned 0x45d99 [0217.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.102] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286105\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286105\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286105\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286105\\....\\temporaryfile")) returned 0 [0217.103] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286105\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286105\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286105\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286105\\temporaryfile")) returned 1 [0217.104] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286105\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86590200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86590200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86590200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.104] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86590200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86590200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86590200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.104] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86590200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86590200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86590200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.104] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286105\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86590200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86590200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86590200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.104] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86590200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86590200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86590200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.104] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86590200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86590200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86590200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.104] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286105\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286105\\temporaryfile")) returned 1 [0217.104] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86590200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86590200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86590200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.104] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286105" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286105")) returned 1 [0217.105] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 0 [0217.105] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.106] WriteFile (in: hFile=0xe0, lpBuffer=0x2b46e8*, nNumberOfBytesToWrite=0x7c68, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b46e8*, lpNumberOfBytesWritten=0x18fdb8*=0x7c68, lpOverlapped=0x0) returned 1 [0217.107] CloseHandle (hObject=0xe0) returned 1 [0217.107] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.107] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86590200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86590200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0217.107] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.107] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51a61ad0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.108] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51a61ad0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.108] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x51a61ad0, dwReserved1=0x1d301bf, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0217.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256198 [0217.109] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.109] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1a537 [0217.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a53f) returned 0x2aca70 [0217.109] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x1a537, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x1a537, lpOverlapped=0x0) returned 1 [0217.111] CloseHandle (hObject=0xe0) returned 1 [0217.111] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 1 [0217.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.112] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.112] GetTickCount () returned 0x45da9 [0217.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.113] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121\\....\\temporaryfile")) returned 0 [0217.113] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121\\temporaryfile")) returned 1 [0217.114] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.114] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.114] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.114] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.114] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.114] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.115] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121\\temporaryfile")) returned 1 [0217.115] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.115] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121")) returned 1 [0217.115] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 0 [0217.117] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.117] WriteFile (in: hFile=0xe0, lpBuffer=0x2c6fc0*, nNumberOfBytesToWrite=0x1a540, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c6fc0*, lpNumberOfBytesWritten=0x18fdb8*=0x1a540, lpOverlapped=0x0) returned 1 [0217.119] CloseHandle (hObject=0xe0) returned 1 [0217.119] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.120] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1c2 [0217.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ca) returned 0x28f1f8 [0217.120] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1c2, lpOverlapped=0x0) returned 1 [0217.121] CloseHandle (hObject=0xe0) returned 1 [0217.121] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 1 [0217.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.122] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.122] GetTickCount () returned 0x45da9 [0217.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.123] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121\\....\\temporaryfile")) returned 0 [0217.123] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121\\temporaryfile")) returned 1 [0217.124] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.124] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.125] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.125] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.125] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.125] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.125] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121\\temporaryfile")) returned 1 [0217.125] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865b6360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865b6360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865b6360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.125] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286121" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286121")) returned 1 [0217.125] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 0 [0217.126] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.126] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1c8, lpOverlapped=0x0) returned 1 [0217.127] CloseHandle (hObject=0xe0) returned 1 [0217.127] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.128] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xaa2 [0217.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaaa) returned 0x25f580 [0217.128] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xaa2, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xaa2, lpOverlapped=0x0) returned 1 [0217.129] CloseHandle (hObject=0xe0) returned 1 [0217.129] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0217.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.130] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.130] GetTickCount () returned 0x45db9 [0217.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.131] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286137\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286137\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286137\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286137\\....\\temporaryfile")) returned 0 [0217.132] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286137\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286137\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286137\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286137\\temporaryfile")) returned 1 [0217.132] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286137\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865dc4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865dc4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865dc4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.133] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865dc4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865dc4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865dc4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.133] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865dc4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865dc4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865dc4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.133] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286137\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865dc4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865dc4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865dc4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.133] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865dc4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865dc4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865dc4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.133] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865dc4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865dc4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865dc4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.133] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.133] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286137\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286137\\temporaryfile")) returned 1 [0217.133] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865dc4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x865dc4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x865dc4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.133] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.133] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286137" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286137")) returned 1 [0217.133] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 0 [0217.134] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.135] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xaa8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xaa8, lpOverlapped=0x0) returned 1 [0217.136] CloseHandle (hObject=0xe0) returned 1 [0217.136] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.137] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa90c [0217.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa914) returned 0x2aca70 [0217.137] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0xa90c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0xa90c, lpOverlapped=0x0) returned 1 [0217.139] CloseHandle (hObject=0xe0) returned 1 [0217.139] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0217.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.140] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.140] GetTickCount () returned 0x45dc8 [0217.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.140] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152\\....\\temporaryfile")) returned 0 [0217.141] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152\\temporaryfile")) returned 1 [0217.142] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.142] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.142] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.142] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.142] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.142] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.142] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.142] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152\\temporaryfile")) returned 1 [0217.142] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.143] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.143] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152")) returned 1 [0217.143] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 0 [0217.144] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.144] WriteFile (in: hFile=0xe0, lpBuffer=0x2b7398*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b7398*, lpNumberOfBytesWritten=0x18fdb8*=0xa910, lpOverlapped=0x0) returned 1 [0217.145] CloseHandle (hObject=0xe0) returned 1 [0217.145] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.145] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0217.146] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.146] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51c2ab50, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.147] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51c2ab50, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.147] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x51c2ab50, dwReserved1=0x1d301bf, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0217.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256228 [0217.147] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.148] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xaec9 [0217.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaed1) returned 0x2aca70 [0217.148] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0xaec9, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0xaec9, lpOverlapped=0x0) returned 1 [0217.149] CloseHandle (hObject=0xe0) returned 1 [0217.150] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 1 [0217.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.151] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.151] GetTickCount () returned 0x45dc8 [0217.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.151] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152\\....\\temporaryfile")) returned 0 [0217.152] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152\\temporaryfile")) returned 1 [0217.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.153] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.153] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.153] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.153] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.153] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152\\temporaryfile")) returned 1 [0217.153] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86602620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86602620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86602620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.154] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.154] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286152" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286152")) returned 1 [0217.154] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 0 [0217.155] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.155] WriteFile (in: hFile=0xe0, lpBuffer=0x2b7958*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b7958*, lpNumberOfBytesWritten=0x18fdb8*=0xaed0, lpOverlapped=0x0) returned 1 [0217.157] CloseHandle (hObject=0xe0) returned 1 [0217.157] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.158] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1d1 [0217.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d9) returned 0x28f1f8 [0217.158] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1d1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1d1, lpOverlapped=0x0) returned 1 [0217.159] CloseHandle (hObject=0xe0) returned 1 [0217.159] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 1 [0217.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.160] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.160] GetTickCount () returned 0x45dd8 [0217.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.160] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168\\....\\temporaryfile")) returned 0 [0217.161] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168\\temporaryfile")) returned 1 [0217.162] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.162] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.162] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.162] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.162] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.162] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.162] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.162] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168\\temporaryfile")) returned 1 [0217.163] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.163] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168")) returned 1 [0217.163] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 0 [0217.163] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.164] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1d8, lpOverlapped=0x0) returned 1 [0217.164] CloseHandle (hObject=0xe0) returned 1 [0217.165] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.165] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3b1 [0217.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3b9) returned 0x259e70 [0217.165] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x3b1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x3b1, lpOverlapped=0x0) returned 1 [0217.166] CloseHandle (hObject=0xe0) returned 1 [0217.166] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0217.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.167] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.167] GetTickCount () returned 0x45dd8 [0217.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.168] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168\\....\\temporaryfile")) returned 0 [0217.169] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168\\temporaryfile")) returned 1 [0217.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.170] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.170] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.170] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.170] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.170] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.170] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168\\temporaryfile")) returned 1 [0217.170] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86628780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86628780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86628780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.170] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.170] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286168" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286168")) returned 1 [0217.171] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 0 [0217.171] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.173] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x3b8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x3b8, lpOverlapped=0x0) returned 1 [0217.174] CloseHandle (hObject=0xe0) returned 1 [0217.174] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.175] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7f5f [0217.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7f67) returned 0x2aca70 [0217.175] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x7f5f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x7f5f, lpOverlapped=0x0) returned 1 [0217.176] CloseHandle (hObject=0xe0) returned 1 [0217.176] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0217.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.177] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.177] GetTickCount () returned 0x45de7 [0217.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.178] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286183\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286183\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286183\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286183\\....\\temporaryfile")) returned 0 [0217.178] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286183\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286183\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286183\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286183\\temporaryfile")) returned 1 [0217.179] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286183\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8664e8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8664e8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8664e8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.179] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8664e8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8664e8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8664e8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.180] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8664e8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8664e8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8664e8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.180] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286183\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8664e8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8664e8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8664e8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.180] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8664e8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8664e8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8664e8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.180] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8664e8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8664e8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8664e8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.180] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.180] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286183\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286183\\temporaryfile")) returned 1 [0217.180] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8664e8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8664e8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8664e8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.180] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.180] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286183" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286183")) returned 1 [0217.180] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 0 [0217.181] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.181] WriteFile (in: hFile=0xe0, lpBuffer=0x2b49e8*, nNumberOfBytesToWrite=0x7f68, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b49e8*, lpNumberOfBytesWritten=0x18fdb8*=0x7f68, lpOverlapped=0x0) returned 1 [0217.183] CloseHandle (hObject=0xe0) returned 1 [0217.186] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.186] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8664e8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8664e8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0217.186] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.186] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51c2ab50, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.187] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51c2ab50, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.187] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x51c2ab50, dwReserved1=0x1d301bf, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0217.187] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256228 [0217.187] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.188] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe1ba [0217.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe1c2) returned 0x2aca70 [0217.188] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0xe1ba, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0xe1ba, lpOverlapped=0x0) returned 1 [0217.189] CloseHandle (hObject=0xe0) returned 1 [0217.189] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 1 [0217.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.191] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.191] GetTickCount () returned 0x45df7 [0217.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.191] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199\\....\\temporaryfile")) returned 0 [0217.192] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199\\temporaryfile")) returned 1 [0217.193] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.193] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.193] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.193] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.193] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.193] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.193] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.193] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199\\temporaryfile")) returned 1 [0217.193] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.193] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199")) returned 1 [0217.194] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 0 [0217.195] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.195] WriteFile (in: hFile=0xe0, lpBuffer=0x2bac48*, nNumberOfBytesToWrite=0xe1c0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bac48*, lpNumberOfBytesWritten=0x18fdb8*=0xe1c0, lpOverlapped=0x0) returned 1 [0217.197] CloseHandle (hObject=0xe0) returned 1 [0217.197] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.197] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1f5 [0217.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1fd) returned 0x28f1f8 [0217.197] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1f5, lpOverlapped=0x0) returned 1 [0217.198] CloseHandle (hObject=0xe0) returned 1 [0217.198] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf")) returned 1 [0217.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.199] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.199] GetTickCount () returned 0x45df7 [0217.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.200] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199\\....\\temporaryfile")) returned 0 [0217.200] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199\\temporaryfile")) returned 1 [0217.201] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.201] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.202] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.202] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.202] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.202] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.202] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.202] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199\\temporaryfile")) returned 1 [0217.202] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86674a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86674a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86674a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.202] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.202] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286199" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286199")) returned 1 [0217.202] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 0 [0217.203] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.204] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x200, lpOverlapped=0x0) returned 1 [0217.205] CloseHandle (hObject=0xe0) returned 1 [0217.205] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.206] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7fc [0217.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x804) returned 0x25f580 [0217.206] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x7fc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x7fc, lpOverlapped=0x0) returned 1 [0217.208] CloseHandle (hObject=0xe0) returned 1 [0217.208] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0217.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.209] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.209] GetTickCount () returned 0x45e07 [0217.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.209] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215\\....\\temporaryfile")) returned 0 [0217.210] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215\\temporaryfile")) returned 1 [0217.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.211] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.211] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.211] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.211] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.211] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215\\temporaryfile")) returned 1 [0217.211] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.211] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215")) returned 1 [0217.211] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 0 [0217.212] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.212] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x800, lpOverlapped=0x0) returned 1 [0217.213] CloseHandle (hObject=0xe0) returned 1 [0217.213] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.214] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x74e5 [0217.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x74ed) returned 0x2aca70 [0217.214] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x74e5, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x74e5, lpOverlapped=0x0) returned 1 [0217.215] CloseHandle (hObject=0xe0) returned 1 [0217.215] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0217.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.216] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.216] GetTickCount () returned 0x45e07 [0217.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215\\....\\temporaryfile")) returned 0 [0217.217] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215\\temporaryfile")) returned 1 [0217.218] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866c0d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866c0d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.219] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866c0d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866c0d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.219] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.219] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.219] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.219] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.219] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215\\temporaryfile")) returned 1 [0217.219] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8669aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8669aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8669aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.219] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286215" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286215")) returned 1 [0217.219] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 0 [0217.220] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.220] WriteFile (in: hFile=0xe0, lpBuffer=0x2b3f70*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b3f70*, lpNumberOfBytesWritten=0x18fdb8*=0x74f0, lpOverlapped=0x0) returned 1 [0217.222] CloseHandle (hObject=0xe0) returned 1 [0217.222] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.222] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x866c0d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866c0d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0217.222] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.222] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51c50cb0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.223] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51c50cb0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.223] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x51c50cb0, dwReserved1=0x1d301bf, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0217.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256198 [0217.223] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.224] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xba44 [0217.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xba4c) returned 0x2aca70 [0217.224] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0xba44, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0xba44, lpOverlapped=0x0) returned 1 [0217.225] CloseHandle (hObject=0xe0) returned 1 [0217.225] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm")) returned 1 [0217.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.226] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.226] GetTickCount () returned 0x45e16 [0217.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.227] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286230\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286230\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286230\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286230\\....\\temporaryfile")) returned 0 [0217.228] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286230\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286230\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286230\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286230\\temporaryfile")) returned 1 [0217.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286230\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866c0d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866c0d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866c0d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.229] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866c0d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866c0d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866c0d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.229] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866c0d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866c0d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866c0d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286230\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866c0d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866c0d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866c0d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.229] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866c0d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866c0d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866c0d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.229] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866c0d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866c0d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866c0d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.229] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286230\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286230\\temporaryfile")) returned 1 [0217.229] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866c0d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866c0d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866c0d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.229] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.230] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286230" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286230")) returned 1 [0217.230] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 0 [0217.231] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.231] WriteFile (in: hFile=0xe0, lpBuffer=0x2b84d0*, nNumberOfBytesToWrite=0xba48, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b84d0*, lpNumberOfBytesWritten=0x18fdb8*=0xba48, lpOverlapped=0x0) returned 1 [0217.232] CloseHandle (hObject=0xe0) returned 1 [0217.233] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.233] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x262 [0217.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26a) returned 0x259e70 [0217.234] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x262, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x262, lpOverlapped=0x0) returned 1 [0217.234] CloseHandle (hObject=0xe0) returned 1 [0217.234] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf")) returned 1 [0217.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.235] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.235] GetTickCount () returned 0x45e26 [0217.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.236] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246\\....\\temporaryfile")) returned 0 [0217.236] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246\\temporaryfile")) returned 1 [0217.237] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.237] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.237] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.237] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.238] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.238] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.238] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246\\temporaryfile")) returned 1 [0217.238] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.238] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246")) returned 1 [0217.238] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 0 [0217.238] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.241] WriteFile (in: hFile=0xe0, lpBuffer=0x25a0f0*, nNumberOfBytesToWrite=0x268, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25a0f0*, lpNumberOfBytesWritten=0x18fdb8*=0x268, lpOverlapped=0x0) returned 1 [0217.243] CloseHandle (hObject=0xe0) returned 1 [0217.243] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.244] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x553 [0217.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x55b) returned 0x259e70 [0217.244] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x553, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x553, lpOverlapped=0x0) returned 1 [0217.245] CloseHandle (hObject=0xe0) returned 1 [0217.245] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0217.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.246] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.246] GetTickCount () returned 0x45e26 [0217.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.247] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246\\....\\temporaryfile")) returned 0 [0217.247] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246\\temporaryfile")) returned 1 [0217.248] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.249] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.249] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.249] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.249] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.249] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.249] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246\\temporaryfile")) returned 1 [0217.249] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866e6e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x866e6e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x866e6e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.249] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286246" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286246")) returned 1 [0217.249] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 0 [0217.250] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.250] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x558, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x558, lpOverlapped=0x0) returned 1 [0217.251] CloseHandle (hObject=0xe0) returned 1 [0217.251] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.252] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4f93 [0217.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f9b) returned 0x2aca70 [0217.252] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x4f93, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x4f93, lpOverlapped=0x0) returned 1 [0217.253] CloseHandle (hObject=0xe0) returned 1 [0217.253] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0217.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.254] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.254] GetTickCount () returned 0x45e35 [0217.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.254] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286261\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286261\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286261\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286261\\....\\temporaryfile")) returned 0 [0217.255] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286261\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286261\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286261\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286261\\temporaryfile")) returned 1 [0217.256] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286261\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8670cfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8670cfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8670cfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.256] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8670cfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8670cfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8670cfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.256] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8670cfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8670cfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8670cfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.256] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286261\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8670cfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8670cfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8670cfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.256] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8670cfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8670cfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8670cfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.256] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8670cfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8670cfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8670cfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.256] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.256] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286261\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286261\\temporaryfile")) returned 1 [0217.257] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8670cfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8670cfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8670cfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.257] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.257] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286261" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286261")) returned 1 [0217.257] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 0 [0217.257] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.258] WriteFile (in: hFile=0xe0, lpBuffer=0x2b1a20*, nNumberOfBytesToWrite=0x4f98, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b1a20*, lpNumberOfBytesWritten=0x18fdb8*=0x4f98, lpOverlapped=0x0) returned 1 [0217.259] CloseHandle (hObject=0xe0) returned 1 [0217.259] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.259] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8670cfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8670cfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0217.259] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.259] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51cc30d0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51cc30d0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x51cc30d0, dwReserved1=0x1d301bf, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0217.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0217.260] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.261] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd613 [0217.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd61b) returned 0x2aca70 [0217.262] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0xd613, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0xd613, lpOverlapped=0x0) returned 1 [0217.263] CloseHandle (hObject=0xe0) returned 1 [0217.263] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm")) returned 1 [0217.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.264] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.264] GetTickCount () returned 0x45e45 [0217.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.265] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277\\....\\temporaryfile")) returned 0 [0217.265] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277\\temporaryfile")) returned 1 [0217.266] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.266] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.267] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.267] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.267] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.267] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.267] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.267] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277\\temporaryfile")) returned 1 [0217.267] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.267] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.267] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277")) returned 1 [0217.267] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 0 [0217.268] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.269] WriteFile (in: hFile=0xe0, lpBuffer=0x2ba0a0*, nNumberOfBytesToWrite=0xd618, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ba0a0*, lpNumberOfBytesWritten=0x18fdb8*=0xd618, lpOverlapped=0x0) returned 1 [0217.270] CloseHandle (hObject=0xe0) returned 1 [0217.270] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.271] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1e6 [0217.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ee) returned 0x28f1f8 [0217.271] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1e6, lpOverlapped=0x0) returned 1 [0217.272] CloseHandle (hObject=0xe0) returned 1 [0217.272] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 1 [0217.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.272] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.273] GetTickCount () returned 0x45e45 [0217.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.273] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277\\....\\temporaryfile")) returned 0 [0217.274] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277\\temporaryfile")) returned 1 [0217.275] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.275] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.275] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.275] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.275] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.275] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.275] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.275] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277\\temporaryfile")) returned 1 [0217.275] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86733120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86733120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86733120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.275] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.276] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286277" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286277")) returned 1 [0217.276] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 0 [0217.276] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.278] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1f0, lpOverlapped=0x0) returned 1 [0217.278] CloseHandle (hObject=0xe0) returned 1 [0217.279] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.279] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x50d [0217.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x515) returned 0x259e70 [0217.279] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x50d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x50d, lpOverlapped=0x0) returned 1 [0217.280] CloseHandle (hObject=0xe0) returned 1 [0217.280] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0217.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.281] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.281] GetTickCount () returned 0x45e55 [0217.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.282] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293\\....\\temporaryfile")) returned 0 [0217.282] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293\\temporaryfile")) returned 1 [0217.283] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.283] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.283] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.283] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.284] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.284] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.284] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.284] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293\\temporaryfile")) returned 1 [0217.284] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.284] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.284] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293")) returned 1 [0217.284] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 0 [0217.284] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.285] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x518, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x518, lpOverlapped=0x0) returned 1 [0217.286] CloseHandle (hObject=0xe0) returned 1 [0217.286] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.286] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x505f [0217.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5067) returned 0x2aca70 [0217.286] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x505f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x505f, lpOverlapped=0x0) returned 1 [0217.288] CloseHandle (hObject=0xe0) returned 1 [0217.288] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0217.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.289] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.289] GetTickCount () returned 0x45e55 [0217.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.290] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.290] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293\\....\\temporaryfile")) returned 0 [0217.290] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293\\temporaryfile")) returned 1 [0217.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.291] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.292] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.292] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.292] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.292] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.292] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.292] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293\\temporaryfile")) returned 1 [0217.292] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86759280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.292] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.292] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286293" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286293")) returned 1 [0217.292] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 0 [0217.293] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.293] WriteFile (in: hFile=0xe0, lpBuffer=0x2b1ae8*, nNumberOfBytesToWrite=0x5068, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b1ae8*, lpNumberOfBytesWritten=0x18fdb8*=0x5068, lpOverlapped=0x0) returned 1 [0217.294] CloseHandle (hObject=0xe0) returned 1 [0217.294] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.295] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86759280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86759280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0217.295] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.295] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51cc30d0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.295] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51cc30d0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.295] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x51cc30d0, dwReserved1=0x1d301bf, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0217.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0217.296] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.296] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb1d8 [0217.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb1e0) returned 0x2aca70 [0217.297] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0xb1d8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0xb1d8, lpOverlapped=0x0) returned 1 [0217.298] CloseHandle (hObject=0xe0) returned 1 [0217.298] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 1 [0217.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.299] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.299] GetTickCount () returned 0x45e64 [0217.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.300] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.300] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308\\....\\temporaryfile")) returned 0 [0217.300] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308\\temporaryfile")) returned 1 [0217.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.301] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.301] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.302] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.302] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.302] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.302] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308\\temporaryfile")) returned 1 [0217.303] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.303] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.303] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308")) returned 1 [0217.303] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 0 [0217.304] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.304] WriteFile (in: hFile=0xe0, lpBuffer=0x2b7c60*, nNumberOfBytesToWrite=0xb1e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b7c60*, lpNumberOfBytesWritten=0x18fdb8*=0xb1e0, lpOverlapped=0x0) returned 1 [0217.306] CloseHandle (hObject=0xe0) returned 1 [0217.306] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.307] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1e0 [0217.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e8) returned 0x28f1f8 [0217.307] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1e0, lpOverlapped=0x0) returned 1 [0217.308] CloseHandle (hObject=0xe0) returned 1 [0217.308] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 1 [0217.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.309] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.309] GetTickCount () returned 0x45e64 [0217.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.309] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308\\....\\temporaryfile")) returned 0 [0217.310] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308\\temporaryfile")) returned 1 [0217.311] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.311] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.311] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.311] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.312] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.312] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.312] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.312] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308\\temporaryfile")) returned 1 [0217.312] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8677f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8677f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8677f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.312] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.312] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286308" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286308")) returned 1 [0217.312] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 0 [0217.312] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.314] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1e8, lpOverlapped=0x0) returned 1 [0217.315] CloseHandle (hObject=0xe0) returned 1 [0217.315] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.315] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x507 [0217.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x50f) returned 0x259e70 [0217.315] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x507, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x507, lpOverlapped=0x0) returned 1 [0217.317] CloseHandle (hObject=0xe0) returned 1 [0217.317] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0217.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.321] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.321] GetTickCount () returned 0x45e74 [0217.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.322] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286324\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286324\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286324\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286324\\....\\temporaryfile")) returned 0 [0217.322] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286324\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286324\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286324\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286324\\temporaryfile")) returned 1 [0217.323] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286324\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867a5540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867a5540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867a5540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.323] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867a5540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867a5540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867a5540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.323] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867a5540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867a5540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867a5540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.323] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286324\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867a5540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867a5540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867a5540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.324] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867a5540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867a5540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867a5540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.324] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867a5540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867a5540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867a5540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.324] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.324] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286324\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286324\\temporaryfile")) returned 1 [0217.324] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867a5540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867a5540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867a5540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.324] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.324] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286324" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286324")) returned 1 [0217.324] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 0 [0217.324] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.325] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x510, lpOverlapped=0x0) returned 1 [0217.326] CloseHandle (hObject=0xe0) returned 1 [0217.326] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.326] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6fb3 [0217.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6fbb) returned 0x2aca70 [0217.327] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x6fb3, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x6fb3, lpOverlapped=0x0) returned 1 [0217.328] CloseHandle (hObject=0xe0) returned 1 [0217.328] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0217.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.329] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.329] GetTickCount () returned 0x45e83 [0217.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.330] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339\\....\\temporaryfile")) returned 0 [0217.330] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339\\temporaryfile")) returned 1 [0217.331] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.331] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.331] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.331] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.331] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.332] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.332] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.332] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339\\temporaryfile")) returned 1 [0217.332] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.332] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.332] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339")) returned 1 [0217.332] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 0 [0217.333] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.333] WriteFile (in: hFile=0xe0, lpBuffer=0x2b3a40*, nNumberOfBytesToWrite=0x6fb8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b3a40*, lpNumberOfBytesWritten=0x18fdb8*=0x6fb8, lpOverlapped=0x0) returned 1 [0217.334] CloseHandle (hObject=0xe0) returned 1 [0217.334] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.334] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0217.335] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.335] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.335] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.335] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0217.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256198 [0217.335] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.336] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x116dc [0217.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x116e4) returned 0x2aca70 [0217.336] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x116dc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x116dc, lpOverlapped=0x0) returned 1 [0217.338] CloseHandle (hObject=0xe0) returned 1 [0217.338] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 1 [0217.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.339] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.339] GetTickCount () returned 0x45e83 [0217.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.340] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339\\....\\temporaryfile")) returned 0 [0217.341] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339\\temporaryfile")) returned 1 [0217.342] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.342] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.342] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.342] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.342] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.342] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.342] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.342] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339\\temporaryfile")) returned 1 [0217.342] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867cb6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867cb6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867cb6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.343] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.343] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286339" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286339")) returned 1 [0217.343] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 0 [0217.344] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.345] WriteFile (in: hFile=0xe0, lpBuffer=0x2be168*, nNumberOfBytesToWrite=0x116e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2be168*, lpNumberOfBytesWritten=0x18fdb8*=0x116e0, lpOverlapped=0x0) returned 1 [0217.346] CloseHandle (hObject=0xe0) returned 1 [0217.346] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.347] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x239 [0217.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x241) returned 0x28f1f8 [0217.347] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x239, lpOverlapped=0x0) returned 1 [0217.348] CloseHandle (hObject=0xe0) returned 1 [0217.348] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 1 [0217.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.348] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.349] GetTickCount () returned 0x45e93 [0217.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.349] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355\\....\\temporaryfile")) returned 0 [0217.350] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355\\temporaryfile")) returned 1 [0217.351] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867f1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867f1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867f1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.351] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867f1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867f1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867f1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.351] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867f1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867f1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867f1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.351] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867f1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867f1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867f1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.351] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867f1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867f1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867f1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.351] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867f1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867f1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867f1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.351] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.351] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355\\temporaryfile")) returned 1 [0217.351] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867f1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x867f1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x867f1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.351] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.351] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355")) returned 1 [0217.352] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 0 [0217.352] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.353] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x240, lpOverlapped=0x0) returned 1 [0217.354] CloseHandle (hObject=0xe0) returned 1 [0217.354] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.355] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xf75 [0217.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf7d) returned 0x25f580 [0217.355] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xf75, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xf75, lpOverlapped=0x0) returned 1 [0217.356] CloseHandle (hObject=0xe0) returned 1 [0217.356] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0217.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.357] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.357] GetTickCount () returned 0x45e93 [0217.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.358] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355\\....\\temporaryfile")) returned 0 [0217.359] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355\\temporaryfile")) returned 1 [0217.360] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867f1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.360] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867f1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.360] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.360] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.360] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.360] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.360] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.360] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355\\temporaryfile")) returned 1 [0217.360] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.360] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.360] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286355" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286355")) returned 1 [0217.361] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 0 [0217.361] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.361] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xf80, lpOverlapped=0x0) returned 1 [0217.362] CloseHandle (hObject=0xe0) returned 1 [0217.363] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.365] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x81fd [0217.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8205) returned 0x2aca70 [0217.365] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x81fd, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x81fd, lpOverlapped=0x0) returned 1 [0217.367] CloseHandle (hObject=0xe0) returned 1 [0217.367] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0217.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.368] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.368] GetTickCount () returned 0x45ea3 [0217.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.369] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286371\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286371\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286371\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286371\\....\\temporaryfile")) returned 0 [0217.370] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286371\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286371\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286371\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286371\\temporaryfile")) returned 1 [0217.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286371\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.371] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.371] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286371\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.371] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.371] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.371] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.371] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286371\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286371\\temporaryfile")) returned 1 [0217.371] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86817960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.371] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.372] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286371" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286371")) returned 1 [0217.372] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 0 [0217.372] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.373] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4c88*, nNumberOfBytesToWrite=0x8208, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4c88*, lpNumberOfBytesWritten=0x18fdb8*=0x8208, lpOverlapped=0x0) returned 1 [0217.374] CloseHandle (hObject=0xe0) returned 1 [0217.374] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.374] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86817960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86817960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0217.375] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.375] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.376] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.376] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0217.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.376] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.377] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb0ce [0217.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0d6) returned 0x2aca70 [0217.377] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0xb0ce, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0xb0ce, lpOverlapped=0x0) returned 1 [0217.378] CloseHandle (hObject=0xe0) returned 1 [0217.378] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 1 [0217.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.379] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.379] GetTickCount () returned 0x45eb2 [0217.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.380] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386\\....\\temporaryfile")) returned 0 [0217.380] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386\\temporaryfile")) returned 1 [0217.381] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.382] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.382] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.382] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.382] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.382] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.382] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.382] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386\\temporaryfile")) returned 1 [0217.382] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.382] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.382] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386")) returned 1 [0217.382] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 0 [0217.383] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.384] WriteFile (in: hFile=0xe0, lpBuffer=0x2b7b58*, nNumberOfBytesToWrite=0xb0d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b7b58*, lpNumberOfBytesWritten=0x18fdb8*=0xb0d8, lpOverlapped=0x0) returned 1 [0217.385] CloseHandle (hObject=0xe0) returned 1 [0217.385] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.386] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1f7 [0217.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ff) returned 0x28f1f8 [0217.386] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1f7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1f7, lpOverlapped=0x0) returned 1 [0217.387] CloseHandle (hObject=0xe0) returned 1 [0217.387] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 1 [0217.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.388] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.388] GetTickCount () returned 0x45eb2 [0217.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.388] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386\\....\\temporaryfile")) returned 0 [0217.389] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386\\temporaryfile")) returned 1 [0217.390] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86863c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86863c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.390] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86863c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86863c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.390] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.390] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.390] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.391] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.391] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.391] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386\\temporaryfile")) returned 1 [0217.391] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8683dac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8683dac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8683dac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.391] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.391] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286386" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286386")) returned 1 [0217.391] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 0 [0217.391] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.392] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x200, lpOverlapped=0x0) returned 1 [0217.393] CloseHandle (hObject=0xe0) returned 1 [0217.393] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.393] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5ad [0217.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b5) returned 0x259e70 [0217.393] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x5ad, lpOverlapped=0x0) returned 1 [0217.395] CloseHandle (hObject=0xe0) returned 1 [0217.395] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0217.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.396] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.396] GetTickCount () returned 0x45ec2 [0217.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.396] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286402\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286402\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286402\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286402\\....\\temporaryfile")) returned 0 [0217.397] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286402\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286402\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286402\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286402\\temporaryfile")) returned 1 [0217.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286402\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86863c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86863c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86863c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.398] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86863c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86863c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86863c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.398] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86863c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86863c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86863c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286402\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86863c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86863c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86863c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.399] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86863c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86863c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86863c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.399] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86863c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86863c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86863c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.399] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286402\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286402\\temporaryfile")) returned 1 [0217.399] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86863c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86863c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86863c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.399] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286402" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286402")) returned 1 [0217.399] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 0 [0217.399] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.401] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x5b8, lpOverlapped=0x0) returned 1 [0217.402] CloseHandle (hObject=0xe0) returned 1 [0217.402] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.403] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6212 [0217.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x621a) returned 0x2aca70 [0217.403] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x6212, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x6212, lpOverlapped=0x0) returned 1 [0217.404] CloseHandle (hObject=0xe0) returned 1 [0217.404] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0217.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.405] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.405] GetTickCount () returned 0x45ed1 [0217.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.406] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417\\....\\temporaryfile")) returned 0 [0217.406] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417\\temporaryfile")) returned 1 [0217.407] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.408] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.408] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.408] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.408] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.408] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.408] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.408] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417\\temporaryfile")) returned 1 [0217.408] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.408] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.408] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417")) returned 1 [0217.408] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 0 [0217.409] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.409] WriteFile (in: hFile=0xe0, lpBuffer=0x2b2ca0*, nNumberOfBytesToWrite=0x6218, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b2ca0*, lpNumberOfBytesWritten=0x18fdb8*=0x6218, lpOverlapped=0x0) returned 1 [0217.411] CloseHandle (hObject=0xe0) returned 1 [0217.411] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.411] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0217.411] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.411] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51e3fe90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.412] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51e3fe90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.412] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x51e3fe90, dwReserved1=0x1d301bf, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0217.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0217.412] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.413] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1cf31 [0217.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1cf39) returned 0x2aca70 [0217.413] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x1cf31, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x1cf31, lpOverlapped=0x0) returned 1 [0217.414] CloseHandle (hObject=0xe0) returned 1 [0217.414] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm")) returned 1 [0217.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.416] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.416] GetTickCount () returned 0x45ed1 [0217.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.417] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417\\....\\temporaryfile")) returned 0 [0217.417] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417\\temporaryfile")) returned 1 [0217.418] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.418] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.419] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.419] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.419] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.419] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.419] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.419] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417\\temporaryfile")) returned 1 [0217.419] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86889d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86889d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86889d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.419] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.419] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286417" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286417")) returned 1 [0217.419] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 0 [0217.421] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.422] WriteFile (in: hFile=0xe0, lpBuffer=0x2c99c0*, nNumberOfBytesToWrite=0x1cf38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c99c0*, lpNumberOfBytesWritten=0x18fdb8*=0x1cf38, lpOverlapped=0x0) returned 1 [0217.424] CloseHandle (hObject=0xe0) returned 1 [0217.424] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.425] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x253 [0217.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25b) returned 0x2a8a88 [0217.425] ReadFile (in: hFile=0xe0, lpBuffer=0x2a8a90, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a8a90*, lpNumberOfBytesRead=0x18fdd0*=0x253, lpOverlapped=0x0) returned 1 [0217.426] CloseHandle (hObject=0xe0) returned 1 [0217.426] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf")) returned 1 [0217.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.427] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.427] GetTickCount () returned 0x45ee1 [0217.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.428] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286433\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286433\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286433\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286433\\....\\temporaryfile")) returned 0 [0217.428] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286433\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286433\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286433\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286433\\temporaryfile")) returned 1 [0217.429] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286433\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868afee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868afee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868afee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.429] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868afee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868afee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868afee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.429] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868afee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868afee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868afee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.429] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286433\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868afee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868afee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868afee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.430] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868afee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868afee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868afee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.430] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868afee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868afee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868afee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.430] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.430] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286433\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286433\\temporaryfile")) returned 1 [0217.430] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868afee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868afee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868afee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.430] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.430] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286433" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286433")) returned 1 [0217.430] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 0 [0217.430] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.432] WriteFile (in: hFile=0xe0, lpBuffer=0x2a8cf8*, nNumberOfBytesToWrite=0x258, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a8cf8*, lpNumberOfBytesWritten=0x18fdb8*=0x258, lpOverlapped=0x0) returned 1 [0217.433] CloseHandle (hObject=0xe0) returned 1 [0217.433] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.434] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x543 [0217.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54b) returned 0x259e70 [0217.434] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x543, lpOverlapped=0x0) returned 1 [0217.435] CloseHandle (hObject=0xe0) returned 1 [0217.435] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0217.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.437] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.437] GetTickCount () returned 0x45ef1 [0217.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.437] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449\\....\\temporaryfile")) returned 0 [0217.438] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449\\temporaryfile")) returned 1 [0217.439] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.439] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.439] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.439] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.439] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.439] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.439] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.439] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449\\temporaryfile")) returned 1 [0217.439] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.440] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.440] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449")) returned 1 [0217.440] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 0 [0217.440] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.440] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x548, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x548, lpOverlapped=0x0) returned 1 [0217.442] CloseHandle (hObject=0xe0) returned 1 [0217.442] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.442] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7e93 [0217.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7e9b) returned 0x2aca70 [0217.442] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x7e93, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x7e93, lpOverlapped=0x0) returned 1 [0217.444] CloseHandle (hObject=0xe0) returned 1 [0217.444] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0217.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.445] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.445] GetTickCount () returned 0x45ef1 [0217.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.446] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.446] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449\\....\\temporaryfile")) returned 0 [0217.446] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449\\temporaryfile")) returned 1 [0217.447] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.447] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.448] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.448] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.448] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.448] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.448] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.448] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449\\temporaryfile")) returned 1 [0217.448] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868d6040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.448] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.448] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286449" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286449")) returned 1 [0217.448] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 0 [0217.449] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.449] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4920*, nNumberOfBytesToWrite=0x7e98, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4920*, lpNumberOfBytesWritten=0x18fdb8*=0x7e98, lpOverlapped=0x0) returned 1 [0217.451] CloseHandle (hObject=0xe0) returned 1 [0217.451] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.451] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x868d6040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868d6040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0217.451] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.451] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51f70990, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.452] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51f70990, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.452] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x51f70990, dwReserved1=0x1d301bf, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0217.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.452] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.453] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb8f8 [0217.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb900) returned 0x2aca70 [0217.453] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0xb8f8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0xb8f8, lpOverlapped=0x0) returned 1 [0217.454] CloseHandle (hObject=0xe0) returned 1 [0217.454] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm")) returned 1 [0217.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.455] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.455] GetTickCount () returned 0x45f00 [0217.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.456] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464\\....\\temporaryfile")) returned 0 [0217.460] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464\\temporaryfile")) returned 1 [0217.461] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868fc1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868fc1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868fc1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.461] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868fc1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868fc1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868fc1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.461] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868fc1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868fc1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868fc1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.461] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868fc1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868fc1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868fc1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.461] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868fc1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868fc1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868fc1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.461] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868fc1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868fc1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868fc1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.461] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.461] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464\\temporaryfile")) returned 1 [0217.461] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868fc1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x868fc1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x868fc1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.461] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.461] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464")) returned 1 [0217.462] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 0 [0217.462] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.463] WriteFile (in: hFile=0xe0, lpBuffer=0x2b8380*, nNumberOfBytesToWrite=0xb900, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b8380*, lpNumberOfBytesWritten=0x18fdb8*=0xb900, lpOverlapped=0x0) returned 1 [0217.464] CloseHandle (hObject=0xe0) returned 1 [0217.464] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.465] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x211 [0217.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x219) returned 0x285a10 [0217.465] ReadFile (in: hFile=0xe0, lpBuffer=0x285a18, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x285a18*, lpNumberOfBytesRead=0x18fdd0*=0x211, lpOverlapped=0x0) returned 1 [0217.466] CloseHandle (hObject=0xe0) returned 1 [0217.466] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf")) returned 1 [0217.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.467] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.467] GetTickCount () returned 0x45f00 [0217.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.467] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.468] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464\\....\\temporaryfile")) returned 0 [0217.468] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464\\temporaryfile")) returned 1 [0217.469] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.469] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.469] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.469] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.469] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.469] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.469] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.469] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464\\temporaryfile")) returned 1 [0217.469] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.469] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.469] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286464" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286464")) returned 1 [0217.470] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 0 [0217.470] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.470] WriteFile (in: hFile=0xe0, lpBuffer=0x285c40*, nNumberOfBytesToWrite=0x218, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x285c40*, lpNumberOfBytesWritten=0x18fdb8*=0x218, lpOverlapped=0x0) returned 1 [0217.471] CloseHandle (hObject=0xe0) returned 1 [0217.471] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.472] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x543 [0217.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54b) returned 0x259e70 [0217.472] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x543, lpOverlapped=0x0) returned 1 [0217.473] CloseHandle (hObject=0xe0) returned 1 [0217.473] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0217.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.474] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.474] GetTickCount () returned 0x45f10 [0217.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.475] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286480\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286480\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286480\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286480\\....\\temporaryfile")) returned 0 [0217.475] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286480\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286480\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286480\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286480\\temporaryfile")) returned 1 [0217.476] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286480\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.477] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.477] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.477] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286480\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.477] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.477] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.477] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.477] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286480\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286480\\temporaryfile")) returned 1 [0217.477] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86922300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86922300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86922300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.477] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.477] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286480" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286480")) returned 1 [0217.477] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 0 [0217.478] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.479] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x548, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x548, lpOverlapped=0x0) returned 1 [0217.480] CloseHandle (hObject=0xe0) returned 1 [0217.480] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.481] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6722 [0217.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x672a) returned 0x2aca70 [0217.481] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x6722, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x6722, lpOverlapped=0x0) returned 1 [0217.482] CloseHandle (hObject=0xe0) returned 1 [0217.482] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0217.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.483] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.484] GetTickCount () returned 0x45f1f [0217.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.484] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.484] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495\\....\\temporaryfile")) returned 0 [0217.485] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495\\temporaryfile")) returned 1 [0217.486] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.486] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.486] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.486] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.486] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.486] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.486] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495\\temporaryfile")) returned 1 [0217.486] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.486] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495")) returned 1 [0217.487] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 0 [0217.487] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.488] WriteFile (in: hFile=0xe0, lpBuffer=0x2b31b0*, nNumberOfBytesToWrite=0x6728, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b31b0*, lpNumberOfBytesWritten=0x18fdb8*=0x6728, lpOverlapped=0x0) returned 1 [0217.489] CloseHandle (hObject=0xe0) returned 1 [0217.489] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.489] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0217.489] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.489] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51fe2db0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.490] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x51fe2db0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.490] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x51fe2db0, dwReserved1=0x1d301bf, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0217.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256228 [0217.490] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.491] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x12dee [0217.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12df6) returned 0x2aca70 [0217.491] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x12dee, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x12dee, lpOverlapped=0x0) returned 1 [0217.492] CloseHandle (hObject=0xe0) returned 1 [0217.492] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm")) returned 1 [0217.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.494] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.494] GetTickCount () returned 0x45f1f [0217.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.494] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495\\....\\temporaryfile")) returned 0 [0217.495] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495\\temporaryfile")) returned 1 [0217.496] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.496] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.496] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.496] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.496] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.496] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.496] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.496] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495\\temporaryfile")) returned 1 [0217.497] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86948460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86948460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86948460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.497] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286495" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286495")) returned 1 [0217.497] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 0 [0217.498] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.499] WriteFile (in: hFile=0xe0, lpBuffer=0x2bf878*, nNumberOfBytesToWrite=0x12df8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bf878*, lpNumberOfBytesWritten=0x18fdb8*=0x12df8, lpOverlapped=0x0) returned 1 [0217.501] CloseHandle (hObject=0xe0) returned 1 [0217.501] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.502] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x223 [0217.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22b) returned 0x28f1f8 [0217.502] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x223, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x223, lpOverlapped=0x0) returned 1 [0217.503] CloseHandle (hObject=0xe0) returned 1 [0217.504] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 1 [0217.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.504] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.505] GetTickCount () returned 0x45f2f [0217.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.505] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511\\....\\temporaryfile")) returned 0 [0217.506] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511\\temporaryfile")) returned 1 [0217.507] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8696e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8696e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8696e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.507] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8696e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8696e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8696e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.507] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8696e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8696e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8696e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.507] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8696e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8696e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8696e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.507] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8696e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8696e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8696e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.507] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8696e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8696e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8696e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.507] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511\\temporaryfile")) returned 1 [0217.507] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8696e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8696e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8696e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.507] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511")) returned 1 [0217.508] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 0 [0217.508] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.510] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x228, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x228, lpOverlapped=0x0) returned 1 [0217.510] CloseHandle (hObject=0xe0) returned 1 [0217.511] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.511] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x54a [0217.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x552) returned 0x259e70 [0217.511] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x54a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x54a, lpOverlapped=0x0) returned 1 [0217.512] CloseHandle (hObject=0xe0) returned 1 [0217.512] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0217.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.513] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.513] GetTickCount () returned 0x45f2f [0217.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.514] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.515] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511\\....\\temporaryfile")) returned 0 [0217.515] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511\\temporaryfile")) returned 1 [0217.516] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8696e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.516] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8696e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.516] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.516] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.516] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.516] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.516] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.516] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511\\temporaryfile")) returned 1 [0217.516] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.516] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.516] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286511" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286511")) returned 1 [0217.517] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 0 [0217.517] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.517] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x550, lpOverlapped=0x0) returned 1 [0217.518] CloseHandle (hObject=0xe0) returned 1 [0217.518] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.519] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7eb1 [0217.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7eb9) returned 0x2aca70 [0217.519] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x7eb1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x7eb1, lpOverlapped=0x0) returned 1 [0217.520] CloseHandle (hObject=0xe0) returned 1 [0217.520] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0217.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.521] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.521] GetTickCount () returned 0x45f3f [0217.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.522] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286527\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286527\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286527\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286527\\....\\temporaryfile")) returned 0 [0217.522] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286527\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286527\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286527\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286527\\temporaryfile")) returned 1 [0217.524] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286527\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.524] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.524] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.524] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286527\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.524] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.524] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.524] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.524] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286527\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286527\\temporaryfile")) returned 1 [0217.524] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86994720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.524] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.524] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286527" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286527")) returned 1 [0217.524] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 0 [0217.525] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.526] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4940*, nNumberOfBytesToWrite=0x7eb8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4940*, lpNumberOfBytesWritten=0x18fdb8*=0x7eb8, lpOverlapped=0x0) returned 1 [0217.527] CloseHandle (hObject=0xe0) returned 1 [0217.527] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.527] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86994720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86994720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0217.527] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.527] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.528] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.528] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0217.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0217.528] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.528] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x19539 [0217.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19541) returned 0x2aca70 [0217.528] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x19539, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x19539, lpOverlapped=0x0) returned 1 [0217.530] CloseHandle (hObject=0xe0) returned 1 [0217.530] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 1 [0217.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.532] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.532] GetTickCount () returned 0x45f4e [0217.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.532] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542\\....\\temporaryfile")) returned 0 [0217.533] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542\\temporaryfile")) returned 1 [0217.534] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.534] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.534] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.534] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.534] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.534] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.534] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542\\temporaryfile")) returned 1 [0217.534] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.534] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542")) returned 1 [0217.535] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 0 [0217.536] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.537] WriteFile (in: hFile=0xe0, lpBuffer=0x2c5fc8*, nNumberOfBytesToWrite=0x19540, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c5fc8*, lpNumberOfBytesWritten=0x18fdb8*=0x19540, lpOverlapped=0x0) returned 1 [0217.539] CloseHandle (hObject=0xe0) returned 1 [0217.539] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.540] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x255 [0217.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25d) returned 0x2a8a88 [0217.540] ReadFile (in: hFile=0xe0, lpBuffer=0x2a8a90, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a8a90*, lpNumberOfBytesRead=0x18fdd0*=0x255, lpOverlapped=0x0) returned 1 [0217.541] CloseHandle (hObject=0xe0) returned 1 [0217.541] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf")) returned 1 [0217.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.542] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.542] GetTickCount () returned 0x45f4e [0217.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.543] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542\\....\\temporaryfile")) returned 0 [0217.543] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542\\temporaryfile")) returned 1 [0217.544] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.544] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.545] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.545] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.545] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.545] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.545] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.545] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542\\temporaryfile")) returned 1 [0217.545] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869ba880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869ba880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869ba880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.545] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.545] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286542" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286542")) returned 1 [0217.545] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 0 [0217.546] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.547] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x260, lpOverlapped=0x0) returned 1 [0217.549] CloseHandle (hObject=0xe0) returned 1 [0217.549] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.549] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1400 [0217.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1408) returned 0x25b528 [0217.549] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x1400, lpOverlapped=0x0) returned 1 [0217.550] CloseHandle (hObject=0xe0) returned 1 [0217.551] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0217.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.551] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.551] GetTickCount () returned 0x45f5e [0217.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.552] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286558\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286558\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286558\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286558\\....\\temporaryfile")) returned 0 [0217.552] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286558\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286558\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286558\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286558\\temporaryfile")) returned 1 [0217.554] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286558\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869e09e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869e09e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869e09e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.554] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869e09e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869e09e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869e09e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.554] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869e09e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869e09e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869e09e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.554] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286558\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869e09e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869e09e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869e09e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.554] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869e09e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869e09e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869e09e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.554] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869e09e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869e09e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869e09e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.554] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.554] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286558\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286558\\temporaryfile")) returned 1 [0217.554] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869e09e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x869e09e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x869e09e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.554] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.554] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286558" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286558")) returned 1 [0217.554] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 0 [0217.555] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.555] WriteFile (in: hFile=0xe0, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1408, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdb8*=0x1408, lpOverlapped=0x0) returned 1 [0217.556] CloseHandle (hObject=0xe0) returned 1 [0217.557] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.557] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xed34 [0217.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xed3c) returned 0x2aca70 [0217.558] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0xed34, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0xed34, lpOverlapped=0x0) returned 1 [0217.559] CloseHandle (hObject=0xe0) returned 1 [0217.559] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0217.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0217.561] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.561] GetTickCount () returned 0x45f6d [0217.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0217.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.561] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573\\...."), lpSecurityAttributes=0x256210) returned 1 [0217.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573\\....\\temporaryfile")) returned 0 [0217.562] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573\\temporaryfile")) returned 1 [0217.563] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.563] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.563] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.563] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.563] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.563] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.563] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.563] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573\\temporaryfile")) returned 1 [0217.563] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.563] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.563] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573")) returned 1 [0217.564] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 0 [0217.565] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.565] WriteFile (in: hFile=0xe0, lpBuffer=0x2bb7c0*, nNumberOfBytesToWrite=0xed38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bb7c0*, lpNumberOfBytesWritten=0x18fdb8*=0xed38, lpOverlapped=0x0) returned 1 [0217.567] CloseHandle (hObject=0xe0) returned 1 [0217.567] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.567] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0217.567] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.567] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.568] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.568] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0217.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9a0 [0217.569] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.569] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x109d0 [0217.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x109d8) returned 0x2aca70 [0217.570] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x109d0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x109d0, lpOverlapped=0x0) returned 1 [0217.573] CloseHandle (hObject=0xe0) returned 1 [0217.573] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 1 [0217.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.574] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.574] GetTickCount () returned 0x45f6d [0217.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.575] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573\\....\\temporaryfile")) returned 0 [0217.575] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573\\temporaryfile")) returned 1 [0217.577] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.577] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0217.577] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.577] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.577] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.577] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.577] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.577] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573\\temporaryfile")) returned 1 [0217.578] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a06b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a06b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a06b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.578] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286573" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286573")) returned 1 [0217.578] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 0 [0217.579] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.580] WriteFile (in: hFile=0xe0, lpBuffer=0x2bd458*, nNumberOfBytesToWrite=0x109d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd458*, lpNumberOfBytesWritten=0x18fdb8*=0x109d8, lpOverlapped=0x0) returned 1 [0217.581] CloseHandle (hObject=0xe0) returned 1 [0217.581] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.582] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1ad [0217.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b5) returned 0x28f1f8 [0217.582] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1ad, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1ad, lpOverlapped=0x0) returned 1 [0217.583] CloseHandle (hObject=0xe0) returned 1 [0217.583] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 1 [0217.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.584] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.584] GetTickCount () returned 0x45f7d [0217.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0217.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.584] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589\\....\\temporaryfile")) returned 0 [0217.585] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589\\temporaryfile")) returned 1 [0217.586] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a2cca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a2cca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a2cca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.586] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a2cca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a2cca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a2cca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.586] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a2cca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a2cca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a2cca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.586] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a2cca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a2cca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a2cca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.586] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a2cca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a2cca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a2cca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.586] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a2cca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a2cca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a2cca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.586] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.586] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589\\temporaryfile")) returned 1 [0217.587] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a2cca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a2cca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a2cca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.587] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.587] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589")) returned 1 [0217.587] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 0 [0217.587] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.588] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1b8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1b8, lpOverlapped=0x0) returned 1 [0217.588] CloseHandle (hObject=0xe0) returned 1 [0217.589] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.589] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x9f8 [0217.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa00) returned 0x25f580 [0217.589] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x9f8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x9f8, lpOverlapped=0x0) returned 1 [0217.590] CloseHandle (hObject=0xe0) returned 1 [0217.590] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0217.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.591] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.591] GetTickCount () returned 0x45f7d [0217.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.596] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589\\....\\temporaryfile")) returned 0 [0217.597] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589\\temporaryfile")) returned 1 [0217.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a52e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a52e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a52e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.601] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a52e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a52e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a52e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.601] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a52e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a52e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a52e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a52e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a52e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a52e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.601] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a52e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a52e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a52e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.601] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a52e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a52e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a52e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.601] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589\\temporaryfile")) returned 1 [0217.602] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a52e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a52e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a52e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.602] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.602] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286589" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286589")) returned 1 [0217.602] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 0 [0217.602] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.604] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xa00, lpOverlapped=0x0) returned 1 [0217.605] CloseHandle (hObject=0xe0) returned 1 [0217.605] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.605] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4981 [0217.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4989) returned 0x2aca70 [0217.605] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x4981, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x4981, lpOverlapped=0x0) returned 1 [0217.607] CloseHandle (hObject=0xe0) returned 1 [0217.607] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0217.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.608] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.608] GetTickCount () returned 0x45f9c [0217.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.608] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620\\....\\temporaryfile")) returned 0 [0217.609] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620\\temporaryfile")) returned 1 [0217.610] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.610] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.610] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.610] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.610] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.610] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.610] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.610] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620\\temporaryfile")) returned 1 [0217.611] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.611] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.611] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620")) returned 1 [0217.611] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 0 [0217.611] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.612] WriteFile (in: hFile=0xe0, lpBuffer=0x2b1410*, nNumberOfBytesToWrite=0x4988, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b1410*, lpNumberOfBytesWritten=0x18fdb8*=0x4988, lpOverlapped=0x0) returned 1 [0217.613] CloseHandle (hObject=0xe0) returned 1 [0217.613] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.613] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0217.613] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.613] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x539538d0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.615] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x539538d0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.615] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x539538d0, dwReserved1=0x1d301bf, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0217.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256228 [0217.615] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.616] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x184e9 [0217.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x184f1) returned 0x2aca70 [0217.616] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x184e9, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x184e9, lpOverlapped=0x0) returned 1 [0217.617] CloseHandle (hObject=0xe0) returned 1 [0217.617] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm")) returned 1 [0217.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.619] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.619] GetTickCount () returned 0x45f9c [0217.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.620] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620\\....\\temporaryfile")) returned 0 [0217.620] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620\\temporaryfile")) returned 1 [0217.621] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.622] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.622] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.622] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.622] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.622] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.622] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620\\temporaryfile")) returned 1 [0217.622] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a78f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a78f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a78f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.622] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286620" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286620")) returned 1 [0217.622] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 0 [0217.624] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.625] WriteFile (in: hFile=0xe0, lpBuffer=0x2c4f78*, nNumberOfBytesToWrite=0x184f0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c4f78*, lpNumberOfBytesWritten=0x18fdb8*=0x184f0, lpOverlapped=0x0) returned 1 [0217.627] CloseHandle (hObject=0xe0) returned 1 [0217.627] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.628] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x225 [0217.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22d) returned 0x28f1f8 [0217.628] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x225, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x225, lpOverlapped=0x0) returned 1 [0217.629] CloseHandle (hObject=0xe0) returned 1 [0217.629] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf")) returned 1 [0217.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.630] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.630] GetTickCount () returned 0x45fac [0217.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.630] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636\\....\\temporaryfile")) returned 0 [0217.631] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636\\temporaryfile")) returned 1 [0217.632] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.632] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.632] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.632] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.632] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.632] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.632] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.632] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636\\temporaryfile")) returned 1 [0217.632] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.633] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.633] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636")) returned 1 [0217.633] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 0 [0217.633] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.633] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x230, lpOverlapped=0x0) returned 1 [0217.634] CloseHandle (hObject=0xe0) returned 1 [0217.634] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.635] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x143b [0217.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1443) returned 0x25b528 [0217.635] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x143b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x143b, lpOverlapped=0x0) returned 1 [0217.636] CloseHandle (hObject=0xe0) returned 1 [0217.636] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0217.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.637] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.637] GetTickCount () returned 0x45fac [0217.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.638] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636\\....\\temporaryfile")) returned 0 [0217.639] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636\\temporaryfile")) returned 1 [0217.640] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ac5220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ac5220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.640] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ac5220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ac5220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.640] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.640] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.640] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.640] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.640] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.640] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636\\temporaryfile")) returned 1 [0217.640] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a9f0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86a9f0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86a9f0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.640] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.640] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286636" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286636")) returned 1 [0217.640] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 0 [0217.641] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.643] WriteFile (in: hFile=0xe0, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdb8*=0x1440, lpOverlapped=0x0) returned 1 [0217.643] CloseHandle (hObject=0xe0) returned 1 [0217.644] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.644] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8317 [0217.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x831f) returned 0x2aca70 [0217.644] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x8317, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x8317, lpOverlapped=0x0) returned 1 [0217.646] CloseHandle (hObject=0xe0) returned 1 [0217.646] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0217.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.647] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.647] GetTickCount () returned 0x45fbb [0217.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.647] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286651\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286651\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286651\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286651\\....\\temporaryfile")) returned 0 [0217.648] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286651\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286651\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286651\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286651\\temporaryfile")) returned 1 [0217.649] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286651\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ac5220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ac5220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ac5220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.649] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ac5220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ac5220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ac5220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.649] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ac5220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ac5220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ac5220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.649] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286651\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ac5220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ac5220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ac5220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.649] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ac5220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ac5220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ac5220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.649] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ac5220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ac5220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ac5220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.649] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.649] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286651\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286651\\temporaryfile")) returned 1 [0217.650] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ac5220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ac5220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ac5220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.650] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.650] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286651" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286651")) returned 1 [0217.650] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 0 [0217.651] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.651] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4da0*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4da0*, lpNumberOfBytesWritten=0x18fdb8*=0x8320, lpOverlapped=0x0) returned 1 [0217.652] CloseHandle (hObject=0xe0) returned 1 [0217.653] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.653] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86ac5220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ac5220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0217.653] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.653] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.653] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.653] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0217.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0217.653] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.655] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1015d [0217.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10165) returned 0x2aca70 [0217.655] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x1015d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x1015d, lpOverlapped=0x0) returned 1 [0217.656] CloseHandle (hObject=0xe0) returned 1 [0217.657] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 1 [0217.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.658] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.658] GetTickCount () returned 0x45fcb [0217.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.658] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667\\....\\temporaryfile")) returned 0 [0217.659] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667\\temporaryfile")) returned 1 [0217.660] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.660] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.660] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.660] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.660] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.660] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.660] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.660] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667\\temporaryfile")) returned 1 [0217.661] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.661] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.661] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667")) returned 1 [0217.661] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 0 [0217.662] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.662] WriteFile (in: hFile=0xe0, lpBuffer=0x2bcbe8*, nNumberOfBytesToWrite=0x10168, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bcbe8*, lpNumberOfBytesWritten=0x18fdb8*=0x10168, lpOverlapped=0x0) returned 1 [0217.665] CloseHandle (hObject=0xe0) returned 1 [0217.665] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.665] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1ce [0217.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d6) returned 0x28f1f8 [0217.665] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1ce, lpOverlapped=0x0) returned 1 [0217.666] CloseHandle (hObject=0xe0) returned 1 [0217.666] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf")) returned 1 [0217.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.667] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.667] GetTickCount () returned 0x45fcb [0217.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.668] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667\\....\\temporaryfile")) returned 0 [0217.668] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667\\temporaryfile")) returned 1 [0217.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.669] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.669] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.670] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.670] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.670] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667\\temporaryfile")) returned 1 [0217.670] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aeb380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86aeb380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86aeb380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.670] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286667" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286667")) returned 1 [0217.670] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 0 [0217.671] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.671] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1d8, lpOverlapped=0x0) returned 1 [0217.672] CloseHandle (hObject=0xe0) returned 1 [0217.672] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.673] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x9ac [0217.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9b4) returned 0x25f580 [0217.673] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x9ac, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x9ac, lpOverlapped=0x0) returned 1 [0217.675] CloseHandle (hObject=0xe0) returned 1 [0217.675] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0217.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.676] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.676] GetTickCount () returned 0x45fdb [0217.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.676] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683\\....\\temporaryfile")) returned 0 [0217.677] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683\\temporaryfile")) returned 1 [0217.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b114e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b114e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b114e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.678] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b114e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b114e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b114e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.678] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b114e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b114e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b114e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b114e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b114e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b114e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.678] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b114e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b114e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b114e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.678] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b114e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b114e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b114e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.679] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683\\temporaryfile")) returned 1 [0217.679] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b114e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b114e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b114e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.679] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683")) returned 1 [0217.679] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 0 [0217.679] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.681] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x9b0, lpOverlapped=0x0) returned 1 [0217.682] CloseHandle (hObject=0xe0) returned 1 [0217.682] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.683] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4c1d [0217.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c25) returned 0x2aca70 [0217.683] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0x4c1d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0x4c1d, lpOverlapped=0x0) returned 1 [0217.684] CloseHandle (hObject=0xe0) returned 1 [0217.684] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0217.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.685] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.685] GetTickCount () returned 0x45fdb [0217.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.686] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683\\....\\temporaryfile")) returned 0 [0217.686] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683\\temporaryfile")) returned 1 [0217.687] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.687] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.687] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.687] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.688] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.688] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.688] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.688] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683\\temporaryfile")) returned 1 [0217.689] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.689] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.689] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286683" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286683")) returned 1 [0217.690] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 0 [0217.690] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.691] WriteFile (in: hFile=0xe0, lpBuffer=0x2b16a8*, nNumberOfBytesToWrite=0x4c28, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b16a8*, lpNumberOfBytesWritten=0x18fdb8*=0x4c28, lpOverlapped=0x0) returned 1 [0217.692] CloseHandle (hObject=0xe0) returned 1 [0217.692] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.692] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0217.692] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.692] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x567be5d0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.693] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x567be5d0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.693] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x567be5d0, dwReserved1=0x1d301bf, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0217.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0217.693] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.694] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xba32 [0217.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xba3a) returned 0x2aca70 [0217.695] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca78, nNumberOfBytesToRead=0xba32, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca78*, lpNumberOfBytesRead=0x18fdd0*=0xba32, lpOverlapped=0x0) returned 1 [0217.696] CloseHandle (hObject=0xe0) returned 1 [0217.696] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 1 [0217.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.697] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.697] GetTickCount () returned 0x45fea [0217.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.698] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286698\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286698\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286698\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286698\\....\\temporaryfile")) returned 0 [0217.698] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286698\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286698\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286698\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286698\\temporaryfile")) returned 1 [0217.700] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286698\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.700] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.700] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.700] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286698\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.700] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.700] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.700] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.700] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286698\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286698\\temporaryfile")) returned 1 [0217.700] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b37640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b37640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b37640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.700] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.700] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286698" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286698")) returned 1 [0217.700] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 0 [0217.701] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.702] WriteFile (in: hFile=0xe0, lpBuffer=0x2b84c0*, nNumberOfBytesToWrite=0xba38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b84c0*, lpNumberOfBytesWritten=0x18fdb8*=0xba38, lpOverlapped=0x0) returned 1 [0217.703] CloseHandle (hObject=0xe0) returned 1 [0217.703] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.704] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1f3 [0217.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1fb) returned 0x28f1f8 [0217.704] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1f3, lpOverlapped=0x0) returned 1 [0217.705] CloseHandle (hObject=0xe0) returned 1 [0217.705] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf")) returned 1 [0217.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.706] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.706] GetTickCount () returned 0x45ffa [0217.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.706] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286714\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286714\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.707] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286714\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286714\\....\\temporaryfile")) returned 0 [0217.707] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286714\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286714\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286714\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286714\\temporaryfile")) returned 1 [0217.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286714\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b5d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b5d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b5d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.708] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b5d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b5d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b5d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.708] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b5d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b5d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b5d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286714\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b5d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b5d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b5d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.708] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b5d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b5d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b5d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.708] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b5d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b5d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b5d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.708] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.708] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286714\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286714\\temporaryfile")) returned 1 [0217.708] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b5d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b5d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b5d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.708] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.709] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286714" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286714")) returned 1 [0217.709] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 0 [0217.709] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.711] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1f8, lpOverlapped=0x0) returned 1 [0217.711] CloseHandle (hObject=0xe0) returned 1 [0217.712] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.712] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4d0 [0217.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4d8) returned 0x2aca88 [0217.712] ReadFile (in: hFile=0xe0, lpBuffer=0x2aca90, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2aca90*, lpNumberOfBytesRead=0x18fdd0*=0x4d0, lpOverlapped=0x0) returned 1 [0217.721] CloseHandle (hObject=0xe0) returned 1 [0217.721] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0217.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.722] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.722] GetTickCount () returned 0x46009 [0217.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.722] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729\\....\\temporaryfile")) returned 0 [0217.723] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729\\temporaryfile")) returned 1 [0217.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.724] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.724] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.724] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.724] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.724] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.724] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729\\temporaryfile")) returned 1 [0217.724] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.724] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729")) returned 1 [0217.725] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 0 [0217.725] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.725] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x4d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x4d8, lpOverlapped=0x0) returned 1 [0217.726] CloseHandle (hObject=0xe0) returned 1 [0217.726] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.727] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x47ed [0217.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x47f5) returned 0x2b4a70 [0217.727] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x47ed, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x47ed, lpOverlapped=0x0) returned 1 [0217.728] CloseHandle (hObject=0xe0) returned 1 [0217.728] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0217.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.729] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.729] GetTickCount () returned 0x46009 [0217.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.730] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729\\....\\temporaryfile")) returned 0 [0217.731] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729\\temporaryfile")) returned 1 [0217.732] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.732] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.732] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.732] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.732] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.732] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.732] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.733] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729\\temporaryfile")) returned 1 [0217.733] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86b83900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86b83900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86b83900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.733] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.733] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286729" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286729")) returned 1 [0217.733] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 0 [0217.733] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.734] WriteFile (in: hFile=0xe0, lpBuffer=0x2b9278*, nNumberOfBytesToWrite=0x47f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b9278*, lpNumberOfBytesWritten=0x18fdb8*=0x47f8, lpOverlapped=0x0) returned 1 [0217.735] CloseHandle (hObject=0xe0) returned 1 [0217.735] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.735] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86ba9a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ba9a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0217.735] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.736] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x567e4730, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x567e4730, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x567e4730, dwReserved1=0x1d301bf, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0217.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256198 [0217.737] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.737] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe743 [0217.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe74b) returned 0x2b4a70 [0217.737] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xe743, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xe743, lpOverlapped=0x0) returned 1 [0217.739] CloseHandle (hObject=0xe0) returned 1 [0217.739] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 1 [0217.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.740] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.740] GetTickCount () returned 0x46019 [0217.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.740] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286745\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286745\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286745\\....\\temporaryfile")) returned 0 [0217.741] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286745\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286745\\temporaryfile")) returned 1 [0217.742] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286745\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ba9a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ba9a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ba9a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.742] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ba9a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ba9a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ba9a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.742] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ba9a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ba9a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ba9a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.742] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286745\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ba9a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ba9a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ba9a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.742] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ba9a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ba9a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ba9a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.742] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ba9a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ba9a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ba9a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.742] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.742] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286745\\temporaryfile")) returned 1 [0217.743] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ba9a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ba9a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ba9a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.743] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.743] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286745" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286745")) returned 1 [0217.746] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 0 [0217.747] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.748] WriteFile (in: hFile=0xe0, lpBuffer=0x2c31d0*, nNumberOfBytesToWrite=0xe748, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c31d0*, lpNumberOfBytesWritten=0x18fdb8*=0xe748, lpOverlapped=0x0) returned 1 [0217.750] CloseHandle (hObject=0xe0) returned 1 [0217.750] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.751] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x215 [0217.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x21d) returned 0x285c38 [0217.751] ReadFile (in: hFile=0xe0, lpBuffer=0x285c40, nNumberOfBytesToRead=0x215, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x285c40*, lpNumberOfBytesRead=0x18fdd0*=0x215, lpOverlapped=0x0) returned 1 [0217.752] CloseHandle (hObject=0xe0) returned 1 [0217.752] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf")) returned 1 [0217.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.753] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.753] GetTickCount () returned 0x46029 [0217.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.753] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761\\....\\temporaryfile")) returned 0 [0217.754] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761\\temporaryfile")) returned 1 [0217.755] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.755] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.755] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.755] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.755] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.755] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.755] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761\\temporaryfile")) returned 1 [0217.755] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.755] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761")) returned 1 [0217.756] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 0 [0217.756] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.756] WriteFile (in: hFile=0xe0, lpBuffer=0x2a4a90*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a4a90*, lpNumberOfBytesWritten=0x18fdb8*=0x220, lpOverlapped=0x0) returned 1 [0217.757] CloseHandle (hObject=0xe0) returned 1 [0217.757] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.758] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x67b [0217.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x683) returned 0x259e70 [0217.758] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x67b, lpOverlapped=0x0) returned 1 [0217.759] CloseHandle (hObject=0xe0) returned 1 [0217.759] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0217.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.760] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.760] GetTickCount () returned 0x46029 [0217.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.760] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761\\....\\temporaryfile")) returned 0 [0217.761] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761\\temporaryfile")) returned 1 [0217.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.762] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.762] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.762] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.762] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.762] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761\\temporaryfile")) returned 1 [0217.763] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bcfbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bcfbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bcfbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.763] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286761" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286761")) returned 1 [0217.763] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 0 [0217.764] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.765] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x680, lpOverlapped=0x0) returned 1 [0217.766] CloseHandle (hObject=0xe0) returned 1 [0217.767] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.768] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xaf32 [0217.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaf3a) returned 0x2b4a70 [0217.768] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xaf32, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xaf32, lpOverlapped=0x0) returned 1 [0217.769] CloseHandle (hObject=0xe0) returned 1 [0217.769] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0217.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.770] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.770] GetTickCount () returned 0x46038 [0217.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.771] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286776\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286776\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.771] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286776\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286776\\....\\temporaryfile")) returned 0 [0217.771] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286776\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286776\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286776\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286776\\temporaryfile")) returned 1 [0217.772] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286776\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bf5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bf5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bf5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.772] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bf5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bf5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bf5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.773] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bf5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bf5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bf5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.773] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286776\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bf5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bf5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bf5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.773] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bf5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bf5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bf5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.773] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bf5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bf5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bf5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.773] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.773] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286776\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286776\\temporaryfile")) returned 1 [0217.773] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86bf5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86bf5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bf5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.773] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.773] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286776" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286776")) returned 1 [0217.773] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 0 [0217.774] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.775] WriteFile (in: hFile=0xe0, lpBuffer=0x2bf9c0*, nNumberOfBytesToWrite=0xaf38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bf9c0*, lpNumberOfBytesWritten=0x18fdb8*=0xaf38, lpOverlapped=0x0) returned 1 [0217.776] CloseHandle (hObject=0xe0) returned 1 [0217.776] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.776] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86bf5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86bf5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0217.776] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.776] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0217.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256228 [0217.777] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.778] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe2ec [0217.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe2f4) returned 0x2b4a70 [0217.778] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xe2ec, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xe2ec, lpOverlapped=0x0) returned 1 [0217.779] CloseHandle (hObject=0xe0) returned 1 [0217.779] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm")) returned 1 [0217.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.781] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.781] GetTickCount () returned 0x46048 [0217.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.781] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792\\....\\temporaryfile")) returned 0 [0217.782] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792\\temporaryfile")) returned 1 [0217.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.783] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.783] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.783] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.783] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.783] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.783] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792\\temporaryfile")) returned 1 [0217.783] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.783] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.783] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792")) returned 1 [0217.784] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 0 [0217.785] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.785] WriteFile (in: hFile=0xe0, lpBuffer=0x2c2d78*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c2d78*, lpNumberOfBytesWritten=0x18fdb8*=0xe2f0, lpOverlapped=0x0) returned 1 [0217.787] CloseHandle (hObject=0xe0) returned 1 [0217.787] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.787] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x20e [0217.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x216) returned 0x28f1f8 [0217.787] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x20e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x20e, lpOverlapped=0x0) returned 1 [0217.788] CloseHandle (hObject=0xe0) returned 1 [0217.788] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf")) returned 1 [0217.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.789] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.789] GetTickCount () returned 0x46048 [0217.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.790] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.790] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792\\....\\temporaryfile")) returned 0 [0217.790] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792\\temporaryfile")) returned 1 [0217.791] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.791] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.791] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.791] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.792] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.792] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.792] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792\\temporaryfile")) returned 1 [0217.792] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c1be80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c1be80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c1be80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.792] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286792" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286792")) returned 1 [0217.792] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 0 [0217.792] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.793] WriteFile (in: hFile=0xe0, lpBuffer=0x285c40*, nNumberOfBytesToWrite=0x218, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x285c40*, lpNumberOfBytesWritten=0x18fdb8*=0x218, lpOverlapped=0x0) returned 1 [0217.794] CloseHandle (hObject=0xe0) returned 1 [0217.794] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.795] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x563 [0217.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x56b) returned 0x259e70 [0217.795] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x563, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x563, lpOverlapped=0x0) returned 1 [0217.797] CloseHandle (hObject=0xe0) returned 1 [0217.797] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0217.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.798] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.798] GetTickCount () returned 0x46057 [0217.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.799] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807\\....\\temporaryfile")) returned 0 [0217.799] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807\\temporaryfile")) returned 1 [0217.800] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.800] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.800] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.800] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.800] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.801] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.801] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.801] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807\\temporaryfile")) returned 1 [0217.801] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.801] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.801] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807")) returned 1 [0217.801] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 0 [0217.801] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.803] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x568, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x568, lpOverlapped=0x0) returned 1 [0217.804] CloseHandle (hObject=0xe0) returned 1 [0217.804] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.805] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbbf3 [0217.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbbfb) returned 0x2b4a70 [0217.805] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xbbf3, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xbbf3, lpOverlapped=0x0) returned 1 [0217.806] CloseHandle (hObject=0xe0) returned 1 [0217.806] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0217.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.807] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.807] GetTickCount () returned 0x46057 [0217.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.808] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.808] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807\\....\\temporaryfile")) returned 0 [0217.808] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807\\temporaryfile")) returned 1 [0217.809] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.810] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.810] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.810] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.810] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.810] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.810] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.810] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807\\temporaryfile")) returned 1 [0217.810] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c41fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c41fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c41fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.810] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.810] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286807" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286807")) returned 1 [0217.810] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 0 [0217.811] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.812] WriteFile (in: hFile=0xe0, lpBuffer=0x2c0680*, nNumberOfBytesToWrite=0xbbf8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c0680*, lpNumberOfBytesWritten=0x18fdb8*=0xbbf8, lpOverlapped=0x0) returned 1 [0217.813] CloseHandle (hObject=0xe0) returned 1 [0217.813] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.813] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86c68140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c68140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0217.814] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.814] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x59544a90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.814] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x59544a90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.814] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x59544a90, dwReserved1=0x1d301bf, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0217.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256198 [0217.814] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.815] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc649 [0217.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc651) returned 0x2b4a70 [0217.815] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xc649, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xc649, lpOverlapped=0x0) returned 1 [0217.816] CloseHandle (hObject=0xe0) returned 1 [0217.816] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm")) returned 1 [0217.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.818] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.818] GetTickCount () returned 0x46067 [0217.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.818] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286823\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286823\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.818] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286823\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286823\\....\\temporaryfile")) returned 0 [0217.819] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286823\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286823\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286823\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286823\\temporaryfile")) returned 1 [0217.820] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286823\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c68140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c68140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c68140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.820] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c68140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c68140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c68140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.820] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c68140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c68140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c68140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.820] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286823\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c68140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c68140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c68140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.820] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c68140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c68140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c68140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.820] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c68140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c68140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c68140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.820] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.820] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286823\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286823\\temporaryfile")) returned 1 [0217.820] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c68140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c68140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c68140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.820] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.820] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286823" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286823")) returned 1 [0217.821] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 0 [0217.821] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.822] WriteFile (in: hFile=0xe0, lpBuffer=0x2c10d8*, nNumberOfBytesToWrite=0xc650, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c10d8*, lpNumberOfBytesWritten=0x18fdb8*=0xc650, lpOverlapped=0x0) returned 1 [0217.823] CloseHandle (hObject=0xe0) returned 1 [0217.823] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.824] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x249 [0217.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x251) returned 0x28f1f8 [0217.825] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x249, lpOverlapped=0x0) returned 1 [0217.825] CloseHandle (hObject=0xe0) returned 1 [0217.825] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf")) returned 1 [0217.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.826] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.826] GetTickCount () returned 0x46077 [0217.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.827] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839\\....\\temporaryfile")) returned 0 [0217.827] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839\\temporaryfile")) returned 1 [0217.828] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.829] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.829] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.829] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.829] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.829] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.829] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.829] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839\\temporaryfile")) returned 1 [0217.829] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.829] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.829] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839")) returned 1 [0217.829] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 0 [0217.830] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.831] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x250, lpOverlapped=0x0) returned 1 [0217.832] CloseHandle (hObject=0xe0) returned 1 [0217.832] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.833] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x554 [0217.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x55c) returned 0x259e70 [0217.833] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x554, lpOverlapped=0x0) returned 1 [0217.834] CloseHandle (hObject=0xe0) returned 1 [0217.834] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0217.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.835] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.835] GetTickCount () returned 0x46077 [0217.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.836] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839\\....\\temporaryfile")) returned 0 [0217.836] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839\\temporaryfile")) returned 1 [0217.837] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.838] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.838] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.838] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.838] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.838] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.838] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.838] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839\\temporaryfile")) returned 1 [0217.838] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86c8e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86c8e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86c8e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.838] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.838] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286839" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286839")) returned 1 [0217.838] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 0 [0217.839] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.839] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x558, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x558, lpOverlapped=0x0) returned 1 [0217.840] CloseHandle (hObject=0xe0) returned 1 [0217.840] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.840] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2d35 [0217.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d3d) returned 0x299460 [0217.840] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x2d35, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x2d35, lpOverlapped=0x0) returned 1 [0217.842] CloseHandle (hObject=0xe0) returned 1 [0217.842] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0217.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.843] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.843] GetTickCount () returned 0x46086 [0217.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.843] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854\\....\\temporaryfile")) returned 0 [0217.844] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854\\temporaryfile")) returned 1 [0217.845] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.845] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.845] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.845] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.845] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.845] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.845] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.845] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854\\temporaryfile")) returned 1 [0217.846] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.846] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.846] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854")) returned 1 [0217.846] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 0 [0217.846] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.847] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdb8*=0x2d40, lpOverlapped=0x0) returned 1 [0217.848] CloseHandle (hObject=0xe0) returned 1 [0217.848] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.848] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0217.848] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.848] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x59c68c90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.849] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x59c68c90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.849] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x59c68c90, dwReserved1=0x1d301bf, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0217.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0217.849] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.850] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x166d5 [0217.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x166dd) returned 0x2b4a70 [0217.850] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x166d5, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x166d5, lpOverlapped=0x0) returned 1 [0217.852] CloseHandle (hObject=0xe0) returned 1 [0217.852] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm")) returned 1 [0217.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.853] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.853] GetTickCount () returned 0x46086 [0217.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.854] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854\\....\\temporaryfile")) returned 0 [0217.854] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854\\temporaryfile")) returned 1 [0217.855] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.855] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.856] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.856] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.856] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.856] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.856] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.856] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854\\temporaryfile")) returned 1 [0217.856] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cb4400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cb4400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cb4400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.856] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.856] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286854" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286854")) returned 1 [0217.856] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 0 [0217.858] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.858] WriteFile (in: hFile=0xe0, lpBuffer=0x2cb160*, nNumberOfBytesToWrite=0x166e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2cb160*, lpNumberOfBytesWritten=0x18fdb8*=0x166e0, lpOverlapped=0x0) returned 1 [0217.860] CloseHandle (hObject=0xe0) returned 1 [0217.860] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.861] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1f4 [0217.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1fc) returned 0x28f1f8 [0217.862] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1f4, lpOverlapped=0x0) returned 1 [0217.863] CloseHandle (hObject=0xe0) returned 1 [0217.863] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf")) returned 1 [0217.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.863] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.864] GetTickCount () returned 0x46096 [0217.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.864] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286870\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286870\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286870\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286870\\....\\temporaryfile")) returned 0 [0217.865] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286870\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286870\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286870\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286870\\temporaryfile")) returned 1 [0217.866] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286870\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cda560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cda560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cda560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.866] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cda560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cda560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cda560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.866] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cda560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cda560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cda560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.866] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286870\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cda560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cda560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cda560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.866] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cda560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cda560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cda560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.866] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cda560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cda560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cda560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.866] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286870\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286870\\temporaryfile")) returned 1 [0217.866] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86cda560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86cda560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86cda560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.866] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286870" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286870")) returned 1 [0217.866] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 0 [0217.867] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.869] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1f8, lpOverlapped=0x0) returned 1 [0217.869] CloseHandle (hObject=0xe0) returned 1 [0217.870] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.870] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa0e [0217.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa16) returned 0x25f580 [0217.870] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xa0e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xa0e, lpOverlapped=0x0) returned 1 [0217.871] CloseHandle (hObject=0xe0) returned 1 [0217.871] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0217.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.872] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.873] GetTickCount () returned 0x460a5 [0217.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.873] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885\\....\\temporaryfile")) returned 0 [0217.874] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885\\temporaryfile")) returned 1 [0217.875] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.875] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.875] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.875] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.875] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.875] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.875] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.875] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885\\temporaryfile")) returned 1 [0217.875] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.875] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.875] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885")) returned 1 [0217.875] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 0 [0217.876] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.879] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xa18, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xa18, lpOverlapped=0x0) returned 1 [0217.880] CloseHandle (hObject=0xe0) returned 1 [0217.880] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.881] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x9240 [0217.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9248) returned 0x2b4a70 [0217.881] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x9240, lpOverlapped=0x0) returned 1 [0217.882] CloseHandle (hObject=0xe0) returned 1 [0217.882] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0217.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.883] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.883] GetTickCount () returned 0x460a5 [0217.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.884] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885\\....\\temporaryfile")) returned 0 [0217.885] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885\\temporaryfile")) returned 1 [0217.886] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.886] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.886] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.886] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.886] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.886] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.886] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.886] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885\\temporaryfile")) returned 1 [0217.886] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d006c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.886] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.886] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286885" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286885")) returned 1 [0217.886] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 0 [0217.887] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.888] WriteFile (in: hFile=0xe0, lpBuffer=0x2bdcc8*, nNumberOfBytesToWrite=0x9248, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bdcc8*, lpNumberOfBytesWritten=0x18fdb8*=0x9248, lpOverlapped=0x0) returned 1 [0217.889] CloseHandle (hObject=0xe0) returned 1 [0217.889] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.889] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86d006c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d006c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0217.889] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.890] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a44b570, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.890] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a44b570, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.890] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x5a44b570, dwReserved1=0x1d301bf, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0217.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x256198 [0217.890] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.890] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd0e5 [0217.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd0ed) returned 0x2b4a70 [0217.890] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xd0e5, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xd0e5, lpOverlapped=0x0) returned 1 [0217.892] CloseHandle (hObject=0xe0) returned 1 [0217.892] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm")) returned 1 [0217.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.893] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.893] GetTickCount () returned 0x460b5 [0217.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.894] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901\\....\\temporaryfile")) returned 0 [0217.894] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901\\temporaryfile")) returned 1 [0217.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.895] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.895] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.895] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.895] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.895] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.896] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901\\temporaryfile")) returned 1 [0217.896] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.896] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.896] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901")) returned 1 [0217.896] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 0 [0217.897] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.897] WriteFile (in: hFile=0xe0, lpBuffer=0x2c1b70*, nNumberOfBytesToWrite=0xd0f0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c1b70*, lpNumberOfBytesWritten=0x18fdb8*=0xd0f0, lpOverlapped=0x0) returned 1 [0217.899] CloseHandle (hObject=0xe0) returned 1 [0217.899] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.900] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x21b [0217.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x223) returned 0x2a4a88 [0217.900] ReadFile (in: hFile=0xe0, lpBuffer=0x2a4a90, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a4a90*, lpNumberOfBytesRead=0x18fdd0*=0x21b, lpOverlapped=0x0) returned 1 [0217.900] CloseHandle (hObject=0xe0) returned 1 [0217.901] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf")) returned 1 [0217.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.901] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.901] GetTickCount () returned 0x460b5 [0217.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.902] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901\\....\\temporaryfile")) returned 0 [0217.903] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901\\temporaryfile")) returned 1 [0217.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d4c980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d4c980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.905] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d4c980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d4c980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.905] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.905] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.906] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.906] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901\\temporaryfile")) returned 1 [0217.906] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d26820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d26820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d26820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.906] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286901" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286901")) returned 1 [0217.906] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 0 [0217.906] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.907] WriteFile (in: hFile=0xe0, lpBuffer=0x2a4cd8*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a4cd8*, lpNumberOfBytesWritten=0x18fdb8*=0x220, lpOverlapped=0x0) returned 1 [0217.908] CloseHandle (hObject=0xe0) returned 1 [0217.908] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.908] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x639 [0217.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x641) returned 0x259e70 [0217.908] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x639, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x639, lpOverlapped=0x0) returned 1 [0217.910] CloseHandle (hObject=0xe0) returned 1 [0217.910] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0217.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.911] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.911] GetTickCount () returned 0x460c5 [0217.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.911] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286917\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286917\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286917\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286917\\....\\temporaryfile")) returned 0 [0217.912] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286917\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286917\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286917\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286917\\temporaryfile")) returned 1 [0217.913] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286917\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d4c980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d4c980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d4c980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.913] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d4c980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d4c980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d4c980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.913] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d4c980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d4c980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d4c980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.913] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286917\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d4c980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d4c980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d4c980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.913] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d4c980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d4c980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d4c980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.913] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d4c980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d4c980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d4c980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.913] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.913] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286917\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286917\\temporaryfile")) returned 1 [0217.914] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d4c980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d4c980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d4c980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.914] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286917" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286917")) returned 1 [0217.914] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 0 [0217.914] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.917] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x640, lpOverlapped=0x0) returned 1 [0217.917] CloseHandle (hObject=0xe0) returned 1 [0217.918] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.919] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x54f1 [0217.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54f9) returned 0x2b4a70 [0217.919] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x54f1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x54f1, lpOverlapped=0x0) returned 1 [0217.920] CloseHandle (hObject=0xe0) returned 1 [0217.920] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0217.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.921] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.921] GetTickCount () returned 0x460d4 [0217.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.922] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.922] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932\\....\\temporaryfile")) returned 0 [0217.922] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932\\temporaryfile")) returned 1 [0217.923] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.923] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.923] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.924] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.924] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.924] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.924] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.924] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932\\temporaryfile")) returned 1 [0217.924] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.924] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.924] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932")) returned 1 [0217.924] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 0 [0217.925] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.925] WriteFile (in: hFile=0xe0, lpBuffer=0x2b9f80*, nNumberOfBytesToWrite=0x54f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b9f80*, lpNumberOfBytesWritten=0x18fdb8*=0x54f8, lpOverlapped=0x0) returned 1 [0217.926] CloseHandle (hObject=0xe0) returned 1 [0217.926] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.926] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0217.927] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.927] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0217.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0217.927] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.928] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x53b [0217.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x543) returned 0x259e70 [0217.928] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x53b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x53b, lpOverlapped=0x0) returned 1 [0217.930] CloseHandle (hObject=0xe0) returned 1 [0217.930] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0217.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.930] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.931] GetTickCount () returned 0x460d4 [0217.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.931] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932\\....\\temporaryfile")) returned 0 [0217.932] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932\\temporaryfile")) returned 1 [0217.933] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.933] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.933] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.933] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.933] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.933] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.934] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.934] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932\\temporaryfile")) returned 1 [0217.934] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d72ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d72ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d72ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.934] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.934] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286932" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286932")) returned 1 [0217.934] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 0 [0217.934] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.935] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x540, lpOverlapped=0x0) returned 1 [0217.936] CloseHandle (hObject=0xe0) returned 1 [0217.936] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.937] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb20e [0217.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb216) returned 0x2b4a70 [0217.937] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xb20e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xb20e, lpOverlapped=0x0) returned 1 [0217.938] CloseHandle (hObject=0xe0) returned 1 [0217.938] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm")) returned 1 [0217.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.939] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.939] GetTickCount () returned 0x460e4 [0217.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.940] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948\\....\\temporaryfile")) returned 0 [0217.941] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948\\temporaryfile")) returned 1 [0217.942] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.942] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.942] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.942] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.942] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.942] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.942] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.942] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948\\temporaryfile")) returned 1 [0217.942] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.942] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.942] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948")) returned 1 [0217.942] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 0 [0217.943] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.945] WriteFile (in: hFile=0xe0, lpBuffer=0x2bfc98*, nNumberOfBytesToWrite=0xb218, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bfc98*, lpNumberOfBytesWritten=0x18fdb8*=0xb218, lpOverlapped=0x0) returned 1 [0217.946] CloseHandle (hObject=0xe0) returned 1 [0217.946] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.947] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x24b [0217.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x253) returned 0x28f1f8 [0217.947] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x24b, lpOverlapped=0x0) returned 1 [0217.948] CloseHandle (hObject=0xe0) returned 1 [0217.948] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf")) returned 1 [0217.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.949] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.949] GetTickCount () returned 0x460e4 [0217.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.949] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948\\....\\temporaryfile")) returned 0 [0217.950] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948\\temporaryfile")) returned 1 [0217.951] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.951] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.951] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.952] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.952] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.952] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.952] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.952] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948\\temporaryfile")) returned 1 [0217.952] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86d98c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86d98c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86d98c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.952] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.952] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286948" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286948")) returned 1 [0217.952] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 0 [0217.952] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.953] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x250, lpOverlapped=0x0) returned 1 [0217.954] CloseHandle (hObject=0xe0) returned 1 [0217.954] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.954] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4162 [0217.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x416a) returned 0x2b4a70 [0217.954] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4162, lpOverlapped=0x0) returned 1 [0217.956] CloseHandle (hObject=0xe0) returned 1 [0217.956] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0217.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.957] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.957] GetTickCount () returned 0x460f3 [0217.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.957] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963\\....\\temporaryfile")) returned 0 [0217.958] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963\\temporaryfile")) returned 1 [0217.959] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86dbeda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86dbeda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86dbeda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.959] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86dbeda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86dbeda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86dbeda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.959] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86dbeda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86dbeda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86dbeda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.959] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86dbeda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86dbeda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86dbeda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.959] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86dbeda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86dbeda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86dbeda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.959] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86dbeda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86dbeda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86dbeda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.959] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.959] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963\\temporaryfile")) returned 1 [0217.960] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86dbeda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86dbeda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86dbeda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.960] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.960] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963")) returned 1 [0217.960] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 0 [0217.960] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.961] WriteFile (in: hFile=0xe0, lpBuffer=0x2b8bf0*, nNumberOfBytesToWrite=0x4168, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b8bf0*, lpNumberOfBytesWritten=0x18fdb8*=0x4168, lpOverlapped=0x0) returned 1 [0217.962] CloseHandle (hObject=0xe0) returned 1 [0217.962] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.962] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86dbeda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86dbeda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0217.962] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.962] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.963] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0217.963] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x5a6f8e30, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0217.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256198 [0217.963] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.963] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x59f [0217.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5a7) returned 0x259e70 [0217.963] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x59f, lpOverlapped=0x0) returned 1 [0217.965] CloseHandle (hObject=0xe0) returned 1 [0217.965] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0217.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.966] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.966] GetTickCount () returned 0x460f3 [0217.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.966] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963\\....\\temporaryfile")) returned 0 [0217.967] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963\\temporaryfile")) returned 1 [0217.968] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86dbeda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.968] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86dbeda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0217.968] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.968] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.968] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.968] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.968] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.968] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963\\temporaryfile")) returned 1 [0217.969] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.969] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.969] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286963" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286963")) returned 1 [0217.969] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 0 [0217.969] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.970] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x5a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x5a8, lpOverlapped=0x0) returned 1 [0217.970] CloseHandle (hObject=0xe0) returned 1 [0217.971] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.972] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbba7 [0217.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbbaf) returned 0x2b4a70 [0217.972] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xbba7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xbba7, lpOverlapped=0x0) returned 1 [0217.974] CloseHandle (hObject=0xe0) returned 1 [0217.974] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm")) returned 1 [0217.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.975] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.975] GetTickCount () returned 0x46103 [0217.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.976] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286979\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286979\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286979\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286979\\....\\temporaryfile")) returned 0 [0217.976] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286979\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286979\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286979\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286979\\temporaryfile")) returned 1 [0217.977] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286979\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.977] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.977] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.977] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286979\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.978] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.978] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.978] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.978] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286979\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286979\\temporaryfile")) returned 1 [0217.978] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86de4f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86de4f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86de4f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.978] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.978] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286979" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286979")) returned 1 [0217.978] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 0 [0217.979] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.981] WriteFile (in: hFile=0xe0, lpBuffer=0x2c0630*, nNumberOfBytesToWrite=0xbbb0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c0630*, lpNumberOfBytesWritten=0x18fdb8*=0xbbb0, lpOverlapped=0x0) returned 1 [0217.982] CloseHandle (hObject=0xe0) returned 1 [0217.982] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.984] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x258 [0217.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x260) returned 0x2a8a88 [0217.984] ReadFile (in: hFile=0xe0, lpBuffer=0x2a8a90, nNumberOfBytesToRead=0x258, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2a8a90*, lpNumberOfBytesRead=0x18fdd0*=0x258, lpOverlapped=0x0) returned 1 [0217.984] CloseHandle (hObject=0xe0) returned 1 [0217.984] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf")) returned 1 [0217.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0217.985] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.985] GetTickCount () returned 0x46113 [0217.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.986] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995\\...."), lpSecurityAttributes=0x256228) returned 1 [0217.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995\\....\\temporaryfile")) returned 0 [0217.986] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995\\temporaryfile")) returned 1 [0217.987] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.987] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.987] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.988] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.988] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.988] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.988] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.988] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995\\temporaryfile")) returned 1 [0217.988] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.988] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.988] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995")) returned 1 [0217.988] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 0 [0217.988] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.989] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x260, lpOverlapped=0x0) returned 1 [0217.990] CloseHandle (hObject=0xe0) returned 1 [0217.990] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.990] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x90f8 [0217.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9100) returned 0x2b4a70 [0217.990] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x90f8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x90f8, lpOverlapped=0x0) returned 1 [0217.992] CloseHandle (hObject=0xe0) returned 1 [0217.992] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0217.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0217.993] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0217.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0217.993] GetTickCount () returned 0x46113 [0217.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0217.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0217.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0217.994] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995\\...."), lpSecurityAttributes=0x256198) returned 1 [0217.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995\\....\\temporaryfile")) returned 0 [0217.994] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995\\temporaryfile")) returned 1 [0217.995] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0217.995] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.995] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0217.995] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0217.996] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.996] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0217.996] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0217.996] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995\\temporaryfile")) returned 1 [0217.996] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e0b060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0217.996] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0217.996] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18286995" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18286995")) returned 1 [0217.996] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 0 [0217.997] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0217.998] WriteFile (in: hFile=0xe0, lpBuffer=0x2bdb80*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bdb80*, lpNumberOfBytesWritten=0x18fdb8*=0x9100, lpOverlapped=0x0) returned 1 [0217.999] CloseHandle (hObject=0xe0) returned 1 [0217.999] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0217.999] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86e0b060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86e0b060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0217.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0217.999] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.000] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a829930, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.116] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a829930, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.116] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x5a829930, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0218.117] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.119] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x682 [0218.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x68a) returned 0x259e70 [0218.119] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x682, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x682, lpOverlapped=0x0) returned 1 [0218.120] CloseHandle (hObject=0xe0) returned 1 [0218.120] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0218.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.121] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.121] GetTickCount () returned 0x4618f [0218.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.122] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287119\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287119\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287119\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287119\\....\\temporaryfile")) returned 0 [0218.123] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287119\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287119\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287119\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287119\\temporaryfile")) returned 1 [0218.124] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287119\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f3bb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.124] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f3bb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.124] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.124] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287119\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.125] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.125] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.125] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287119\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287119\\temporaryfile")) returned 1 [0218.125] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.125] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287119" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287119")) returned 1 [0218.125] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 0 [0218.125] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.126] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x688, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x688, lpOverlapped=0x0) returned 1 [0218.127] CloseHandle (hObject=0xe0) returned 1 [0218.130] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.130] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb75e [0218.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb766) returned 0x2b4a70 [0218.131] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xb75e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xb75e, lpOverlapped=0x0) returned 1 [0218.132] CloseHandle (hObject=0xe0) returned 1 [0218.132] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm")) returned 1 [0218.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.133] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.133] GetTickCount () returned 0x4619f [0218.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.134] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287135\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287135\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287135\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287135\\....\\temporaryfile")) returned 0 [0218.134] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287135\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287135\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287135\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287135\\temporaryfile")) returned 1 [0218.136] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287135\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.136] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.136] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.136] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287135\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.136] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.136] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.136] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.136] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287135\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287135\\temporaryfile")) returned 1 [0218.136] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f61cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f61cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f61cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.136] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.136] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287135" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287135")) returned 1 [0218.136] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 0 [0218.137] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.139] WriteFile (in: hFile=0xe0, lpBuffer=0x2c01e8*, nNumberOfBytesToWrite=0xb768, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c01e8*, lpNumberOfBytesWritten=0x18fdb8*=0xb768, lpOverlapped=0x0) returned 1 [0218.140] CloseHandle (hObject=0xe0) returned 1 [0218.141] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.141] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x24a [0218.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x252) returned 0x28f1f8 [0218.141] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x24a, lpOverlapped=0x0) returned 1 [0218.142] CloseHandle (hObject=0xe0) returned 1 [0218.142] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf")) returned 1 [0218.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.143] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.143] GetTickCount () returned 0x461af [0218.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.143] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151\\....\\temporaryfile")) returned 0 [0218.144] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151\\temporaryfile")) returned 1 [0218.145] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.145] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.145] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.145] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.145] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.145] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.145] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.145] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151\\temporaryfile")) returned 1 [0218.145] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.145] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.145] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151")) returned 1 [0218.146] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 0 [0218.146] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.146] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x250, lpOverlapped=0x0) returned 1 [0218.147] CloseHandle (hObject=0xe0) returned 1 [0218.147] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.148] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4c6b [0218.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c73) returned 0x2b4a70 [0218.148] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4c6b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4c6b, lpOverlapped=0x0) returned 1 [0218.149] CloseHandle (hObject=0xe0) returned 1 [0218.149] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0218.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.150] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.150] GetTickCount () returned 0x461af [0218.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.151] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151\\....\\temporaryfile")) returned 0 [0218.151] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151\\temporaryfile")) returned 1 [0218.152] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.152] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.152] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.153] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.153] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.153] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151\\temporaryfile")) returned 1 [0218.153] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f87e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86f87e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86f87e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.153] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287151" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287151")) returned 1 [0218.153] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 0 [0218.154] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.154] WriteFile (in: hFile=0xe0, lpBuffer=0x2b96f8*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b96f8*, lpNumberOfBytesWritten=0x18fdb8*=0x4c70, lpOverlapped=0x0) returned 1 [0218.155] CloseHandle (hObject=0xe0) returned 1 [0218.156] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.156] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.156] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0218.156] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.156] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a84fa90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.156] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a84fa90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.156] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x5a84fa90, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.156] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256198 [0218.157] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.157] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x58f [0218.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x597) returned 0x259e70 [0218.157] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x58f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x58f, lpOverlapped=0x0) returned 1 [0218.158] CloseHandle (hObject=0xe0) returned 1 [0218.158] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0218.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.159] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.159] GetTickCount () returned 0x461be [0218.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.160] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166\\....\\temporaryfile")) returned 0 [0218.160] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166\\temporaryfile")) returned 1 [0218.161] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.161] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.161] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.162] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.162] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.162] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.162] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.162] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166\\temporaryfile")) returned 1 [0218.162] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.162] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.162] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166")) returned 1 [0218.162] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 0 [0218.162] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.163] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x598, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x598, lpOverlapped=0x0) returned 1 [0218.164] CloseHandle (hObject=0xe0) returned 1 [0218.164] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.164] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb30e [0218.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb316) returned 0x2b4a70 [0218.164] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xb30e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xb30e, lpOverlapped=0x0) returned 1 [0218.167] CloseHandle (hObject=0xe0) returned 1 [0218.167] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm")) returned 1 [0218.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.168] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.168] GetTickCount () returned 0x461be [0218.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.169] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166\\....\\temporaryfile")) returned 0 [0218.169] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166\\temporaryfile")) returned 1 [0218.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fd40e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fd40e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.170] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fd40e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fd40e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.170] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.171] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.171] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.171] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.171] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.171] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166\\temporaryfile")) returned 1 [0218.171] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fadf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fadf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fadf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.171] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.171] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287166" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287166")) returned 1 [0218.171] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 0 [0218.172] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.174] WriteFile (in: hFile=0xe0, lpBuffer=0x2bfd98*, nNumberOfBytesToWrite=0xb318, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bfd98*, lpNumberOfBytesWritten=0x18fdb8*=0xb318, lpOverlapped=0x0) returned 1 [0218.175] CloseHandle (hObject=0xe0) returned 1 [0218.175] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.176] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x24a [0218.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x252) returned 0x28f1f8 [0218.176] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x24a, lpOverlapped=0x0) returned 1 [0218.177] CloseHandle (hObject=0xe0) returned 1 [0218.177] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf")) returned 1 [0218.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.177] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.177] GetTickCount () returned 0x461ce [0218.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.178] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287182\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287182\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287182\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287182\\....\\temporaryfile")) returned 0 [0218.179] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287182\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287182\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287182\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287182\\temporaryfile")) returned 1 [0218.180] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287182\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fd40e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fd40e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fd40e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.180] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fd40e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fd40e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fd40e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.180] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fd40e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fd40e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fd40e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.180] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287182\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fd40e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fd40e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fd40e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.180] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fd40e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fd40e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fd40e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.180] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fd40e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fd40e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fd40e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.180] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.180] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287182\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287182\\temporaryfile")) returned 1 [0218.180] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fd40e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86fd40e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86fd40e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.180] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.180] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287182" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287182")) returned 1 [0218.181] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 0 [0218.181] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.181] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x250, lpOverlapped=0x0) returned 1 [0218.182] CloseHandle (hObject=0xe0) returned 1 [0218.182] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.183] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3d79 [0218.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d81) returned 0x2b4a70 [0218.183] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3d79, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x3d79, lpOverlapped=0x0) returned 1 [0218.184] CloseHandle (hObject=0xe0) returned 1 [0218.184] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0218.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.185] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.185] GetTickCount () returned 0x461dd [0218.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.186] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197\\....\\temporaryfile")) returned 0 [0218.186] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197\\temporaryfile")) returned 1 [0218.187] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.187] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.187] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.187] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.187] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.188] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.188] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.188] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197\\temporaryfile")) returned 1 [0218.188] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.188] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.188] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197")) returned 1 [0218.188] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 0 [0218.189] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.189] WriteFile (in: hFile=0xe0, lpBuffer=0x2b8808*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b8808*, lpNumberOfBytesWritten=0x18fdb8*=0x3d80, lpOverlapped=0x0) returned 1 [0218.190] CloseHandle (hObject=0xe0) returned 1 [0218.190] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.190] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0218.190] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.191] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a89bd50, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.192] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a89bd50, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.192] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x5a89bd50, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256198 [0218.192] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.192] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xf82 [0218.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf8a) returned 0x25f580 [0218.192] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xf82, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xf82, lpOverlapped=0x0) returned 1 [0218.194] CloseHandle (hObject=0xe0) returned 1 [0218.194] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0218.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.195] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.195] GetTickCount () returned 0x461dd [0218.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.195] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197\\....\\temporaryfile")) returned 0 [0218.196] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197\\temporaryfile")) returned 1 [0218.197] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.197] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.197] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.197] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.197] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.197] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.197] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.197] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197\\temporaryfile")) returned 1 [0218.197] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ffa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x86ffa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x86ffa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.197] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.198] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287197" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287197")) returned 1 [0218.198] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 0 [0218.198] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.198] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xf88, lpOverlapped=0x0) returned 1 [0218.199] CloseHandle (hObject=0xe0) returned 1 [0218.199] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.200] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1205e [0218.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12066) returned 0x2b4a70 [0218.201] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1205e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1205e, lpOverlapped=0x0) returned 1 [0218.202] CloseHandle (hObject=0xe0) returned 1 [0218.202] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm")) returned 1 [0218.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.203] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.203] GetTickCount () returned 0x461ed [0218.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.204] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.204] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213\\....\\temporaryfile")) returned 0 [0218.204] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213\\temporaryfile")) returned 1 [0218.205] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.206] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.206] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.206] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.206] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.206] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.206] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.206] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213\\temporaryfile")) returned 1 [0218.206] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.206] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.206] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213")) returned 1 [0218.206] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 0 [0218.208] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.209] WriteFile (in: hFile=0xe0, lpBuffer=0x2c6ae8*, nNumberOfBytesToWrite=0x12068, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c6ae8*, lpNumberOfBytesWritten=0x18fdb8*=0x12068, lpOverlapped=0x0) returned 1 [0218.211] CloseHandle (hObject=0xe0) returned 1 [0218.211] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.212] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x239 [0218.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x241) returned 0x28f1f8 [0218.212] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x239, lpOverlapped=0x0) returned 1 [0218.213] CloseHandle (hObject=0xe0) returned 1 [0218.213] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf")) returned 1 [0218.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.214] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.214] GetTickCount () returned 0x461ed [0218.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.214] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213\\....\\temporaryfile")) returned 0 [0218.215] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213\\temporaryfile")) returned 1 [0218.216] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.216] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.216] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.216] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.216] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.216] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.216] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.216] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213\\temporaryfile")) returned 1 [0218.217] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870203a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870203a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870203a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.217] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.217] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287213" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287213")) returned 1 [0218.217] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 0 [0218.217] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.218] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x240, lpOverlapped=0x0) returned 1 [0218.218] CloseHandle (hObject=0xe0) returned 1 [0218.218] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.219] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xcf7b [0218.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcf83) returned 0x2b4a70 [0218.219] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xcf7b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xcf7b, lpOverlapped=0x0) returned 1 [0218.221] CloseHandle (hObject=0xe0) returned 1 [0218.221] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0218.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.222] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.222] GetTickCount () returned 0x461fd [0218.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.222] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287229\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287229\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287229\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287229\\....\\temporaryfile")) returned 0 [0218.223] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287229\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287229\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287229\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287229\\temporaryfile")) returned 1 [0218.224] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287229\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87046500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87046500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87046500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.224] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87046500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87046500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87046500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.224] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87046500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87046500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87046500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.224] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287229\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87046500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87046500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87046500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.224] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87046500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87046500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87046500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.224] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87046500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87046500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87046500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.224] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.224] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287229\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287229\\temporaryfile")) returned 1 [0218.225] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87046500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87046500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87046500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.225] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.225] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287229" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287229")) returned 1 [0218.225] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 0 [0218.226] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.226] WriteFile (in: hFile=0xe0, lpBuffer=0x2c1a08*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c1a08*, lpNumberOfBytesWritten=0x18fdb8*=0xcf80, lpOverlapped=0x0) returned 1 [0218.228] CloseHandle (hObject=0xe0) returned 1 [0218.228] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.228] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87046500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87046500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0218.228] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.228] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.228] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.229] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0218.229] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.230] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa2c [0218.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa34) returned 0x25f580 [0218.230] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xa2c, lpOverlapped=0x0) returned 1 [0218.231] CloseHandle (hObject=0xe0) returned 1 [0218.231] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0218.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.232] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.232] GetTickCount () returned 0x4620c [0218.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.233] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244\\....\\temporaryfile")) returned 0 [0218.233] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244\\temporaryfile")) returned 1 [0218.234] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.234] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.234] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.234] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.234] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.234] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.234] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.235] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244\\temporaryfile")) returned 1 [0218.235] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.235] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.235] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244")) returned 1 [0218.235] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 0 [0218.235] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.236] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xa30, lpOverlapped=0x0) returned 1 [0218.236] CloseHandle (hObject=0xe0) returned 1 [0218.237] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.237] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x101e0 [0218.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x101e8) returned 0x2b4a70 [0218.237] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x101e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x101e0, lpOverlapped=0x0) returned 1 [0218.239] CloseHandle (hObject=0xe0) returned 1 [0218.239] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 1 [0218.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.240] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.240] GetTickCount () returned 0x4620c [0218.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.240] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.241] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244\\....\\temporaryfile")) returned 0 [0218.241] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244\\temporaryfile")) returned 1 [0218.242] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.242] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.242] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.242] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.242] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.242] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.242] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244\\temporaryfile")) returned 1 [0218.243] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8706c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8706c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8706c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.243] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287244" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287244")) returned 1 [0218.243] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 0 [0218.244] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.246] WriteFile (in: hFile=0xe0, lpBuffer=0x2c4c68*, nNumberOfBytesToWrite=0x101e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c4c68*, lpNumberOfBytesWritten=0x18fdb8*=0x101e8, lpOverlapped=0x0) returned 1 [0218.247] CloseHandle (hObject=0xe0) returned 1 [0218.247] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.248] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1e7 [0218.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ef) returned 0x28f1f8 [0218.248] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1e7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1e7, lpOverlapped=0x0) returned 1 [0218.249] CloseHandle (hObject=0xe0) returned 1 [0218.249] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf")) returned 1 [0218.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.250] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.250] GetTickCount () returned 0x4621c [0218.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.250] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287260\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287260\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287260\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287260\\....\\temporaryfile")) returned 0 [0218.251] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287260\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287260\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287260\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287260\\temporaryfile")) returned 1 [0218.252] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287260\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870927c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870927c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870927c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.252] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870927c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870927c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870927c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.252] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870927c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870927c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870927c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.252] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287260\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870927c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870927c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870927c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.252] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870927c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870927c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870927c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.252] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870927c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870927c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870927c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.252] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.252] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287260\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287260\\temporaryfile")) returned 1 [0218.252] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870927c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870927c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870927c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.252] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.253] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287260" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287260")) returned 1 [0218.253] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 0 [0218.253] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.253] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1f0, lpOverlapped=0x0) returned 1 [0218.254] CloseHandle (hObject=0xe0) returned 1 [0218.254] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.255] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7ce7 [0218.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7cef) returned 0x2b4a70 [0218.255] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x7ce7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x7ce7, lpOverlapped=0x0) returned 1 [0218.257] CloseHandle (hObject=0xe0) returned 1 [0218.257] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0218.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.265] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.265] GetTickCount () returned 0x4622b [0218.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.265] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275\\....\\temporaryfile")) returned 0 [0218.266] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275\\temporaryfile")) returned 1 [0218.267] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.267] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.267] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.267] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.267] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.267] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.267] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.267] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275\\temporaryfile")) returned 1 [0218.267] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.267] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.268] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275")) returned 1 [0218.268] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 0 [0218.268] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.269] WriteFile (in: hFile=0xe0, lpBuffer=0x2bc770*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bc770*, lpNumberOfBytesWritten=0x18fdb8*=0x7cf0, lpOverlapped=0x0) returned 1 [0218.270] CloseHandle (hObject=0xe0) returned 1 [0218.270] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.270] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0218.270] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.271] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.271] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.271] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0218.271] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.271] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1004 [0218.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x100c) returned 0x25b528 [0218.271] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1004, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x1004, lpOverlapped=0x0) returned 1 [0218.273] CloseHandle (hObject=0xe0) returned 1 [0218.273] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0218.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.274] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.274] GetTickCount () returned 0x4622b [0218.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.275] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275\\....\\temporaryfile")) returned 0 [0218.275] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275\\temporaryfile")) returned 1 [0218.276] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.276] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.276] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.276] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.277] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.277] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.277] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.277] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275\\temporaryfile")) returned 1 [0218.277] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870b8920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870b8920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870b8920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.277] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.277] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287275" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287275")) returned 1 [0218.277] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 0 [0218.277] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.278] WriteFile (in: hFile=0xe0, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1008, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdb8*=0x1008, lpOverlapped=0x0) returned 1 [0218.279] CloseHandle (hObject=0xe0) returned 1 [0218.279] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.279] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11e37 [0218.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e3f) returned 0x2b4a70 [0218.279] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x11e37, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x11e37, lpOverlapped=0x0) returned 1 [0218.281] CloseHandle (hObject=0xe0) returned 1 [0218.281] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 1 [0218.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.282] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.282] GetTickCount () returned 0x4623b [0218.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.283] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291\\....\\temporaryfile")) returned 0 [0218.283] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291\\temporaryfile")) returned 1 [0218.284] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.284] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.284] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.284] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.285] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.285] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.285] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.285] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291\\temporaryfile")) returned 1 [0218.285] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.285] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.285] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291")) returned 1 [0218.285] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 0 [0218.286] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.288] WriteFile (in: hFile=0xe0, lpBuffer=0x2c68c0*, nNumberOfBytesToWrite=0x11e40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c68c0*, lpNumberOfBytesWritten=0x18fdb8*=0x11e40, lpOverlapped=0x0) returned 1 [0218.290] CloseHandle (hObject=0xe0) returned 1 [0218.290] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.291] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x265 [0218.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26d) returned 0x259e70 [0218.291] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x265, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x265, lpOverlapped=0x0) returned 1 [0218.292] CloseHandle (hObject=0xe0) returned 1 [0218.292] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf")) returned 1 [0218.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.292] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.292] GetTickCount () returned 0x4623b [0218.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.293] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291\\....\\temporaryfile")) returned 0 [0218.294] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291\\temporaryfile")) returned 1 [0218.295] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87104be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87104be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.295] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87104be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87104be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.295] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.295] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.295] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.295] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.295] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.295] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291\\temporaryfile")) returned 1 [0218.295] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x870dea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x870dea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x870dea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.295] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.296] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287291" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287291")) returned 1 [0218.296] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 0 [0218.296] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.297] WriteFile (in: hFile=0xe0, lpBuffer=0x25a0f0*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25a0f0*, lpNumberOfBytesWritten=0x18fdb8*=0x270, lpOverlapped=0x0) returned 1 [0218.297] CloseHandle (hObject=0xe0) returned 1 [0218.298] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.298] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbb5a [0218.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbb62) returned 0x2b4a70 [0218.298] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xbb5a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xbb5a, lpOverlapped=0x0) returned 1 [0218.302] CloseHandle (hObject=0xe0) returned 1 [0218.302] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0218.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.303] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.303] GetTickCount () returned 0x4624b [0218.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.304] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287307\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287307\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287307\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287307\\....\\temporaryfile")) returned 0 [0218.304] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287307\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287307\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287307\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287307\\temporaryfile")) returned 1 [0218.305] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287307\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87104be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87104be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87104be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.306] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87104be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87104be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87104be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.306] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87104be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87104be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87104be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.306] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287307\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87104be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87104be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87104be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.306] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87104be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87104be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87104be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.306] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87104be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87104be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87104be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.306] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.306] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287307\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287307\\temporaryfile")) returned 1 [0218.306] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87104be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87104be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87104be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.306] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.306] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287307" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287307")) returned 1 [0218.306] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 0 [0218.307] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.308] WriteFile (in: hFile=0xe0, lpBuffer=0x2c05e8*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c05e8*, lpNumberOfBytesWritten=0x18fdb8*=0xbb60, lpOverlapped=0x0) returned 1 [0218.309] CloseHandle (hObject=0xe0) returned 1 [0218.309] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.310] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87104be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87104be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0218.310] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.310] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.310] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.310] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0218.310] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.311] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe1b [0218.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe23) returned 0x25f580 [0218.311] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xe1b, lpOverlapped=0x0) returned 1 [0218.313] CloseHandle (hObject=0xe0) returned 1 [0218.313] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0218.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.314] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.314] GetTickCount () returned 0x4625a [0218.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.314] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322\\....\\temporaryfile")) returned 0 [0218.315] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322\\temporaryfile")) returned 1 [0218.316] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.316] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.316] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.316] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.316] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.316] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.316] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.316] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322\\temporaryfile")) returned 1 [0218.316] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.316] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.316] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322")) returned 1 [0218.317] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 0 [0218.317] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.317] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xe20, lpOverlapped=0x0) returned 1 [0218.318] CloseHandle (hObject=0xe0) returned 1 [0218.318] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.319] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1936f [0218.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19377) returned 0x2b4a70 [0218.319] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1936f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1936f, lpOverlapped=0x0) returned 1 [0218.321] CloseHandle (hObject=0xe0) returned 1 [0218.321] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm")) returned 1 [0218.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.322] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.322] GetTickCount () returned 0x4625a [0218.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.323] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322\\....\\temporaryfile")) returned 0 [0218.324] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322\\temporaryfile")) returned 1 [0218.325] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.325] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.325] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.325] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.325] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.325] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.325] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322\\temporaryfile")) returned 1 [0218.325] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8712ad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8712ad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8712ad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.325] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287322" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287322")) returned 1 [0218.326] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 0 [0218.327] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.329] WriteFile (in: hFile=0xe0, lpBuffer=0x2cddf8*, nNumberOfBytesToWrite=0x19378, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2cddf8*, lpNumberOfBytesWritten=0x18fdb8*=0x19378, lpOverlapped=0x0) returned 1 [0218.331] CloseHandle (hObject=0xe0) returned 1 [0218.331] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.332] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1c8 [0218.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d0) returned 0x28f1f8 [0218.332] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1c8, lpOverlapped=0x0) returned 1 [0218.332] CloseHandle (hObject=0xe0) returned 1 [0218.332] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf")) returned 1 [0218.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.333] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.333] GetTickCount () returned 0x4626a [0218.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.334] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287338\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287338\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287338\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287338\\....\\temporaryfile")) returned 0 [0218.334] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287338\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287338\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287338\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287338\\temporaryfile")) returned 1 [0218.335] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287338\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87150ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87150ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87150ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.336] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87150ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87150ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87150ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.336] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87150ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87150ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87150ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.336] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287338\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87150ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87150ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87150ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.336] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87150ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87150ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87150ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.336] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87150ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87150ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87150ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.336] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287338\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287338\\temporaryfile")) returned 1 [0218.336] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87150ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87150ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87150ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.336] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287338" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287338")) returned 1 [0218.336] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 0 [0218.336] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.337] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1d0, lpOverlapped=0x0) returned 1 [0218.338] CloseHandle (hObject=0xe0) returned 1 [0218.338] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.338] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8573 [0218.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x857b) returned 0x2b4a70 [0218.338] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x8573, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x8573, lpOverlapped=0x0) returned 1 [0218.340] CloseHandle (hObject=0xe0) returned 1 [0218.340] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0218.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.341] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.341] GetTickCount () returned 0x46279 [0218.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.342] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353\\....\\temporaryfile")) returned 0 [0218.342] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353\\temporaryfile")) returned 1 [0218.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.343] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.343] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.343] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.343] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.344] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353\\temporaryfile")) returned 1 [0218.344] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.344] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353")) returned 1 [0218.344] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 0 [0218.345] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.345] WriteFile (in: hFile=0xe0, lpBuffer=0x2bd000*, nNumberOfBytesToWrite=0x8578, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd000*, lpNumberOfBytesWritten=0x18fdb8*=0x8578, lpOverlapped=0x0) returned 1 [0218.346] CloseHandle (hObject=0xe0) returned 1 [0218.346] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.347] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0218.347] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.347] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a980590, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.349] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a980590, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.349] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x5a980590, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0218.349] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.350] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3a9 [0218.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3b1) returned 0x259e70 [0218.350] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x3a9, lpOverlapped=0x0) returned 1 [0218.351] CloseHandle (hObject=0xe0) returned 1 [0218.351] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0218.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.352] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.352] GetTickCount () returned 0x46279 [0218.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.352] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.353] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353\\....\\temporaryfile")) returned 0 [0218.353] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353\\temporaryfile")) returned 1 [0218.356] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.356] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0218.356] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.356] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.356] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.356] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.356] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.356] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353\\temporaryfile")) returned 1 [0218.356] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87177000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87177000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87177000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.357] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.357] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287353" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287353")) returned 1 [0218.357] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 0 [0218.357] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.357] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x3b0, lpOverlapped=0x0) returned 1 [0218.358] CloseHandle (hObject=0xe0) returned 1 [0218.358] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.359] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1413d [0218.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14145) returned 0x2b4a70 [0218.359] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1413d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1413d, lpOverlapped=0x0) returned 1 [0218.361] CloseHandle (hObject=0xe0) returned 1 [0218.361] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm")) returned 1 [0218.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.362] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.362] GetTickCount () returned 0x46289 [0218.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0218.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.363] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369\\....\\temporaryfile")) returned 0 [0218.363] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369\\temporaryfile")) returned 1 [0218.364] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8719d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8719d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8719d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.365] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8719d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8719d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8719d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.365] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8719d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8719d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8719d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.365] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8719d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8719d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8719d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.365] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8719d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8719d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8719d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.365] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8719d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8719d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8719d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.365] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.365] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369\\temporaryfile")) returned 1 [0218.365] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8719d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8719d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8719d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.365] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.365] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369")) returned 1 [0218.365] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 0 [0218.367] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.367] WriteFile (in: hFile=0xe0, lpBuffer=0x2c8bc8*, nNumberOfBytesToWrite=0x14148, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c8bc8*, lpNumberOfBytesWritten=0x18fdb8*=0x14148, lpOverlapped=0x0) returned 1 [0218.369] CloseHandle (hObject=0xe0) returned 1 [0218.369] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.370] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1bc [0218.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c4) returned 0x28f1f8 [0218.370] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1bc, lpOverlapped=0x0) returned 1 [0218.370] CloseHandle (hObject=0xe0) returned 1 [0218.370] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf")) returned 1 [0218.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.371] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.371] GetTickCount () returned 0x46289 [0218.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0218.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.372] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369\\....\\temporaryfile")) returned 0 [0218.373] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369\\temporaryfile")) returned 1 [0218.374] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.374] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.374] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.374] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.374] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.374] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.374] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.374] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369\\temporaryfile")) returned 1 [0218.374] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.374] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.374] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287369" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287369")) returned 1 [0218.375] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 0 [0218.375] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.376] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1c0, lpOverlapped=0x0) returned 1 [0218.377] CloseHandle (hObject=0xe0) returned 1 [0218.377] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.378] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7279 [0218.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7281) returned 0x2b4a70 [0218.378] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x7279, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x7279, lpOverlapped=0x0) returned 1 [0218.379] CloseHandle (hObject=0xe0) returned 1 [0218.379] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0218.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.380] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.380] GetTickCount () returned 0x46299 [0218.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.381] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287385\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287385\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287385\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287385\\....\\temporaryfile")) returned 0 [0218.382] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287385\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287385\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287385\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287385\\temporaryfile")) returned 1 [0218.383] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287385\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.383] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.383] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.383] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287385\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.383] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.383] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.383] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.383] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287385\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287385\\temporaryfile")) returned 1 [0218.383] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x871c32c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.383] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.383] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287385" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287385")) returned 1 [0218.383] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 0 [0218.384] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.385] WriteFile (in: hFile=0xe0, lpBuffer=0x2bbd08*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bbd08*, lpNumberOfBytesWritten=0x18fdb8*=0x7280, lpOverlapped=0x0) returned 1 [0218.389] CloseHandle (hObject=0xe0) returned 1 [0218.389] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.389] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x871c32c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x871c32c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0218.389] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.389] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a980590, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.392] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a980590, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.392] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x5a980590, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0218.392] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.406] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3f1 [0218.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3f9) returned 0x259e70 [0218.406] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x3f1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x3f1, lpOverlapped=0x0) returned 1 [0218.412] CloseHandle (hObject=0xe0) returned 1 [0218.412] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0218.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.413] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.413] GetTickCount () returned 0x462b8 [0218.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.413] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287416\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287416\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.414] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287416\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287416\\....\\temporaryfile")) returned 0 [0218.414] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287416\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287416\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287416\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287416\\temporaryfile")) returned 1 [0218.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287416\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8720f580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8720f580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8720f580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.415] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8720f580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8720f580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8720f580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.415] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8720f580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8720f580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8720f580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287416\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8720f580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8720f580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8720f580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.415] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8720f580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8720f580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8720f580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.415] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8720f580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8720f580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8720f580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.415] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287416\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287416\\temporaryfile")) returned 1 [0218.415] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8720f580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8720f580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8720f580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.415] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.416] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287416" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287416")) returned 1 [0218.416] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 0 [0218.416] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.416] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x3f8, lpOverlapped=0x0) returned 1 [0218.420] CloseHandle (hObject=0xe0) returned 1 [0218.421] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.421] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x14c40 [0218.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14c48) returned 0x2b4a70 [0218.421] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x14c40, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x14c40, lpOverlapped=0x0) returned 1 [0218.423] CloseHandle (hObject=0xe0) returned 1 [0218.423] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm")) returned 1 [0218.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.424] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.424] GetTickCount () returned 0x462c7 [0218.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.425] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287431\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287431\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287431\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287431\\....\\temporaryfile")) returned 0 [0218.425] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287431\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287431\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287431\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287431\\temporaryfile")) returned 1 [0218.426] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287431\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872356e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872356e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872356e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.426] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872356e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872356e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872356e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.426] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872356e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872356e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872356e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.426] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287431\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872356e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872356e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872356e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.426] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872356e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872356e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872356e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.426] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872356e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872356e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872356e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.426] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.427] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287431\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287431\\temporaryfile")) returned 1 [0218.427] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872356e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872356e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872356e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.427] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.427] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287431" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287431")) returned 1 [0218.427] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 0 [0218.428] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.430] WriteFile (in: hFile=0xe0, lpBuffer=0x2c96c8*, nNumberOfBytesToWrite=0x14c48, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c96c8*, lpNumberOfBytesWritten=0x18fdb8*=0x14c48, lpOverlapped=0x0) returned 1 [0218.432] CloseHandle (hObject=0xe0) returned 1 [0218.432] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.433] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1f4 [0218.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1fc) returned 0x28f1f8 [0218.433] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1f4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1f4, lpOverlapped=0x0) returned 1 [0218.434] CloseHandle (hObject=0xe0) returned 1 [0218.434] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf")) returned 1 [0218.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.435] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.435] GetTickCount () returned 0x462d7 [0218.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.435] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447\\....\\temporaryfile")) returned 0 [0218.436] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447\\temporaryfile")) returned 1 [0218.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.437] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.437] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.437] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.437] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.437] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.437] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447\\temporaryfile")) returned 1 [0218.437] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.437] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447")) returned 1 [0218.438] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 0 [0218.438] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.438] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1f8, lpOverlapped=0x0) returned 1 [0218.439] CloseHandle (hObject=0xe0) returned 1 [0218.439] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.440] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6a29 [0218.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6a31) returned 0x2b4a70 [0218.440] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6a29, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x6a29, lpOverlapped=0x0) returned 1 [0218.441] CloseHandle (hObject=0xe0) returned 1 [0218.441] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0218.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.442] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.442] GetTickCount () returned 0x462d7 [0218.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.443] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.443] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447\\....\\temporaryfile")) returned 0 [0218.443] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447\\temporaryfile")) returned 1 [0218.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.444] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.445] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.445] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.445] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.445] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.445] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.445] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447\\temporaryfile")) returned 1 [0218.445] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8725b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.445] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.445] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287447" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287447")) returned 1 [0218.445] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 0 [0218.446] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.446] WriteFile (in: hFile=0xe0, lpBuffer=0x2bb4b8*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bb4b8*, lpNumberOfBytesWritten=0x18fdb8*=0x6a30, lpOverlapped=0x0) returned 1 [0218.447] CloseHandle (hObject=0xe0) returned 1 [0218.447] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.448] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8725b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8725b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0218.448] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.448] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5aad71f0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5aad71f0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x5aad71f0, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0218.480] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.481] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8a1 [0218.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8a9) returned 0x25f580 [0218.481] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x8a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x8a1, lpOverlapped=0x0) returned 1 [0218.482] CloseHandle (hObject=0xe0) returned 1 [0218.482] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0218.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.483] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.483] GetTickCount () returned 0x46306 [0218.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.484] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.484] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494\\....\\temporaryfile")) returned 0 [0218.484] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494\\temporaryfile")) returned 1 [0218.487] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.487] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.487] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.487] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.487] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.487] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.487] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.487] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494\\temporaryfile")) returned 1 [0218.488] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.488] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.488] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494")) returned 1 [0218.488] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 0 [0218.488] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.489] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x8a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x8a8, lpOverlapped=0x0) returned 1 [0218.489] CloseHandle (hObject=0xe0) returned 1 [0218.490] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.491] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd59f [0218.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd5a7) returned 0x2b4a70 [0218.491] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xd59f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xd59f, lpOverlapped=0x0) returned 1 [0218.492] CloseHandle (hObject=0xe0) returned 1 [0218.492] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm")) returned 1 [0218.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.493] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.493] GetTickCount () returned 0x46306 [0218.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.494] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494\\....\\temporaryfile")) returned 0 [0218.495] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494\\temporaryfile")) returned 1 [0218.496] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.496] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.496] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.496] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.496] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.496] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.496] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.496] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494\\temporaryfile")) returned 1 [0218.497] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872cdc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x872cdc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x872cdc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.497] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287494" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287494")) returned 1 [0218.497] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 0 [0218.498] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.502] WriteFile (in: hFile=0xe0, lpBuffer=0x2c2028*, nNumberOfBytesToWrite=0xd5a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c2028*, lpNumberOfBytesWritten=0x18fdb8*=0xd5a8, lpOverlapped=0x0) returned 1 [0218.509] CloseHandle (hObject=0xe0) returned 1 [0218.509] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.510] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1e4 [0218.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ec) returned 0x28f1f8 [0218.510] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1e4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1e4, lpOverlapped=0x0) returned 1 [0218.511] CloseHandle (hObject=0xe0) returned 1 [0218.511] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf")) returned 1 [0218.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.511] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.512] GetTickCount () returned 0x46315 [0218.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.512] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287509\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287509\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.513] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287509\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287509\\....\\temporaryfile")) returned 0 [0218.513] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287509\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287509\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287509\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287509\\temporaryfile")) returned 1 [0218.514] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287509\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872f3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87319f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87319f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.514] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x872f3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87319f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87319f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.514] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87319f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87319f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87319f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.514] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287509\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87319f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87319f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87319f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.514] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87319f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87319f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87319f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.514] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87319f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87319f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87319f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.514] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287509\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287509\\temporaryfile")) returned 1 [0218.514] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87319f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87319f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87319f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.514] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287509" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287509")) returned 1 [0218.515] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 0 [0218.515] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.515] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1e8, lpOverlapped=0x0) returned 1 [0218.516] CloseHandle (hObject=0xe0) returned 1 [0218.516] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.517] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5534 [0218.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x553c) returned 0x2b4a70 [0218.517] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5534, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x5534, lpOverlapped=0x0) returned 1 [0218.606] CloseHandle (hObject=0xe0) returned 1 [0218.606] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0218.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.607] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.607] GetTickCount () returned 0x46383 [0218.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.608] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619\\....\\temporaryfile")) returned 0 [0218.608] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619\\temporaryfile")) returned 1 [0218.609] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.609] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.610] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.610] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.610] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.610] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.610] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.610] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619\\temporaryfile")) returned 1 [0218.610] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.610] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.610] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619")) returned 1 [0218.610] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 0 [0218.611] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.611] WriteFile (in: hFile=0xe0, lpBuffer=0x2b9fc0*, nNumberOfBytesToWrite=0x5538, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b9fc0*, lpNumberOfBytesWritten=0x18fdb8*=0x5538, lpOverlapped=0x0) returned 1 [0218.612] CloseHandle (hObject=0xe0) returned 1 [0218.613] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.613] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0218.613] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.613] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.613] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.613] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0218.613] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.614] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x9df [0218.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9e7) returned 0x25f580 [0218.614] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x9df, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x9df, lpOverlapped=0x0) returned 1 [0218.615] CloseHandle (hObject=0xe0) returned 1 [0218.615] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0218.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.616] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.616] GetTickCount () returned 0x46383 [0218.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.617] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.617] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619\\....\\temporaryfile")) returned 0 [0218.618] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619\\temporaryfile")) returned 1 [0218.619] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.619] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.619] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.619] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.619] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.619] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.619] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.619] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619\\temporaryfile")) returned 1 [0218.619] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x873fe760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x873fe760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x873fe760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.619] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.619] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287619" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287619")) returned 1 [0218.620] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 0 [0218.620] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.620] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x9e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x9e8, lpOverlapped=0x0) returned 1 [0218.621] CloseHandle (hObject=0xe0) returned 1 [0218.622] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.622] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x10af1 [0218.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10af9) returned 0x2b4a70 [0218.623] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x10af1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x10af1, lpOverlapped=0x0) returned 1 [0218.624] CloseHandle (hObject=0xe0) returned 1 [0218.624] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm")) returned 1 [0218.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.625] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.625] GetTickCount () returned 0x46392 [0218.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.626] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287634\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287634\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287634\\....\\temporaryfile")) returned 0 [0218.626] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287634\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287634\\temporaryfile")) returned 1 [0218.627] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287634\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874248c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874248c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874248c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.628] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874248c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874248c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874248c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.628] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874248c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874248c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874248c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.628] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287634\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874248c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874248c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874248c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.628] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874248c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874248c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874248c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.628] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874248c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874248c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874248c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.628] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.628] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287634\\temporaryfile")) returned 1 [0218.628] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874248c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874248c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874248c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.628] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.628] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287634" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287634")) returned 1 [0218.628] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 0 [0218.630] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.631] WriteFile (in: hFile=0xe0, lpBuffer=0x2c5580*, nNumberOfBytesToWrite=0x10af8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c5580*, lpNumberOfBytesWritten=0x18fdb8*=0x10af8, lpOverlapped=0x0) returned 1 [0218.633] CloseHandle (hObject=0xe0) returned 1 [0218.633] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.634] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1d2 [0218.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1da) returned 0x28f1f8 [0218.634] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1d2, lpOverlapped=0x0) returned 1 [0218.639] CloseHandle (hObject=0xe0) returned 1 [0218.639] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf")) returned 1 [0218.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.639] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.640] GetTickCount () returned 0x463a2 [0218.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.640] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287650\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287650\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287650\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287650\\....\\temporaryfile")) returned 0 [0218.641] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287650\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287650\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287650\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287650\\temporaryfile")) returned 1 [0218.642] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287650\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8744aa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8744aa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8744aa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.642] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8744aa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8744aa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8744aa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.642] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8744aa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8744aa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8744aa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.642] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287650\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8744aa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8744aa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8744aa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.642] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8744aa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8744aa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8744aa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.642] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8744aa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8744aa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8744aa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.642] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.642] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287650\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287650\\temporaryfile")) returned 1 [0218.642] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8744aa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8744aa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8744aa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.642] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.642] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287650" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287650")) returned 1 [0218.642] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 0 [0218.643] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.643] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1d8, lpOverlapped=0x0) returned 1 [0218.645] CloseHandle (hObject=0xe0) returned 1 [0218.646] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.681] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4c45 [0218.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c4d) returned 0x2b4a70 [0218.682] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4c45, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4c45, lpOverlapped=0x0) returned 1 [0218.683] CloseHandle (hObject=0xe0) returned 1 [0218.683] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0218.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.684] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.684] GetTickCount () returned 0x463d1 [0218.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.685] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697\\....\\temporaryfile")) returned 0 [0218.685] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697\\temporaryfile")) returned 1 [0218.686] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.686] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.686] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.686] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.686] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.687] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.687] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.687] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697\\temporaryfile")) returned 1 [0218.690] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.690] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.690] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697")) returned 1 [0218.690] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 0 [0218.691] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.691] WriteFile (in: hFile=0xe0, lpBuffer=0x2b96d0*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b96d0*, lpNumberOfBytesWritten=0x18fdb8*=0x4c50, lpOverlapped=0x0) returned 1 [0218.692] CloseHandle (hObject=0xe0) returned 1 [0218.692] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.692] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0218.693] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.693] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5abe1b90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5abe1b90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x5abe1b90, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256210 [0218.694] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.694] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6c9 [0218.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6d1) returned 0x25f580 [0218.694] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x6c9, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x6c9, lpOverlapped=0x0) returned 1 [0218.696] CloseHandle (hObject=0xe0) returned 1 [0218.696] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0218.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.697] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.697] GetTickCount () returned 0x463d1 [0218.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.697] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697\\....\\temporaryfile")) returned 0 [0218.698] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697\\temporaryfile")) returned 1 [0218.699] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.699] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.699] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.699] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.699] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.700] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.700] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.700] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697\\temporaryfile")) returned 1 [0218.700] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874bce40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874bce40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874bce40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.700] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.700] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287697" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287697")) returned 1 [0218.700] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 0 [0218.700] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.701] WriteFile (in: hFile=0xe0, lpBuffer=0x25fc68*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25fc68*, lpNumberOfBytesWritten=0x18fdb8*=0x6d0, lpOverlapped=0x0) returned 1 [0218.702] CloseHandle (hObject=0xe0) returned 1 [0218.702] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.702] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe232 [0218.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe23a) returned 0x2b4a70 [0218.702] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xe232, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xe232, lpOverlapped=0x0) returned 1 [0218.704] CloseHandle (hObject=0xe0) returned 1 [0218.704] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm")) returned 1 [0218.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.705] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.705] GetTickCount () returned 0x463e0 [0218.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.706] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287712\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287712\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287712\\....\\temporaryfile")) returned 0 [0218.707] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287712\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287712\\temporaryfile")) returned 1 [0218.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287712\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874e2fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874e2fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874e2fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.708] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874e2fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874e2fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874e2fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.708] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874e2fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874e2fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874e2fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287712\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874e2fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874e2fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874e2fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.708] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874e2fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874e2fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874e2fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.708] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874e2fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874e2fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874e2fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.708] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.708] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287712\\temporaryfile")) returned 1 [0218.708] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874e2fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x874e2fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x874e2fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.708] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.708] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287712" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287712")) returned 1 [0218.709] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 0 [0218.710] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.724] WriteFile (in: hFile=0xe0, lpBuffer=0x2c2cc0*, nNumberOfBytesToWrite=0xe238, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c2cc0*, lpNumberOfBytesWritten=0x18fdb8*=0xe238, lpOverlapped=0x0) returned 1 [0218.726] CloseHandle (hObject=0xe0) returned 1 [0218.726] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.727] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x271 [0218.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x279) returned 0x259e70 [0218.727] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x271, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x271, lpOverlapped=0x0) returned 1 [0218.728] CloseHandle (hObject=0xe0) returned 1 [0218.728] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf")) returned 1 [0218.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.729] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.729] GetTickCount () returned 0x463f0 [0218.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.730] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287728\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287728\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287728\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287728\\....\\temporaryfile")) returned 0 [0218.730] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287728\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287728\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287728\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287728\\temporaryfile")) returned 1 [0218.731] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287728\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87509100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87509100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87509100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.732] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87509100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87509100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87509100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.732] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87509100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87509100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87509100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.732] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287728\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87509100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87509100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87509100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.732] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87509100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87509100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87509100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.732] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87509100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87509100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87509100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.732] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.732] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287728\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287728\\temporaryfile")) returned 1 [0218.732] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87509100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87509100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87509100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.732] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.732] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287728" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287728")) returned 1 [0218.732] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 0 [0218.733] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.733] WriteFile (in: hFile=0xe0, lpBuffer=0x25a100*, nNumberOfBytesToWrite=0x278, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25a100*, lpNumberOfBytesWritten=0x18fdb8*=0x278, lpOverlapped=0x0) returned 1 [0218.734] CloseHandle (hObject=0xe0) returned 1 [0218.734] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.735] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x82c7 [0218.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x82cf) returned 0x2b4a70 [0218.735] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x82c7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x82c7, lpOverlapped=0x0) returned 1 [0218.737] CloseHandle (hObject=0xe0) returned 1 [0218.737] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0218.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.738] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.738] GetTickCount () returned 0x463ff [0218.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.738] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287743\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287743\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287743\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287743\\....\\temporaryfile")) returned 0 [0218.739] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287743\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287743\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287743\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287743\\temporaryfile")) returned 1 [0218.740] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287743\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8752f260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8752f260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8752f260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.740] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8752f260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8752f260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8752f260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.740] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8752f260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8752f260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8752f260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.740] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287743\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8752f260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8752f260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8752f260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.740] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8752f260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8752f260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8752f260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.741] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8752f260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8752f260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8752f260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.741] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.741] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287743\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287743\\temporaryfile")) returned 1 [0218.741] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8752f260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8752f260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8752f260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.741] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.741] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287743" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287743")) returned 1 [0218.741] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 0 [0218.742] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.742] WriteFile (in: hFile=0xe0, lpBuffer=0x2bcd50*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bcd50*, lpNumberOfBytesWritten=0x18fdb8*=0x82d0, lpOverlapped=0x0) returned 1 [0218.744] CloseHandle (hObject=0xe0) returned 1 [0218.744] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.744] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8752f260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8752f260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0218.744] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.744] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.744] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.745] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0218.745] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.746] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x68b [0218.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x693) returned 0x259e70 [0218.746] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x68b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x68b, lpOverlapped=0x0) returned 1 [0218.747] CloseHandle (hObject=0xe0) returned 1 [0218.747] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0218.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.748] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.748] GetTickCount () returned 0x4640f [0218.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.749] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759\\....\\temporaryfile")) returned 0 [0218.749] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759\\temporaryfile")) returned 1 [0218.750] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.750] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.751] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.751] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.751] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.751] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.751] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.751] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759\\temporaryfile")) returned 1 [0218.751] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.751] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.751] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759")) returned 1 [0218.751] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 0 [0218.752] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.752] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x690, lpOverlapped=0x0) returned 1 [0218.753] CloseHandle (hObject=0xe0) returned 1 [0218.753] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.754] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbfed [0218.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbff5) returned 0x2b4a70 [0218.754] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xbfed, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xbfed, lpOverlapped=0x0) returned 1 [0218.756] CloseHandle (hObject=0xe0) returned 1 [0218.756] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm")) returned 1 [0218.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.757] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.757] GetTickCount () returned 0x4640f [0218.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.758] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759\\....\\temporaryfile")) returned 0 [0218.758] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759\\temporaryfile")) returned 1 [0218.759] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.759] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.759] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.760] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.760] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.760] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.760] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.760] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759\\temporaryfile")) returned 1 [0218.760] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875553c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875553c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875553c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.760] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.760] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287759" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287759")) returned 1 [0218.760] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 0 [0218.761] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.763] WriteFile (in: hFile=0xe0, lpBuffer=0x2c0a78*, nNumberOfBytesToWrite=0xbff8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c0a78*, lpNumberOfBytesWritten=0x18fdb8*=0xbff8, lpOverlapped=0x0) returned 1 [0218.764] CloseHandle (hObject=0xe0) returned 1 [0218.764] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.765] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x242 [0218.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24a) returned 0x28f1f8 [0218.766] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x242, lpOverlapped=0x0) returned 1 [0218.767] CloseHandle (hObject=0xe0) returned 1 [0218.767] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf")) returned 1 [0218.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.768] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.768] GetTickCount () returned 0x4641f [0218.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.768] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775\\....\\temporaryfile")) returned 0 [0218.769] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775\\temporaryfile")) returned 1 [0218.770] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.770] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.770] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.770] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.770] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.770] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.770] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.770] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775\\temporaryfile")) returned 1 [0218.771] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.771] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.771] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775")) returned 1 [0218.771] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 0 [0218.771] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.772] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x248, lpOverlapped=0x0) returned 1 [0218.773] CloseHandle (hObject=0xe0) returned 1 [0218.773] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.774] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x47cc [0218.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x47d4) returned 0x2b4a70 [0218.774] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x47cc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x47cc, lpOverlapped=0x0) returned 1 [0218.775] CloseHandle (hObject=0xe0) returned 1 [0218.775] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0218.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.776] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.776] GetTickCount () returned 0x4641f [0218.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0218.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.777] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.777] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775\\....\\temporaryfile")) returned 0 [0218.778] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775\\temporaryfile")) returned 1 [0218.779] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875a1680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875a1680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.779] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875a1680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875a1680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.779] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.779] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.779] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.779] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.779] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.779] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775\\temporaryfile")) returned 1 [0218.779] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8757b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8757b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8757b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.780] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.780] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287775" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287775")) returned 1 [0218.780] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 0 [0218.780] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.781] WriteFile (in: hFile=0xe0, lpBuffer=0x2b9258*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b9258*, lpNumberOfBytesWritten=0x18fdb8*=0x47d0, lpOverlapped=0x0) returned 1 [0218.782] CloseHandle (hObject=0xe0) returned 1 [0218.782] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.782] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x875a1680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875a1680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0218.782] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.782] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.783] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.783] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0218.783] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.783] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x137f [0218.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1387) returned 0x25b528 [0218.783] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x137f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x137f, lpOverlapped=0x0) returned 1 [0218.785] CloseHandle (hObject=0xe0) returned 1 [0218.785] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0218.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.786] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.786] GetTickCount () returned 0x4642e [0218.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.787] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287790\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287790\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.787] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287790\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287790\\....\\temporaryfile")) returned 0 [0218.787] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287790\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287790\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287790\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287790\\temporaryfile")) returned 1 [0218.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287790\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875a1680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875a1680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875a1680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.789] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875a1680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875a1680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875a1680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.789] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875a1680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875a1680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875a1680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.789] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287790\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875a1680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875a1680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875a1680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.789] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875a1680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875a1680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875a1680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.789] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875a1680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875a1680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875a1680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.789] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287790\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287790\\temporaryfile")) returned 1 [0218.789] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875a1680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875a1680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875a1680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.789] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287790" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287790")) returned 1 [0218.789] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 0 [0218.790] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.790] WriteFile (in: hFile=0xe0, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdb8*=0x1388, lpOverlapped=0x0) returned 1 [0218.791] CloseHandle (hObject=0xe0) returned 1 [0218.791] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.792] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x19e14 [0218.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19e1c) returned 0x2b4a70 [0218.792] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x19e14, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x19e14, lpOverlapped=0x0) returned 1 [0218.794] CloseHandle (hObject=0xe0) returned 1 [0218.794] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm")) returned 1 [0218.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.795] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.795] GetTickCount () returned 0x4643e [0218.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.796] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.796] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806\\....\\temporaryfile")) returned 0 [0218.796] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806\\temporaryfile")) returned 1 [0218.798] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.798] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.798] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.798] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.798] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.798] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.798] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806\\temporaryfile")) returned 1 [0218.798] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.798] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806")) returned 1 [0218.798] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 0 [0218.800] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.802] WriteFile (in: hFile=0xe0, lpBuffer=0x2ce8a0*, nNumberOfBytesToWrite=0x19e18, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ce8a0*, lpNumberOfBytesWritten=0x18fdb8*=0x19e18, lpOverlapped=0x0) returned 1 [0218.804] CloseHandle (hObject=0xe0) returned 1 [0218.804] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.805] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x22b [0218.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x233) returned 0x28f1f8 [0218.805] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x22b, lpOverlapped=0x0) returned 1 [0218.806] CloseHandle (hObject=0xe0) returned 1 [0218.806] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf")) returned 1 [0218.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.807] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.807] GetTickCount () returned 0x4643e [0218.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.807] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.808] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806\\....\\temporaryfile")) returned 0 [0218.808] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806\\temporaryfile")) returned 1 [0218.809] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.809] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.809] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.809] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.809] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.809] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.810] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.810] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806\\temporaryfile")) returned 1 [0218.810] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875c77e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875c77e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875c77e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.810] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.810] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287806" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287806")) returned 1 [0218.810] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 0 [0218.810] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.811] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x230, lpOverlapped=0x0) returned 1 [0218.812] CloseHandle (hObject=0xe0) returned 1 [0218.812] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.812] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xad0e [0218.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xad16) returned 0x2b4a70 [0218.812] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xad0e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xad0e, lpOverlapped=0x0) returned 1 [0218.814] CloseHandle (hObject=0xe0) returned 1 [0218.814] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0218.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.815] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.815] GetTickCount () returned 0x4644d [0218.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.816] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287821\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287821\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.816] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287821\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287821\\....\\temporaryfile")) returned 0 [0218.816] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287821\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287821\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287821\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287821\\temporaryfile")) returned 1 [0218.818] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287821\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875ed940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875ed940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875ed940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.818] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875ed940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875ed940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875ed940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.818] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875ed940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875ed940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875ed940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.818] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287821\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875ed940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875ed940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875ed940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.818] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875ed940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875ed940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875ed940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.818] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875ed940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875ed940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875ed940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.818] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.818] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287821\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287821\\temporaryfile")) returned 1 [0218.818] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x875ed940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x875ed940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875ed940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.818] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.818] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287821" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287821")) returned 1 [0218.818] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 0 [0218.819] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.820] WriteFile (in: hFile=0xe0, lpBuffer=0x2bf798*, nNumberOfBytesToWrite=0xad18, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bf798*, lpNumberOfBytesWritten=0x18fdb8*=0xad18, lpOverlapped=0x0) returned 1 [0218.821] CloseHandle (hObject=0xe0) returned 1 [0218.821] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.821] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x875ed940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x875ed940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0218.822] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.822] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5ad387f0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.822] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5ad387f0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.822] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x5ad387f0, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256198 [0218.822] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.823] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa6c [0218.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa74) returned 0x25f580 [0218.823] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xa6c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xa6c, lpOverlapped=0x0) returned 1 [0218.824] CloseHandle (hObject=0xe0) returned 1 [0218.824] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0218.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.825] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.825] GetTickCount () returned 0x4645d [0218.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0218.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.826] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837\\....\\temporaryfile")) returned 0 [0218.826] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837\\temporaryfile")) returned 1 [0218.827] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.828] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.828] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.828] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.828] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.828] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.828] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.828] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837\\temporaryfile")) returned 1 [0218.828] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.828] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.828] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837")) returned 1 [0218.828] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 0 [0218.829] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.829] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xa70, lpOverlapped=0x0) returned 1 [0218.830] CloseHandle (hObject=0xe0) returned 1 [0218.830] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.830] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa5d5 [0218.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa5dd) returned 0x2b4a70 [0218.831] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xa5d5, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xa5d5, lpOverlapped=0x0) returned 1 [0218.833] CloseHandle (hObject=0xe0) returned 1 [0218.833] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0218.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.834] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.834] GetTickCount () returned 0x4645d [0218.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0218.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.835] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837\\....\\temporaryfile")) returned 0 [0218.836] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837\\temporaryfile")) returned 1 [0218.837] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.837] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.837] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.837] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.837] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.837] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.837] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.837] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837\\temporaryfile")) returned 1 [0218.837] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87613aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87613aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87613aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.837] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.837] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287837" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287837")) returned 1 [0218.838] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 0 [0218.838] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.844] WriteFile (in: hFile=0xe0, lpBuffer=0x2bf060*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bf060*, lpNumberOfBytesWritten=0x18fdb8*=0xa5e0, lpOverlapped=0x0) returned 1 [0218.845] CloseHandle (hObject=0xe0) returned 1 [0218.845] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.846] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x101cc [0218.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x101d4) returned 0x2b4a70 [0218.846] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x101cc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x101cc, lpOverlapped=0x0) returned 1 [0218.848] CloseHandle (hObject=0xe0) returned 1 [0218.848] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm")) returned 1 [0218.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0218.849] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.849] GetTickCount () returned 0x4646d [0218.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0218.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.850] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287853\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287853\\...."), lpSecurityAttributes=0x256210) returned 1 [0218.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287853\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287853\\....\\temporaryfile")) returned 0 [0218.850] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287853\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287853\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287853\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287853\\temporaryfile")) returned 1 [0218.851] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287853\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87639c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87639c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87639c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.851] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87639c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87639c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87639c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.852] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87639c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87639c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87639c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.852] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287853\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87639c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87639c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87639c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.852] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87639c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87639c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87639c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.852] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87639c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87639c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87639c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.852] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.852] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287853\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287853\\temporaryfile")) returned 1 [0218.852] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87639c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87639c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87639c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.852] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.852] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287853" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287853")) returned 1 [0218.852] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 0 [0218.853] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.854] WriteFile (in: hFile=0xe0, lpBuffer=0x2c4c58*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c4c58*, lpNumberOfBytesWritten=0x18fdb8*=0x101d0, lpOverlapped=0x0) returned 1 [0218.856] CloseHandle (hObject=0xe0) returned 1 [0218.856] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.857] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1a1 [0218.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a9) returned 0x28f1f8 [0218.857] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x1a1, lpOverlapped=0x0) returned 1 [0218.858] CloseHandle (hObject=0xe0) returned 1 [0218.858] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 1 [0218.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.859] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.859] GetTickCount () returned 0x4647c [0218.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0218.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.859] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868\\....\\temporaryfile")) returned 0 [0218.860] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868\\temporaryfile")) returned 1 [0218.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.861] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.861] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.861] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.861] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.861] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.861] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868\\temporaryfile")) returned 1 [0218.862] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.862] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868")) returned 1 [0218.862] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 0 [0218.862] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.862] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x1a8, lpOverlapped=0x0) returned 1 [0218.863] CloseHandle (hObject=0xe0) returned 1 [0218.863] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.863] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0218.864] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.864] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.864] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.864] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x5a71ef90, dwReserved1=0x1d301bf, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0218.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256198 [0218.864] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.865] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x623 [0218.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x62b) returned 0x259e70 [0218.865] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x623, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x623, lpOverlapped=0x0) returned 1 [0218.867] CloseHandle (hObject=0xe0) returned 1 [0218.867] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0218.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.868] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.868] GetTickCount () returned 0x4647c [0218.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.868] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868\\....\\temporaryfile")) returned 0 [0218.869] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868\\temporaryfile")) returned 1 [0218.870] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.870] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0218.870] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.870] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.870] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.870] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.870] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.870] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868\\temporaryfile")) returned 1 [0218.871] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8765fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8765fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8765fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.871] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.871] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287868" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287868")) returned 1 [0218.871] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 0 [0218.872] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.872] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x628, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x628, lpOverlapped=0x0) returned 1 [0218.873] CloseHandle (hObject=0xe0) returned 1 [0218.873] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.874] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x75da [0218.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x75e2) returned 0x2b4a70 [0218.874] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x75da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x75da, lpOverlapped=0x0) returned 1 [0218.876] CloseHandle (hObject=0xe0) returned 1 [0218.876] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0218.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.877] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.877] GetTickCount () returned 0x4648c [0218.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.878] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287884\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287884\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287884\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287884\\....\\temporaryfile")) returned 0 [0218.878] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287884\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287884\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287884\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287884\\temporaryfile")) returned 1 [0218.879] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287884\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87685ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87685ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87685ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.879] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87685ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87685ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87685ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.880] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87685ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87685ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87685ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287884\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87685ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87685ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87685ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.880] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87685ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87685ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87685ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.880] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87685ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87685ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87685ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.880] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.880] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287884\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287884\\temporaryfile")) returned 1 [0218.880] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87685ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87685ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87685ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.880] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.880] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287884" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287884")) returned 1 [0218.880] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 0 [0218.881] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.883] WriteFile (in: hFile=0xe0, lpBuffer=0x2bc068*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bc068*, lpNumberOfBytesWritten=0x18fdb8*=0x75e0, lpOverlapped=0x0) returned 1 [0218.884] CloseHandle (hObject=0xe0) returned 1 [0218.884] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.885] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbfc6 [0218.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbfce) returned 0x2b4a70 [0218.885] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xbfc6, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xbfc6, lpOverlapped=0x0) returned 1 [0218.886] CloseHandle (hObject=0xe0) returned 1 [0218.886] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 1 [0218.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.888] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.888] GetTickCount () returned 0x4649b [0218.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.888] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899\\....\\temporaryfile")) returned 0 [0218.889] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899\\temporaryfile")) returned 1 [0218.890] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.890] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.890] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.890] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.890] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.890] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.890] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.890] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899\\temporaryfile")) returned 1 [0218.890] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.890] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.891] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899")) returned 1 [0218.891] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 0 [0218.892] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.893] WriteFile (in: hFile=0xe0, lpBuffer=0x2c0a50*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c0a50*, lpNumberOfBytesWritten=0x18fdb8*=0xbfd0, lpOverlapped=0x0) returned 1 [0218.895] CloseHandle (hObject=0xe0) returned 1 [0218.895] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.895] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2ab [0218.895] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b3) returned 0x259e70 [0218.895] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x2ab, lpOverlapped=0x0) returned 1 [0218.896] CloseHandle (hObject=0xe0) returned 1 [0218.896] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf")) returned 1 [0218.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0218.897] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.897] GetTickCount () returned 0x4649b [0218.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0218.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0218.898] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899\\...."), lpSecurityAttributes=0x256198) returned 1 [0218.898] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899\\....\\temporaryfile")) returned 0 [0218.898] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899\\temporaryfile")) returned 1 [0218.900] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.900] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.900] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.900] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0218.900] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.900] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.900] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0218.900] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899\\temporaryfile")) returned 1 [0218.900] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x876ac020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.900] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.900] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287899" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287899")) returned 1 [0218.900] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 0 [0218.901] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0218.901] WriteFile (in: hFile=0xe0, lpBuffer=0x25a138*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25a138*, lpNumberOfBytesWritten=0x18fdb8*=0x2b0, lpOverlapped=0x0) returned 1 [0218.902] CloseHandle (hObject=0xe0) returned 1 [0218.902] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.902] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x876ac020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x876ac020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0218.903] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.903] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0218.903] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0218.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0218.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName="ARFR", cAlternateFileName="")) returned 1 [0218.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName="ENES", cAlternateFileName="")) returned 1 [0218.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName="ENFR", cAlternateFileName="")) returned 1 [0218.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName="ESEN", cAlternateFileName="")) returned 1 [0218.905] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName="FRAR", cAlternateFileName="")) returned 1 [0218.905] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName="FREN", cAlternateFileName="")) returned 1 [0218.905] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0218.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x2561c8 [0218.905] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0218.906] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x205b0b [0218.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x205b13) returned 0x2650020 [0218.906] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x205b0b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x205b0b, lpOverlapped=0x0) returned 1 [0218.962] CloseHandle (hObject=0xdc) returned 1 [0218.962] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex")) returned 1 [0218.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0218.963] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0218.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0218.963] GetTickCount () returned 0x464da [0218.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0218.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0218.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0218.964] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287962\\...."), lpSecurityAttributes=0x256228) returned 1 [0218.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287962\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287962\\....\\temporaryfile")) returned 0 [0218.965] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287962\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287962\\temporaryfile")) returned 1 [0218.966] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287962\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x877445a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8776a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8776a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0218.966] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x877445a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8776a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8776a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.966] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x877445a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x877445a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x877445a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0218.966] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287962\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x877445a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x877445a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x877445a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0218.966] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x877445a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x877445a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x877445a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.966] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x877445a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x877445a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x877445a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0218.966] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0218.966] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287962\\temporaryfile")) returned 1 [0218.966] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x877445a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x877445a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x877445a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0218.967] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0218.967] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18287962" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18287962")) returned 1 [0218.967] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 0 [0219.061] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0219.062] WriteFile (in: hFile=0xdc, lpBuffer=0x2a70028*, nNumberOfBytesToWrite=0x205b10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a70028*, lpNumberOfBytesWritten=0x18fdd8*=0x205b10, lpOverlapped=0x0) returned 1 [0219.110] CloseHandle (hObject=0xdc) returned 1 [0219.129] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0219.129] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x600 [0219.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x608) returned 0x259e70 [0219.129] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x600, lpOverlapped=0x0) returned 1 [0219.131] CloseHandle (hObject=0xdc) returned 1 [0219.131] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex")) returned 1 [0219.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0219.132] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.132] GetTickCount () returned 0x46585 [0219.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0219.133] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288133\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288133\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0219.133] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288133\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288133\\....\\temporaryfile")) returned 0 [0219.133] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288133\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288133\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288133\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288133\\temporaryfile")) returned 1 [0219.135] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288133\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x878e74c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x878e74c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x878e74c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.135] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x878e74c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x878e74c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x878e74c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.135] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x878e74c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x878e74c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x878e74c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.135] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288133\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x878e74c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x878e74c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x878e74c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.135] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x878e74c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x878e74c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x878e74c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.135] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x878e74c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x878e74c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x878e74c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.135] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.135] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288133\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288133\\temporaryfile")) returned 1 [0219.135] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x878e74c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x878e74c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x878e74c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.136] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.136] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288133" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288133")) returned 1 [0219.136] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 0 [0219.136] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0219.137] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x608, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x608, lpOverlapped=0x0) returned 1 [0219.138] CloseHandle (hObject=0xdc) returned 1 [0219.138] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0219.139] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2b990 [0219.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b998) returned 0x2b4a70 [0219.139] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2b990, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2b990, lpOverlapped=0x0) returned 1 [0219.142] CloseHandle (hObject=0xdc) returned 1 [0219.142] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll")) returned 1 [0219.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0219.144] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.144] GetTickCount () returned 0x46595 [0219.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0219.144] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288149\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288149\\...."), lpSecurityAttributes=0x256228) returned 1 [0219.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288149\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288149\\....\\temporaryfile")) returned 0 [0219.145] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288149\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288149\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288149\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288149\\temporaryfile")) returned 1 [0219.146] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288149\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8790d620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8790d620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8790d620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.146] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8790d620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8790d620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8790d620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.146] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8790d620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8790d620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8790d620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.146] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288149\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8790d620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8790d620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8790d620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.147] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8790d620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8790d620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8790d620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.147] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8790d620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8790d620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8790d620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.147] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.147] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288149\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288149\\temporaryfile")) returned 1 [0219.147] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8790d620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8790d620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8790d620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.147] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.147] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288149" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288149")) returned 1 [0219.147] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 0 [0219.150] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0219.151] WriteFile (in: hFile=0xdc, lpBuffer=0x2e0418*, nNumberOfBytesToWrite=0x2b998, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e0418*, lpNumberOfBytesWritten=0x18fdd8*=0x2b998, lpOverlapped=0x0) returned 1 [0219.154] CloseHandle (hObject=0xdc) returned 1 [0219.154] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0219.157] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x40f70 [0219.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40f78) returned 0x2b4a70 [0219.157] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x40f70, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x40f70, lpOverlapped=0x0) returned 1 [0219.161] CloseHandle (hObject=0xdc) returned 1 [0219.161] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll")) returned 1 [0219.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0219.164] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.164] GetTickCount () returned 0x465a5 [0219.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0219.164] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288165\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0219.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288165\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288165\\....\\temporaryfile")) returned 0 [0219.165] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288165\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288165\\temporaryfile")) returned 1 [0219.166] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288165\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87933780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87933780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87933780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.166] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87933780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87933780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87933780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.166] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87933780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87933780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87933780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.166] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288165\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87933780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87933780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87933780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.166] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87933780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87933780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87933780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.166] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87933780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87933780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87933780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.166] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.167] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288165\\temporaryfile")) returned 1 [0219.167] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87933780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87933780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87933780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.167] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.167] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288165" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288165")) returned 1 [0219.167] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 0 [0219.171] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0219.172] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x40f78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x40f78, lpOverlapped=0x0) returned 1 [0219.176] CloseHandle (hObject=0xdc) returned 1 [0219.176] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0219.177] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x11390 [0219.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11398) returned 0x2b4a70 [0219.178] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x11390, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x11390, lpOverlapped=0x0) returned 1 [0219.179] CloseHandle (hObject=0xdc) returned 1 [0219.179] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll")) returned 1 [0219.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0219.181] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.181] GetTickCount () returned 0x465b4 [0219.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0219.181] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288180\\...."), lpSecurityAttributes=0x256228) returned 1 [0219.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288180\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288180\\....\\temporaryfile")) returned 0 [0219.182] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288180\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288180\\temporaryfile")) returned 1 [0219.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288180\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x879598e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x879598e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x879598e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x879598e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x879598e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x879598e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x879598e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x879598e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x879598e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288180\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x879598e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x879598e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x879598e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.183] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x879598e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x879598e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x879598e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.183] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x879598e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x879598e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x879598e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.183] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288180\\temporaryfile")) returned 1 [0219.184] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x879598e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x879598e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x879598e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.184] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288180" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288180")) returned 1 [0219.184] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 0 [0219.185] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0219.186] WriteFile (in: hFile=0xdc, lpBuffer=0x2c5e18*, nNumberOfBytesToWrite=0x11398, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c5e18*, lpNumberOfBytesWritten=0x18fdd8*=0x11398, lpOverlapped=0x0) returned 1 [0219.188] CloseHandle (hObject=0xdc) returned 1 [0219.188] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0219.188] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x36000 [0219.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36008) returned 0x2b4a70 [0219.188] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x36000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x36000, lpOverlapped=0x0) returned 1 [0219.190] CloseHandle (hObject=0xdc) returned 1 [0219.191] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll")) returned 1 [0219.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0219.193] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.193] GetTickCount () returned 0x465c4 [0219.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0219.193] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288196\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0219.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288196\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288196\\....\\temporaryfile")) returned 0 [0219.194] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288196\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288196\\temporaryfile")) returned 1 [0219.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288196\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8797fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8797fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8797fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8797fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8797fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8797fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8797fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8797fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8797fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288196\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8797fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8797fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8797fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.195] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8797fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8797fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8797fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.195] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8797fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8797fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8797fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.195] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.195] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288196\\temporaryfile")) returned 1 [0219.196] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8797fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8797fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8797fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.196] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.196] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288196" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288196")) returned 1 [0219.196] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 0 [0219.200] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0219.200] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x36008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x36008, lpOverlapped=0x0) returned 1 [0219.204] CloseHandle (hObject=0xdc) returned 1 [0219.204] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0219.204] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x879a5ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x879a5ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0219.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0219.204] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7562dd0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7562dd0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0219.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x7562dd0, dwReserved1=0x1d301bf, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0219.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256228 [0219.205] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.205] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x195018 [0219.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x195020) returned 0x2650020 [0219.206] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x195018, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x195018, lpOverlapped=0x0) returned 1 [0219.246] CloseHandle (hObject=0xe0) returned 1 [0219.246] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its")) returned 1 [0219.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0219.252] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.252] GetTickCount () returned 0x46602 [0219.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0219.253] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288258\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0219.253] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288258\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288258\\....\\temporaryfile")) returned 0 [0219.253] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288258\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288258\\temporaryfile")) returned 1 [0219.254] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288258\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87a17fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87a17fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87a17fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.255] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87a17fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87a17fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87a17fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0219.255] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87a17fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87a17fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87a17fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288258\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87a17fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87a17fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87a17fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0219.255] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87a17fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87a17fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87a17fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.255] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87a17fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87a17fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87a17fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.255] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0219.255] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288258\\temporaryfile")) returned 1 [0219.255] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87a17fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87a17fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87a17fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.255] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.255] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288258" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288258")) returned 1 [0219.255] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 0 [0219.330] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.331] WriteFile (in: hFile=0xe0, lpBuffer=0x2990028*, nNumberOfBytesToWrite=0x195020, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2990028*, lpNumberOfBytesWritten=0x18fdb8*=0x195020, lpOverlapped=0x0) returned 1 [0219.359] CloseHandle (hObject=0xe0) returned 1 [0219.373] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.373] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87ad66a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87ad66a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0219.374] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.374] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54ce0b0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.375] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54ce0b0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0219.375] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x54ce0b0, dwReserved1=0x1d301bf, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0219.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256228 [0219.375] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.376] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xeed1e [0219.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xeed26) returned 0x2250020 [0219.376] ReadFile (in: hFile=0xe0, lpBuffer=0x2250028, nNumberOfBytesToRead=0xeed1e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdd0*=0xeed1e, lpOverlapped=0x0) returned 1 [0219.404] CloseHandle (hObject=0xe0) returned 1 [0219.404] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 1 [0219.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0219.411] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.411] GetTickCount () returned 0x4669e [0219.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0219.412] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288414\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288414\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0219.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288414\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288414\\....\\temporaryfile")) returned 0 [0219.413] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288414\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288414\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288414\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288414\\temporaryfile")) returned 1 [0219.414] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288414\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87b94d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87b94d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87b94d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.414] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87b94d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87b94d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87b94d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0219.414] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87b94d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87b94d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87b94d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.414] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288414\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87b94d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87b94d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87b94d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0219.414] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87b94d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87b94d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87b94d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.415] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87b94d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87b94d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87b94d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.415] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0219.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288414\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288414\\temporaryfile")) returned 1 [0219.415] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87b94d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87b94d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87b94d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.415] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288414" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288414")) returned 1 [0219.415] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 0 [0219.456] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.457] WriteFile (in: hFile=0xe0, lpBuffer=0x2740028*, nNumberOfBytesToWrite=0xeed28, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2740028*, lpNumberOfBytesWritten=0x18fdb8*=0xeed28, lpOverlapped=0x0) returned 1 [0219.471] CloseHandle (hObject=0xe0) returned 1 [0219.479] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.479] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87c071a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87c071a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0219.479] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.479] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7562dd0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7562dd0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0219.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x7562dd0, dwReserved1=0x1d301bf, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0219.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256228 [0219.480] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.480] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe64da [0219.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe64e2) returned 0x2250020 [0219.480] ReadFile (in: hFile=0xe0, lpBuffer=0x2250028, nNumberOfBytesToRead=0xe64da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdd0*=0xe64da, lpOverlapped=0x0) returned 1 [0219.498] CloseHandle (hObject=0xe0) returned 1 [0219.498] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 1 [0219.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0219.506] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.506] GetTickCount () returned 0x466fc [0219.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0219.512] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288508\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0219.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288508\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288508\\....\\temporaryfile")) returned 0 [0219.512] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288508\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288508\\temporaryfile")) returned 1 [0219.514] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288508\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87c9f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87c9f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87c9f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.514] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87c9f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87c9f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87c9f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0219.514] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87c9f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87c9f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87c9f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.514] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288508\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87c9f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87c9f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87c9f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0219.514] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87c9f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87c9f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87c9f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.514] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87c9f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87c9f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87c9f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.514] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0219.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288508\\temporaryfile")) returned 1 [0219.514] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87c9f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87c9f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87c9f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.514] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288508" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288508")) returned 1 [0219.514] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 0 [0219.563] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.564] WriteFile (in: hFile=0xe0, lpBuffer=0x2740028*, nNumberOfBytesToWrite=0xe64e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2740028*, lpNumberOfBytesWritten=0x18fdb8*=0xe64e0, lpOverlapped=0x0) returned 1 [0219.577] CloseHandle (hObject=0xe0) returned 1 [0219.585] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.585] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d11b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87d11b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0219.585] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.586] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.586] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0219.586] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x54a7f50, dwReserved1=0x1d301bf, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0219.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256228 [0219.586] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.586] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x38200 [0219.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x38208) returned 0x2b4a70 [0219.586] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x38200, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x38200, lpOverlapped=0x0) returned 1 [0219.667] CloseHandle (hObject=0xe0) returned 1 [0219.667] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll")) returned 1 [0219.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0219.670] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.670] GetTickCount () returned 0x467a7 [0219.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0219.670] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288679\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288679\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0219.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288679\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288679\\....\\temporaryfile")) returned 0 [0219.671] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288679\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288679\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288679\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288679\\temporaryfile")) returned 1 [0219.672] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288679\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e1c4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e1c4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e1c4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.672] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e1c4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e1c4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e1c4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0219.673] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e1c4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e1c4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e1c4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.673] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288679\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e1c4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e1c4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e1c4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0219.673] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e1c4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e1c4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e1c4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.673] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e1c4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e1c4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e1c4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.673] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0219.673] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288679\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288679\\temporaryfile")) returned 1 [0219.673] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e1c4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e1c4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e1c4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.673] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.673] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288679" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288679")) returned 1 [0219.673] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 0 [0219.677] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.678] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x38208, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x38208, lpOverlapped=0x0) returned 1 [0219.681] CloseHandle (hObject=0xe0) returned 1 [0219.681] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.682] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xff7f2 [0219.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xff7fa) returned 0x2250020 [0219.699] ReadFile (in: hFile=0xe0, lpBuffer=0x2250028, nNumberOfBytesToRead=0xff7f2, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdd0*=0xff7f2, lpOverlapped=0x0) returned 1 [0219.718] CloseHandle (hObject=0xe0) returned 1 [0219.718] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its")) returned 1 [0219.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0219.726] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.726] GetTickCount () returned 0x467d6 [0219.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0219.727] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288726\\...."), lpSecurityAttributes=0x256228) returned 1 [0219.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288726\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288726\\....\\temporaryfile")) returned 0 [0219.727] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288726\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288726\\temporaryfile")) returned 1 [0219.728] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288726\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e8e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e8e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e8e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e8e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e8e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e8e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e8e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e8e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e8e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288726\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e8e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e8e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e8e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0219.729] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e8e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e8e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e8e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.729] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e8e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e8e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e8e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.729] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0219.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288726\\temporaryfile")) returned 1 [0219.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87e8e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87e8e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87e8e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.729] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288726" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288726")) returned 1 [0219.730] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 0 [0219.780] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.781] WriteFile (in: hFile=0xe0, lpBuffer=0x2750028*, nNumberOfBytesToWrite=0xff7f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2750028*, lpNumberOfBytesWritten=0x18fdb8*=0xff7f8, lpOverlapped=0x0) returned 1 [0219.803] CloseHandle (hObject=0xe0) returned 1 [0219.815] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.815] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa5c00 [0219.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa5c08) returned 0x1d70020 [0219.816] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xa5c00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0xa5c00, lpOverlapped=0x0) returned 1 [0219.829] CloseHandle (hObject=0xe0) returned 1 [0219.829] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex")) returned 1 [0219.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0219.834] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.834] GetTickCount () returned 0x46843 [0219.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0219.835] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288835\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288835\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0219.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288835\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288835\\....\\temporaryfile")) returned 0 [0219.836] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288835\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288835\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288835\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288835\\temporaryfile")) returned 1 [0219.837] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288835\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87f992a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87f992a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87f992a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.837] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87f992a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87f992a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87f992a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.837] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87f992a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87f992a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87f992a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.837] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288835\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87f992a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87f992a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87f992a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0219.837] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87f992a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87f992a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87f992a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.837] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87f992a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87f992a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87f992a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.837] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0219.837] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288835\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288835\\temporaryfile")) returned 1 [0219.838] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87f992a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x87f992a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x87f992a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.838] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.838] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288835" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288835")) returned 1 [0219.838] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 0 [0219.876] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.878] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xa5c08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0xa5c08, lpOverlapped=0x0) returned 1 [0219.888] CloseHandle (hObject=0xe0) returned 1 [0219.894] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.894] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8800b6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8800b6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0219.894] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0219.894] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7562dd0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0219.895] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7562dd0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0219.895] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x7562dd0, dwReserved1=0x1d301bf, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0219.895] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256228 [0219.895] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0219.895] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x166bae [0219.895] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x166bb6) returned 0x2650020 [0219.896] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x166bae, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x166bae, lpOverlapped=0x0) returned 1 [0219.930] CloseHandle (hObject=0xe0) returned 1 [0219.930] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its")) returned 1 [0219.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0219.934] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0219.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0219.934] GetTickCount () returned 0x468b1 [0219.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0219.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0219.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0219.934] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288945\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0219.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288945\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288945\\....\\temporaryfile")) returned 0 [0219.935] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288945\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288945\\temporaryfile")) returned 1 [0219.936] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288945\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x880a3c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x880a3c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x880a3c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0219.936] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x880a3c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x880a3c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x880a3c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0219.936] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x880a3c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x880a3c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x880a3c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0219.936] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288945\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x880a3c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x880a3c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x880a3c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0219.936] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x880a3c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x880a3c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x880a3c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.936] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x880a3c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x880a3c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x880a3c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0219.936] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0219.937] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288945\\temporaryfile")) returned 1 [0219.937] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x880a3c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x880a3c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x880a3c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0219.937] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0219.937] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18288945" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18288945")) returned 1 [0219.937] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 0 [0220.030] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0220.031] WriteFile (in: hFile=0xe0, lpBuffer=0x2930028*, nNumberOfBytesToWrite=0x166bb8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2930028*, lpNumberOfBytesWritten=0x18fdb8*=0x166bb8, lpOverlapped=0x0) returned 1 [0220.054] CloseHandle (hObject=0xe0) returned 1 [0220.068] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0220.068] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x88188480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88188480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0220.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0220.068] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0220.068] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7516b10, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0220.069] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7516b10, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0220.069] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x7516b10, dwReserved1=0x1d301bf, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0220.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256228 [0220.069] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0220.069] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x38200 [0220.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x38208) returned 0x2b4a70 [0220.069] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x38200, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x38200, lpOverlapped=0x0) returned 1 [0220.071] CloseHandle (hObject=0xe0) returned 1 [0220.071] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll")) returned 1 [0220.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0220.073] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.074] GetTickCount () returned 0x4693d [0220.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0220.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0220.074] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289085\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289085\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0220.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289085\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289085\\....\\temporaryfile")) returned 0 [0220.075] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289085\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289085\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289085\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289085\\temporaryfile")) returned 1 [0220.076] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289085\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x881fa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x881fa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x881fa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0220.076] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x881fa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x881fa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x881fa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0220.076] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x881fa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x881fa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x881fa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.076] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289085\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x881fa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x881fa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x881fa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0220.076] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x881fa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x881fa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x881fa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.077] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x881fa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x881fa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x881fa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.077] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0220.077] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289085\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289085\\temporaryfile")) returned 1 [0220.077] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x881fa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x881fa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x881fa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.077] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0220.077] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289085" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289085")) returned 1 [0220.077] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 0 [0220.080] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0220.081] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x38208, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x38208, lpOverlapped=0x0) returned 1 [0220.085] CloseHandle (hObject=0xe0) returned 1 [0220.085] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0220.085] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xcd2ac [0220.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcd2b4) returned 0x1d70020 [0220.086] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xcd2ac, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0xcd2ac, lpOverlapped=0x0) returned 1 [0220.110] CloseHandle (hObject=0xe0) returned 1 [0220.110] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its")) returned 1 [0220.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0220.116] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.116] GetTickCount () returned 0x4695c [0220.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0220.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0220.117] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289116\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289116\\...."), lpSecurityAttributes=0x256228) returned 1 [0220.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289116\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289116\\....\\temporaryfile")) returned 0 [0220.118] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289116\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289116\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289116\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289116\\temporaryfile")) returned 1 [0220.119] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289116\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88246b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88246b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88246b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0220.119] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88246b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88246b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88246b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.119] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88246b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88246b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88246b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.119] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289116\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88246b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88246b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88246b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0220.119] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88246b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88246b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88246b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.119] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88246b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88246b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88246b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.119] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0220.119] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289116\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289116\\temporaryfile")) returned 1 [0220.120] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88246b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88246b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88246b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.120] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0220.120] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289116" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289116")) returned 1 [0220.120] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 0 [0220.155] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0220.155] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xcd2b0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0xcd2b0, lpOverlapped=0x0) returned 1 [0220.172] CloseHandle (hObject=0xe0) returned 1 [0220.179] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0220.180] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x96a00 [0220.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x96a08) returned 0x1d70020 [0220.180] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x96a00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0x96a00, lpOverlapped=0x0) returned 1 [0220.192] CloseHandle (hObject=0xe0) returned 1 [0220.192] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex")) returned 1 [0220.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0220.198] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.198] GetTickCount () returned 0x469ba [0220.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0220.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0220.198] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289210\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0220.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289210\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289210\\....\\temporaryfile")) returned 0 [0220.199] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289210\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289210\\temporaryfile")) returned 1 [0220.200] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289210\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8832b3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8832b3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8832b3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0220.200] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8832b3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8832b3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8832b3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.200] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8832b3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8832b3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8832b3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.201] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289210\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8832b3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8832b3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8832b3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0220.201] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8832b3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8832b3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8832b3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.201] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8832b3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8832b3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8832b3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.201] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0220.201] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289210\\temporaryfile")) returned 1 [0220.201] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8832b3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8832b3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8832b3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.201] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0220.201] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289210" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289210")) returned 1 [0220.201] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 0 [0220.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x96a10) returned 0x2650020 [0220.245] HeapFree (in: hHeap=0x3f0000, dwFlags=0x0, lpMem=0x2250020 | out: hHeap=0x3f0000) returned 1 [0220.250] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0220.256] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x96a08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0x96a08, lpOverlapped=0x0) returned 1 [0220.273] CloseHandle (hObject=0xe0) returned 1 [0220.280] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0220.280] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8839d7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8839d7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0220.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0220.281] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0220.281] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0220.281] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0220.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 1 [0220.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="en-US", cAlternateFileName="")) returned 1 [0220.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="en-US", cAlternateFileName="")) returned 0 [0220.282] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0220.282] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0220.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0220.282] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0220.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 1 [0220.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 0 [0220.283] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0220.283] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0220.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0220.284] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0220.284] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0220.284] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0220.285] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0220.285] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="VBA7", cAlternateFileName="")) returned 1 [0220.285] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="VBA7", cAlternateFileName="")) returned 0 [0220.285] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0220.285] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0220.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0220.285] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0220.285] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0220.285] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="1033", cAlternateFileName="")) returned 1 [0220.285] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0220.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0220.286] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0220.287] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x381748 [0220.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x381750) returned 0x2650020 [0220.287] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x381748, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x381748, lpOverlapped=0x0) returned 1 [0220.403] CloseHandle (hObject=0xe0) returned 1 [0220.403] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll")) returned 1 [0220.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0220.409] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.409] GetTickCount () returned 0x46a85 [0220.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0220.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0220.412] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289413\\...."), lpSecurityAttributes=0x256228) returned 1 [0220.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289413\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289413\\....\\temporaryfile")) returned 0 [0220.413] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289413\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289413\\temporaryfile")) returned 1 [0220.414] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289413\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8851a580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8851a580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8851a580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0220.414] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8851a580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8851a580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8851a580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0220.415] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8851a580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8851a580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8851a580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289413\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8851a580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8851a580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8851a580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0220.415] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8851a580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8851a580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8851a580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.415] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8851a580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8851a580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8851a580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.415] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0220.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289413\\temporaryfile")) returned 1 [0220.415] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8851a580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8851a580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8851a580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.415] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0220.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289413" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289413")) returned 1 [0220.416] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 0 [0220.603] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0220.604] WriteFile (in: hFile=0xe0, lpBuffer=0x2d70028*, nNumberOfBytesToWrite=0x381750, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2d70028*, lpNumberOfBytesWritten=0x18fdb8*=0x381750, lpOverlapped=0x0) returned 1 [0220.675] CloseHandle (hObject=0xe0) returned 1 [0220.706] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0220.706] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x88709760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88709760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0220.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0220.707] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0220.709] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0220.709] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0220.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0220.709] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.709] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x51a5b [0220.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x51a63) returned 0x2b4a70 [0220.710] ReadFile (in: hFile=0xe4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x51a5b, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdb0*=0x51a5b, lpOverlapped=0x0) returned 1 [0220.713] CloseHandle (hObject=0xe4) returned 1 [0220.713] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0220.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0220.717] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.717] GetTickCount () returned 0x46bbd [0220.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0220.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c50 [0220.717] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289725\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289725\\...."), lpSecurityAttributes=0x256228) returned 1 [0220.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289725\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289725\\....\\temporaryfile")) returned 0 [0220.718] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289725\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289725\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289725\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289725\\temporaryfile")) returned 1 [0220.719] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289725\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88814100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88814100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88814100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0220.719] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88814100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88814100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88814100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0220.719] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88814100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88814100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88814100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.719] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289725\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88814100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88814100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88814100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c90 [0220.720] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88814100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88814100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88814100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.720] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88814100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88814100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88814100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.720] FindClose (in: hFindFile=0x289c90 | out: hFindFile=0x289c90) returned 1 [0220.720] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289725\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289725\\temporaryfile")) returned 1 [0220.720] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88814100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88814100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88814100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.720] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0220.720] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289725" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289725")) returned 1 [0220.720] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 0 [0220.725] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.726] WriteFile (in: hFile=0xe4, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fd98*=0x51a60, lpOverlapped=0x0) returned 1 [0220.733] CloseHandle (hObject=0xe4) returned 1 [0220.733] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.733] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x1ac96 [0220.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ac9e) returned 0x2b4a70 [0220.733] ReadFile (in: hFile=0xe4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1ac96, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdb0*=0x1ac96, lpOverlapped=0x0) returned 1 [0220.735] CloseHandle (hObject=0xe4) returned 1 [0220.735] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0220.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0220.737] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.737] GetTickCount () returned 0x46bcc [0220.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0220.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c50 [0220.737] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289740\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289740\\...."), lpSecurityAttributes=0x256210) returned 1 [0220.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289740\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289740\\....\\temporaryfile")) returned 0 [0220.738] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289740\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289740\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289740\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289740\\temporaryfile")) returned 1 [0220.739] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289740\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8883a260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8883a260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8883a260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0220.739] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8883a260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8883a260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8883a260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.739] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8883a260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8883a260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8883a260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.739] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289740\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8883a260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8883a260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8883a260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c90 [0220.739] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8883a260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8883a260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8883a260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.739] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8883a260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8883a260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8883a260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.740] FindClose (in: hFindFile=0x289c90 | out: hFindFile=0x289c90) returned 1 [0220.740] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289740\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289740\\temporaryfile")) returned 1 [0220.740] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8883a260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8883a260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8883a260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.740] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0220.740] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289740" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289740")) returned 1 [0220.740] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 0 [0220.742] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.742] WriteFile (in: hFile=0xe4, lpBuffer=0x2cf720*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2cf720*, lpNumberOfBytesWritten=0x18fd98*=0x1aca0, lpOverlapped=0x0) returned 1 [0220.745] CloseHandle (hObject=0xe4) returned 1 [0220.745] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.747] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x25d50 [0220.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25d58) returned 0x2b4a70 [0220.747] ReadFile (in: hFile=0xe4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x25d50, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdb0*=0x25d50, lpOverlapped=0x0) returned 1 [0220.758] CloseHandle (hObject=0xe4) returned 1 [0220.758] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll")) returned 1 [0220.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0220.760] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.760] GetTickCount () returned 0x46beb [0220.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0220.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c50 [0220.761] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771\\...."), lpSecurityAttributes=0x256228) returned 1 [0220.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771\\....\\temporaryfile")) returned 0 [0220.761] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771\\temporaryfile")) returned 1 [0220.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0220.763] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.763] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.763] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c90 [0220.763] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.763] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.763] FindClose (in: hFindFile=0x289c90 | out: hFindFile=0x289c90) returned 1 [0220.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771\\temporaryfile")) returned 1 [0220.763] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.763] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0220.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771")) returned 1 [0220.763] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 0 [0220.766] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.766] WriteFile (in: hFile=0xe4, lpBuffer=0x2da7d8*, nNumberOfBytesToWrite=0x25d58, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2da7d8*, lpNumberOfBytesWritten=0x18fd98*=0x25d58, lpOverlapped=0x0) returned 1 [0220.769] CloseHandle (hObject=0xe4) returned 1 [0220.769] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.770] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x1195f [0220.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11967) returned 0x2b4a70 [0220.770] ReadFile (in: hFile=0xe4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1195f, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdb0*=0x1195f, lpOverlapped=0x0) returned 1 [0220.772] CloseHandle (hObject=0xe4) returned 1 [0220.772] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0220.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0220.773] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.773] GetTickCount () returned 0x46beb [0220.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0220.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c50 [0220.774] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771\\...."), lpSecurityAttributes=0x256210) returned 1 [0220.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771\\....\\temporaryfile")) returned 0 [0220.775] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771\\temporaryfile")) returned 1 [0220.776] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x888ac680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x888ac680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0220.776] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x888ac680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x888ac680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.776] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.776] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c90 [0220.776] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.776] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.776] FindClose (in: hFindFile=0x289c90 | out: hFindFile=0x289c90) returned 1 [0220.776] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771\\temporaryfile")) returned 1 [0220.777] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88886520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88886520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88886520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.777] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0220.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289771" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289771")) returned 1 [0220.777] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 0 [0220.778] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.779] WriteFile (in: hFile=0xe4, lpBuffer=0x2c63e8*, nNumberOfBytesToWrite=0x11968, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2c63e8*, lpNumberOfBytesWritten=0x18fd98*=0x11968, lpOverlapped=0x0) returned 1 [0220.781] CloseHandle (hObject=0xe4) returned 1 [0220.781] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.782] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xe2aa [0220.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe2b2) returned 0x2b4a70 [0220.782] ReadFile (in: hFile=0xe4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xe2aa, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdb0*=0xe2aa, lpOverlapped=0x0) returned 1 [0220.783] CloseHandle (hObject=0xe4) returned 1 [0220.783] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0220.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0220.784] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.784] GetTickCount () returned 0x46bfb [0220.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0220.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c50 [0220.785] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289787\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289787\\...."), lpSecurityAttributes=0x256228) returned 1 [0220.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289787\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289787\\....\\temporaryfile")) returned 0 [0220.786] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289787\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289787\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289787\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289787\\temporaryfile")) returned 1 [0220.787] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289787\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x888ac680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x888ac680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x888ac680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0220.787] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x888ac680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x888ac680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x888ac680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.787] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x888ac680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x888ac680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x888ac680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.787] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289787\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x888ac680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x888ac680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x888ac680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c90 [0220.787] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x888ac680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x888ac680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x888ac680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.787] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x888ac680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x888ac680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x888ac680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.787] FindClose (in: hFindFile=0x289c90 | out: hFindFile=0x289c90) returned 1 [0220.787] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289787\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289787\\temporaryfile")) returned 1 [0220.787] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x888ac680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x888ac680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x888ac680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.787] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0220.788] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289787" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289787")) returned 1 [0220.788] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 0 [0220.789] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.789] WriteFile (in: hFile=0xe4, lpBuffer=0x2c2d38*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2c2d38*, lpNumberOfBytesWritten=0x18fd98*=0xe2b0, lpOverlapped=0x0) returned 1 [0220.791] CloseHandle (hObject=0xe4) returned 1 [0220.791] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.792] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xe6b62 [0220.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe6b6a) returned 0x2250020 [0220.792] ReadFile (in: hFile=0xe4, lpBuffer=0x2250028, nNumberOfBytesToRead=0xe6b62, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdb0*=0xe6b62, lpOverlapped=0x0) returned 1 [0220.818] CloseHandle (hObject=0xe4) returned 1 [0220.818] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0220.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0220.826] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.826] GetTickCount () returned 0x46c2a [0220.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0220.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c50 [0220.826] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289834\\...."), lpSecurityAttributes=0x256210) returned 1 [0220.830] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289834\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289834\\....\\temporaryfile")) returned 0 [0220.830] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289834\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289834\\temporaryfile")) returned 1 [0220.831] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289834\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8891eaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8891eaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8891eaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0220.832] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8891eaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8891eaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8891eaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.832] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8891eaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8891eaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8891eaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.832] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289834\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8891eaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8891eaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8891eaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c90 [0220.832] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8891eaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8891eaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8891eaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.832] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8891eaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8891eaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8891eaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.832] FindClose (in: hFindFile=0x289c90 | out: hFindFile=0x289c90) returned 1 [0220.832] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289834\\temporaryfile")) returned 1 [0220.832] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8891eaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8891eaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8891eaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.832] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0220.832] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289834" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289834")) returned 1 [0220.832] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 0 [0220.873] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.874] WriteFile (in: hFile=0xe4, lpBuffer=0x2740028*, nNumberOfBytesToWrite=0xe6b68, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2740028*, lpNumberOfBytesWritten=0x18fd98*=0xe6b68, lpOverlapped=0x0) returned 1 [0220.897] CloseHandle (hObject=0xe4) returned 1 [0220.905] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.905] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x1e434 [0220.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e43c) returned 0x2b4a70 [0220.906] ReadFile (in: hFile=0xe4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1e434, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdb0*=0x1e434, lpOverlapped=0x0) returned 1 [0220.907] CloseHandle (hObject=0xe4) returned 1 [0220.907] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0220.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0220.909] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.909] GetTickCount () returned 0x46c78 [0220.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0220.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c50 [0220.909] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289912\\...."), lpSecurityAttributes=0x256228) returned 1 [0220.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289912\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289912\\....\\temporaryfile")) returned 0 [0220.910] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289912\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289912\\temporaryfile")) returned 1 [0220.911] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289912\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x889dd180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x889dd180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x889dd180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0220.911] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x889dd180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x889dd180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x889dd180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.911] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x889dd180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x889dd180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x889dd180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.911] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289912\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x889dd180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x889dd180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x889dd180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c90 [0220.912] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x889dd180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x889dd180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x889dd180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.912] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x889dd180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x889dd180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x889dd180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.912] FindClose (in: hFindFile=0x289c90 | out: hFindFile=0x289c90) returned 1 [0220.912] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289912\\temporaryfile")) returned 1 [0220.912] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x889dd180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x889dd180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x889dd180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.912] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0220.912] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289912" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289912")) returned 1 [0220.912] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 0 [0220.914] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.915] WriteFile (in: hFile=0xe4, lpBuffer=0x2d2ec0*, nNumberOfBytesToWrite=0x1e438, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2d2ec0*, lpNumberOfBytesWritten=0x18fd98*=0x1e438, lpOverlapped=0x0) returned 1 [0220.918] CloseHandle (hObject=0xe4) returned 1 [0220.918] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.919] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x65c96 [0220.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x65c9e) returned 0x2450048 [0220.919] ReadFile (in: hFile=0xe4, lpBuffer=0x2450050, nNumberOfBytesToRead=0x65c96, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdb0*=0x65c96, lpOverlapped=0x0) returned 1 [0220.923] CloseHandle (hObject=0xe4) returned 1 [0220.923] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0220.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0220.927] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.927] GetTickCount () returned 0x46c87 [0220.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0220.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c50 [0220.927] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289927\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289927\\...."), lpSecurityAttributes=0x256210) returned 1 [0220.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289927\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289927\\....\\temporaryfile")) returned 0 [0220.929] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289927\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289927\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289927\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289927\\temporaryfile")) returned 1 [0220.930] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289927\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a032e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a032e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a032e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0220.930] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a032e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a032e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a032e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.930] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a032e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a032e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a032e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.930] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289927\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a032e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a032e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a032e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c90 [0220.930] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a032e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a032e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a032e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.930] FindNextFileA (in: hFindFile=0x289c90, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a032e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a032e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a032e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.930] FindClose (in: hFindFile=0x289c90 | out: hFindFile=0x289c90) returned 1 [0220.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289927\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289927\\temporaryfile")) returned 1 [0220.931] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a032e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a032e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a032e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.931] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0220.931] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289927" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289927")) returned 1 [0220.931] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 0 [0220.946] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0220.946] WriteFile (in: hFile=0xe4, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fd98*=0x65ca0, lpOverlapped=0x0) returned 1 [0220.953] CloseHandle (hObject=0xe4) returned 1 [0220.953] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0220.953] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x88a4f5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a4f5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0220.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0220.953] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0220.953] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0220.954] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0220.954] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbd2c6940, dwReserved1=0x1d2e620, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0220.955] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbd2c6940, dwReserved1=0x1d2e620, cFileName="..", cAlternateFileName="")) returned 1 [0220.955] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0xbd2c6940, dwReserved1=0x1d2e620, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0220.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256228 [0220.955] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0220.956] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf1b50 [0220.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf1b58) returned 0x2250020 [0220.956] ReadFile (in: hFile=0xdc, lpBuffer=0x2250028, nNumberOfBytesToRead=0xf1b50, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdf0*=0xf1b50, lpOverlapped=0x0) returned 1 [0220.975] CloseHandle (hObject=0xdc) returned 1 [0220.975] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1 [0220.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0220.983] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0220.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0220.983] GetTickCount () returned 0x46cc6 [0220.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0220.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0220.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0220.983] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289990\\...."), lpSecurityAttributes=0x256210) returned 1 [0220.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289990\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289990\\....\\temporaryfile")) returned 0 [0220.984] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289990\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289990\\temporaryfile")) returned 1 [0220.985] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289990\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a9b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a9b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a9b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x773a5902, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0220.985] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a9b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a9b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a9b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x773a5902, cFileName="..", cAlternateFileName="")) returned 1 [0220.985] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a9b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a9b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a9b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x773a5902, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0220.985] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289990\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a9b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a9b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a9b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0220.985] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a9b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a9b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a9b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.985] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a9b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a9b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a9b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.985] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0220.986] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289990\\temporaryfile")) returned 1 [0220.986] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88a9b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88a9b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88a9b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x773a5902, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0220.986] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0220.986] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18289990" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18289990")) returned 1 [0220.986] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 0 [0221.031] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.032] WriteFile (in: hFile=0xdc, lpBuffer=0x2750028*, nNumberOfBytesToWrite=0xf1b58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2750028*, lpNumberOfBytesWritten=0x18fdd8*=0xf1b58, lpOverlapped=0x0) returned 1 [0221.048] CloseHandle (hObject=0xdc) returned 1 [0221.056] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.056] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd0d50 [0221.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd0d58) returned 0x2250020 [0221.056] ReadFile (in: hFile=0xdc, lpBuffer=0x2250028, nNumberOfBytesToRead=0xd0d50, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdf0*=0xd0d50, lpOverlapped=0x0) returned 1 [0221.084] CloseHandle (hObject=0xdc) returned 1 [0221.084] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1 [0221.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0221.091] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.091] GetTickCount () returned 0x46d33 [0221.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0221.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0221.092] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290099\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290099\\...."), lpSecurityAttributes=0x256228) returned 1 [0221.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290099\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290099\\....\\temporaryfile")) returned 0 [0221.092] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290099\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290099\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290099\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290099\\temporaryfile")) returned 1 [0221.093] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290099\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ba6200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ba6200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ba6200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.093] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ba6200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ba6200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ba6200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ba6200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ba6200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ba6200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.094] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290099\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ba6200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ba6200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ba6200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.094] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ba6200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ba6200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ba6200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.094] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ba6200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ba6200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ba6200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.094] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290099\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290099\\temporaryfile")) returned 1 [0221.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ba6200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ba6200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ba6200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.094] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290099" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290099")) returned 1 [0221.094] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 0 [0221.130] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.130] WriteFile (in: hFile=0xdc, lpBuffer=0x2730028*, nNumberOfBytesToWrite=0xd0d58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2730028*, lpNumberOfBytesWritten=0x18fdd8*=0xd0d58, lpOverlapped=0x0) returned 1 [0221.143] CloseHandle (hObject=0xdc) returned 1 [0221.150] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.150] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x88bf24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88bf24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0221.150] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.150] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80020c30, dwReserved1=0x1ca0444, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.151] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80020c30, dwReserved1=0x1ca0444, cFileName="..", cAlternateFileName="")) returned 1 [0221.151] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x80020c30, dwReserved1=0x1ca0444, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0221.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8) returned 0x25c9d0 [0221.151] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.152] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10f200 [0221.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10f208) returned 0x2650020 [0221.152] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x10f200, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x10f200, lpOverlapped=0x0) returned 1 [0221.180] CloseHandle (hObject=0xdc) returned 1 [0221.180] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0 [0221.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0221.180] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.180] GetTickCount () returned 0x46d91 [0221.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0221.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.181] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290193\\...."), lpSecurityAttributes=0x256210) returned 1 [0221.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290193\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290193\\....\\temporaryfile")) returned 0 [0221.182] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290193\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290193\\temporaryfile")) returned 1 [0221.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290193\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88c8aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88c8aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88c8aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88c8aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88c8aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88c8aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88c8aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88c8aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88c8aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290193\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88c8aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88c8aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88c8aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.183] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88c8aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88c8aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88c8aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.183] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88c8aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88c8aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88c8aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.183] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.183] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290193\\temporaryfile")) returned 1 [0221.184] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88c8aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88c8aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88c8aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.184] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290193" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290193")) returned 1 [0221.184] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 1 [0221.241] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.242] WriteFile (in: hFile=0xdc, lpBuffer=0x2870028*, nNumberOfBytesToWrite=0x10f208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2870028*, lpNumberOfBytesWritten=0x18fdd8*=0x10f208, lpOverlapped=0x0) returned 1 [0221.261] CloseHandle (hObject=0xdc) returned 1 [0221.269] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.270] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x88cfce60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88cfce60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0221.270] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.270] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x81afcd40, dwReserved1=0x1d305eb, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0221.270] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x81afcd40, dwReserved1=0x1d305eb, cFileName="..", cAlternateFileName="")) returned 1 [0221.270] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x81afcd40, dwReserved1=0x1d305eb, cFileName="Fonts", cAlternateFileName="")) returned 1 [0221.270] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x81afcd40, dwReserved1=0x1d305eb, cFileName="Fonts", cAlternateFileName="")) returned 0 [0221.270] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0221.270] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x81afcd40, dwReserved1=0x1d305eb, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0221.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0221.271] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x81afcd40, dwReserved1=0x1d305eb, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x81afcd40, dwReserved1=0x1d305eb, cFileName="..", cAlternateFileName="")) returned 1 [0221.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x81afcd40, dwReserved1=0x1d305eb, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0221.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x256228 [0221.272] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.273] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4f2ea [0221.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f2f2) returned 0x2b4a70 [0221.273] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4f2ea, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4f2ea, lpOverlapped=0x0) returned 1 [0221.276] CloseHandle (hObject=0xe0) returned 1 [0221.276] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx")) returned 1 [0221.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0221.279] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.279] GetTickCount () returned 0x46dee [0221.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.280] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290286\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0221.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290286\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290286\\....\\temporaryfile")) returned 0 [0221.281] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290286\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290286\\temporaryfile")) returned 1 [0221.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290286\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88d6f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88d6f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88d6f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88d6f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88d6f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88d6f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88d6f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88d6f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88d6f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290286\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88d6f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88d6f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88d6f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.283] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88d6f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88d6f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88d6f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.283] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88d6f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88d6f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88d6f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.283] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290286\\temporaryfile")) returned 1 [0221.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88d6f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88d6f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88d6f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.283] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290286" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290286")) returned 1 [0221.283] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 0 [0221.292] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.292] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x4f2f0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x4f2f0, lpOverlapped=0x0) returned 1 [0221.301] CloseHandle (hObject=0xe0) returned 1 [0221.302] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.302] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa261d [0221.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa2625) returned 0x1d70020 [0221.302] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xa261d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0xa261d, lpOverlapped=0x0) returned 1 [0221.315] CloseHandle (hObject=0xe0) returned 1 [0221.315] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx")) returned 1 [0221.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0221.321] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.321] GetTickCount () returned 0x46e1d [0221.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.321] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290333\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290333\\...."), lpSecurityAttributes=0x256228) returned 1 [0221.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290333\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290333\\....\\temporaryfile")) returned 0 [0221.322] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290333\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290333\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290333\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290333\\temporaryfile")) returned 1 [0221.323] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290333\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88de16a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88de16a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88de16a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.323] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88de16a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88de16a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88de16a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.323] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88de16a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88de16a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88de16a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.323] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290333\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88de16a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88de16a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88de16a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.323] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88de16a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88de16a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88de16a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.323] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88de16a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88de16a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88de16a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.323] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.323] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290333\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290333\\temporaryfile")) returned 1 [0221.324] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88de16a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88de16a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88de16a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.324] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.324] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290333" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290333")) returned 1 [0221.324] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 0 [0221.351] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.352] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xa2628, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0xa2628, lpOverlapped=0x0) returned 1 [0221.362] CloseHandle (hObject=0xe0) returned 1 [0221.367] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.368] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6a9e6 [0221.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6a9ee) returned 0x2450048 [0221.368] ReadFile (in: hFile=0xe0, lpBuffer=0x2450050, nNumberOfBytesToRead=0x6a9e6, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdd0*=0x6a9e6, lpOverlapped=0x0) returned 1 [0221.374] CloseHandle (hObject=0xe0) returned 1 [0221.374] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx")) returned 1 [0221.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0221.377] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.377] GetTickCount () returned 0x46e4c [0221.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.378] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290380\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0221.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290380\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290380\\....\\temporaryfile")) returned 0 [0221.378] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290380\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290380\\temporaryfile")) returned 1 [0221.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290380\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88e53ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88e53ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88e53ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88e53ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88e53ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88e53ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88e53ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88e53ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88e53ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290380\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88e53ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88e53ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88e53ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.380] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88e53ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88e53ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88e53ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.380] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88e53ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88e53ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88e53ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.380] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290380\\temporaryfile")) returned 1 [0221.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88e53ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88e53ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88e53ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.380] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290380" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290380")) returned 1 [0221.381] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 0 [0221.392] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.392] WriteFile (in: hFile=0xe0, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x6a9f0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdb8*=0x6a9f0, lpOverlapped=0x0) returned 1 [0221.400] CloseHandle (hObject=0xe0) returned 1 [0221.400] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.400] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xdc6b9 [0221.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdc6c1) returned 0x2250020 [0221.401] ReadFile (in: hFile=0xe0, lpBuffer=0x2250028, nNumberOfBytesToRead=0xdc6b9, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdd0*=0xdc6b9, lpOverlapped=0x0) returned 1 [0221.418] CloseHandle (hObject=0xe0) returned 1 [0221.418] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx")) returned 1 [0221.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0221.425] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.425] GetTickCount () returned 0x46e7b [0221.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.426] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290427\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290427\\...."), lpSecurityAttributes=0x256228) returned 1 [0221.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290427\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290427\\....\\temporaryfile")) returned 0 [0221.426] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290427\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290427\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290427\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290427\\temporaryfile")) returned 1 [0221.427] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290427\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ec5ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ec5ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ec5ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.427] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ec5ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ec5ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ec5ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.428] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ec5ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ec5ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ec5ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.428] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290427\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ec5ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ec5ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ec5ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.428] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ec5ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ec5ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ec5ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.428] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ec5ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ec5ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ec5ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.428] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.428] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290427\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290427\\temporaryfile")) returned 1 [0221.428] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ec5ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ec5ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ec5ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.428] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.428] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290427" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290427")) returned 1 [0221.428] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 0 [0221.475] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.476] WriteFile (in: hFile=0xe0, lpBuffer=0x2730028*, nNumberOfBytesToWrite=0xdc6c0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2730028*, lpNumberOfBytesWritten=0x18fdb8*=0xdc6c0, lpOverlapped=0x0) returned 1 [0221.520] CloseHandle (hObject=0xe0) returned 1 [0221.527] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.528] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2b01 [0221.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b09) returned 0x299460 [0221.528] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x2b01, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x2b01, lpOverlapped=0x0) returned 1 [0221.529] CloseHandle (hObject=0xe0) returned 1 [0221.529] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx")) returned 1 [0221.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0221.530] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.530] GetTickCount () returned 0x46ee8 [0221.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.531] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0221.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536\\....\\temporaryfile")) returned 0 [0221.531] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536\\temporaryfile")) returned 1 [0221.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.533] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.533] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.533] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536\\temporaryfile")) returned 1 [0221.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.533] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536")) returned 1 [0221.533] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 0 [0221.534] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.534] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2b08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdb8*=0x2b08, lpOverlapped=0x0) returned 1 [0221.535] CloseHandle (hObject=0xe0) returned 1 [0221.536] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.536] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x146 [0221.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14e) returned 0x28f1f8 [0221.536] ReadFile (in: hFile=0xe0, lpBuffer=0x28f200, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdd0*=0x146, lpOverlapped=0x0) returned 1 [0221.537] CloseHandle (hObject=0xe0) returned 1 [0221.537] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp")) returned 1 [0221.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0221.538] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.538] GetTickCount () returned 0x46ee8 [0221.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.538] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536\\...."), lpSecurityAttributes=0x256228) returned 1 [0221.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536\\....\\temporaryfile")) returned 0 [0221.539] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536\\temporaryfile")) returned 1 [0221.540] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ff69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ff69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.540] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ff69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ff69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.541] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.541] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.541] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536\\temporaryfile")) returned 1 [0221.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88fd0880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88fd0880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88fd0880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.541] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290536" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290536")) returned 1 [0221.541] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 0 [0221.541] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.542] WriteFile (in: hFile=0xe0, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdb8*=0x150, lpOverlapped=0x0) returned 1 [0221.543] CloseHandle (hObject=0xe0) returned 1 [0221.543] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.544] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x369d3 [0221.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x369db) returned 0x2b4a70 [0221.544] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x369d3, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x369d3, lpOverlapped=0x0) returned 1 [0221.546] CloseHandle (hObject=0xe0) returned 1 [0221.546] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx")) returned 1 [0221.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0221.548] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.548] GetTickCount () returned 0x46ef7 [0221.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.549] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290551\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290551\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0221.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290551\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290551\\....\\temporaryfile")) returned 0 [0221.549] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290551\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290551\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290551\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290551\\temporaryfile")) returned 1 [0221.553] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290551\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ff69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ff69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ff69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ff69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ff69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ff69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ff69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ff69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ff69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.554] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290551\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ff69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ff69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ff69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.554] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ff69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ff69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ff69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.554] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ff69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ff69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ff69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.554] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.554] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290551\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290551\\temporaryfile")) returned 1 [0221.554] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x88ff69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x88ff69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x88ff69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.554] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.554] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290551" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290551")) returned 1 [0221.554] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 0 [0221.560] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.561] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x369d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x369d8, lpOverlapped=0x0) returned 1 [0221.564] CloseHandle (hObject=0xe0) returned 1 [0221.564] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.565] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2fde5 [0221.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2fded) returned 0x2b4a70 [0221.565] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2fde5, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2fde5, lpOverlapped=0x0) returned 1 [0221.567] CloseHandle (hObject=0xe0) returned 1 [0221.567] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx")) returned 1 [0221.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0221.569] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.569] GetTickCount () returned 0x46f07 [0221.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.570] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290567\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290567\\...."), lpSecurityAttributes=0x256228) returned 1 [0221.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290567\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290567\\....\\temporaryfile")) returned 0 [0221.570] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290567\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290567\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290567\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290567\\temporaryfile")) returned 1 [0221.573] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290567\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8901cb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89042ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89042ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.573] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8901cb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89042ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89042ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.573] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8901cb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8901cb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8901cb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.573] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290567\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8901cb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8901cb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8901cb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.573] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8901cb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8901cb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8901cb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.573] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8901cb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8901cb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8901cb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.573] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.573] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290567\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290567\\temporaryfile")) returned 1 [0221.574] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8901cb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8901cb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8901cb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.574] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.574] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290567" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290567")) returned 1 [0221.574] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 0 [0221.577] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.577] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x2fdf0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x2fdf0, lpOverlapped=0x0) returned 1 [0221.580] CloseHandle (hObject=0xe0) returned 1 [0221.580] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.581] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x9e413 [0221.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9e41b) returned 0x1d70020 [0221.581] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x9e413, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0x9e413, lpOverlapped=0x0) returned 1 [0221.594] CloseHandle (hObject=0xe0) returned 1 [0221.594] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx")) returned 1 [0221.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0221.599] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.599] GetTickCount () returned 0x46f26 [0221.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.600] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290598\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290598\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0221.600] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290598\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290598\\....\\temporaryfile")) returned 0 [0221.600] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290598\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290598\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290598\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290598\\temporaryfile")) returned 1 [0221.607] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290598\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89068e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89068e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89068e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.608] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89068e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89068e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89068e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.608] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89068e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89068e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89068e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.608] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290598\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89068e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89068e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89068e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.608] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89068e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89068e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89068e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.608] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89068e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89068e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89068e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.608] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.608] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290598\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290598\\temporaryfile")) returned 1 [0221.608] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89068e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89068e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89068e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.608] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.608] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290598" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290598")) returned 1 [0221.608] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 0 [0221.635] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.636] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x9e418, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0x9e418, lpOverlapped=0x0) returned 1 [0221.645] CloseHandle (hObject=0xe0) returned 1 [0221.650] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.651] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xdfc98 [0221.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdfca0) returned 0x2250020 [0221.651] ReadFile (in: hFile=0xe0, lpBuffer=0x2250028, nNumberOfBytesToRead=0xdfc98, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdd0*=0xdfc98, lpOverlapped=0x0) returned 1 [0221.668] CloseHandle (hObject=0xe0) returned 1 [0221.668] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx")) returned 1 [0221.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0221.675] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.676] GetTickCount () returned 0x46f74 [0221.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.676] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290676\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290676\\...."), lpSecurityAttributes=0x256228) returned 1 [0221.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290676\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290676\\....\\temporaryfile")) returned 0 [0221.677] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290676\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290676\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290676\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290676\\temporaryfile")) returned 1 [0221.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290676\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891274e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891274e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891274e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.678] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891274e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891274e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891274e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.678] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891274e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891274e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891274e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290676\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891274e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891274e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891274e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.678] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891274e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891274e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891274e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.678] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891274e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891274e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891274e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.678] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.678] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290676\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290676\\temporaryfile")) returned 1 [0221.679] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891274e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891274e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891274e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.679] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290676" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290676")) returned 1 [0221.679] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 0 [0221.718] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.719] WriteFile (in: hFile=0xe0, lpBuffer=0x2730028*, nNumberOfBytesToWrite=0xdfca0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2730028*, lpNumberOfBytesWritten=0x18fdb8*=0xdfca0, lpOverlapped=0x0) returned 1 [0221.739] CloseHandle (hObject=0xe0) returned 1 [0221.747] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.747] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x89199900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89199900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0221.747] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.747] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0221.747] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a42070, dwReserved1=0x1d2dda2, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.748] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a42070, dwReserved1=0x1d2dda2, cFileName="..", cAlternateFileName="")) returned 1 [0221.748] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a42070, dwReserved1=0x1d2dda2, cFileName="10.0", cAlternateFileName="")) returned 1 [0221.748] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x3a42070, dwReserved1=0x1d2dda2, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0221.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256210 [0221.748] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.749] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2d148 [0221.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d150) returned 0x2b4a70 [0221.749] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2d148, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2d148, lpOverlapped=0x0) returned 1 [0221.752] CloseHandle (hObject=0xdc) returned 1 [0221.752] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0221.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0221.754] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.754] GetTickCount () returned 0x46fc2 [0221.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0221.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0221.755] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290754\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290754\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0221.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290754\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290754\\....\\temporaryfile")) returned 0 [0221.755] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290754\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290754\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290754\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290754\\temporaryfile")) returned 1 [0221.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290754\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891e5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891e5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891e5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.756] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891e5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891e5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891e5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891e5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891e5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891e5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.757] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290754\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891e5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891e5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891e5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.757] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891e5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891e5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891e5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.757] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891e5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891e5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891e5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.757] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290754\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290754\\temporaryfile")) returned 1 [0221.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x891e5bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x891e5bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x891e5bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.757] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290754" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290754")) returned 1 [0221.757] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 0 [0221.760] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.761] WriteFile (in: hFile=0xdc, lpBuffer=0x2e1bd0*, nNumberOfBytesToWrite=0x2d150, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e1bd0*, lpNumberOfBytesWritten=0x18fdd8*=0x2d150, lpOverlapped=0x0) returned 1 [0221.764] CloseHandle (hObject=0xdc) returned 1 [0221.764] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.765] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3f50 [0221.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3f58) returned 0x2b4a70 [0221.765] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3f50, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3f50, lpOverlapped=0x0) returned 1 [0221.768] CloseHandle (hObject=0xdc) returned 1 [0221.768] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0221.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0221.769] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.769] GetTickCount () returned 0x46fd2 [0221.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0221.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0221.769] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290770\\...."), lpSecurityAttributes=0x256210) returned 1 [0221.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290770\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290770\\....\\temporaryfile")) returned 0 [0221.770] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290770\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290770\\temporaryfile")) returned 1 [0221.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290770\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8920bd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8920bd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8920bd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8920bd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8920bd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8920bd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8920bd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8920bd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8920bd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290770\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8920bd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8920bd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8920bd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.772] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8920bd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8920bd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8920bd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.772] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8920bd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8920bd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8920bd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.772] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290770\\temporaryfile")) returned 1 [0221.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8920bd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8920bd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8920bd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.772] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290770" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290770")) returned 1 [0221.772] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 0 [0221.773] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.773] WriteFile (in: hFile=0xdc, lpBuffer=0x2b89d8*, nNumberOfBytesToWrite=0x3f58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b89d8*, lpNumberOfBytesWritten=0x18fdd8*=0x3f58, lpOverlapped=0x0) returned 1 [0221.774] CloseHandle (hObject=0xdc) returned 1 [0221.774] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.775] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5550 [0221.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5558) returned 0x2b4a70 [0221.776] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5550, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x5550, lpOverlapped=0x0) returned 1 [0221.777] CloseHandle (hObject=0xdc) returned 1 [0221.777] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0221.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0221.778] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.778] GetTickCount () returned 0x46fe1 [0221.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0221.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0221.779] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290785\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290785\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0221.779] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290785\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290785\\....\\temporaryfile")) returned 0 [0221.779] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290785\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290785\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290785\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290785\\temporaryfile")) returned 1 [0221.780] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290785\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89231e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89231e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89231e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.780] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89231e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89231e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89231e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89231e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89231e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89231e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.781] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290785\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89231e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89231e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89231e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.781] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89231e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89231e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89231e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.781] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89231e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89231e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89231e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.781] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.781] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290785\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290785\\temporaryfile")) returned 1 [0221.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89231e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89231e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89231e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.781] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.781] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290785" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290785")) returned 1 [0221.781] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 0 [0221.782] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.784] WriteFile (in: hFile=0xdc, lpBuffer=0x2b9fd8*, nNumberOfBytesToWrite=0x5558, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b9fd8*, lpNumberOfBytesWritten=0x18fdd8*=0x5558, lpOverlapped=0x0) returned 1 [0221.785] CloseHandle (hObject=0xdc) returned 1 [0221.785] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.785] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x89231e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89231e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0221.786] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a42070, dwReserved1=0x1d2dda2, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a42070, dwReserved1=0x1d2dda2, cFileName="..", cAlternateFileName="")) returned 1 [0221.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a42070, dwReserved1=0x1d2dda2, cFileName="1033", cAlternateFileName="")) returned 1 [0221.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x3a42070, dwReserved1=0x1d2dda2, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0221.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15) returned 0x25cdb0 [0221.788] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.789] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2cc [0221.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d4) returned 0x259e70 [0221.789] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x2cc, lpOverlapped=0x0) returned 1 [0221.791] CloseHandle (hObject=0xe0) returned 1 [0221.791] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0221.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0221.792] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.792] GetTickCount () returned 0x46ff1 [0221.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0221.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0221.792] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801\\...."), lpSecurityAttributes=0x256210) returned 1 [0221.793] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801\\....\\temporaryfile")) returned 0 [0221.793] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801\\temporaryfile")) returned 1 [0221.794] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.794] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0221.794] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.794] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0221.794] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.795] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.795] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0221.795] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801\\temporaryfile")) returned 1 [0221.795] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.795] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.795] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801")) returned 1 [0221.795] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 0 [0221.795] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.796] WriteFile (in: hFile=0xe0, lpBuffer=0x25a158*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25a158*, lpNumberOfBytesWritten=0x18fdb8*=0x2d0, lpOverlapped=0x0) returned 1 [0221.797] CloseHandle (hObject=0xe0) returned 1 [0221.797] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.798] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x18558 [0221.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18560) returned 0x2b4a70 [0221.798] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x18558, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x18558, lpOverlapped=0x0) returned 1 [0221.801] CloseHandle (hObject=0xe0) returned 1 [0221.801] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1 [0221.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0221.802] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.802] GetTickCount () returned 0x46ff1 [0221.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0221.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0221.803] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801\\...."), lpSecurityAttributes=0x256210) returned 1 [0221.804] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801\\....\\temporaryfile")) returned 0 [0221.811] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801\\temporaryfile")) returned 1 [0221.812] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8927e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8927e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.813] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8927e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8927e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.813] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.813] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0221.813] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.813] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.813] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0221.813] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801\\temporaryfile")) returned 1 [0221.813] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89257fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89257fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89257fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.813] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.813] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290801" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290801")) returned 1 [0221.814] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 0 [0221.815] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.816] WriteFile (in: hFile=0xe0, lpBuffer=0x2ccfe0*, nNumberOfBytesToWrite=0x18560, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ccfe0*, lpNumberOfBytesWritten=0x18fdb8*=0x18560, lpOverlapped=0x0) returned 1 [0221.818] CloseHandle (hObject=0xe0) returned 1 [0221.818] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.820] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5e950 [0221.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5e958) returned 0x2b4a70 [0221.820] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5e950, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x5e950, lpOverlapped=0x0) returned 1 [0221.824] CloseHandle (hObject=0xe0) returned 1 [0221.824] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1 [0221.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0221.828] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.828] GetTickCount () returned 0x47010 [0221.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0221.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.829] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0221.829] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290832\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290832\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0221.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290832\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290832\\....\\temporaryfile")) returned 0 [0221.829] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290832\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290832\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290832\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290832\\temporaryfile")) returned 1 [0221.831] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290832\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892a42a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892a42a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892a42a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.831] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892a42a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892a42a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892a42a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.831] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892a42a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892a42a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892a42a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.831] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290832\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892a42a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892a42a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892a42a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0221.831] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892a42a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892a42a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892a42a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.831] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892a42a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892a42a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892a42a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.831] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0221.831] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290832\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290832\\temporaryfile")) returned 1 [0221.831] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892a42a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892a42a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892a42a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.831] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.831] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290832" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290832")) returned 1 [0221.832] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 0 [0221.842] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.843] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x5e958, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x5e958, lpOverlapped=0x0) returned 1 [0221.851] CloseHandle (hObject=0xe0) returned 1 [0221.852] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.853] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbb68 [0221.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbb70) returned 0x2b4a70 [0221.853] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xbb68, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xbb68, lpOverlapped=0x0) returned 1 [0221.859] CloseHandle (hObject=0xe0) returned 1 [0221.859] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1 [0221.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0221.860] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.860] GetTickCount () returned 0x4702f [0221.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0221.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0221.861] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290863\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290863\\...."), lpSecurityAttributes=0x256210) returned 1 [0221.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290863\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290863\\....\\temporaryfile")) returned 0 [0221.861] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290863\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290863\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290863\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290863\\temporaryfile")) returned 1 [0221.862] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290863\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892f0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892f0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892f0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.863] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892f0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892f0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892f0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.863] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892f0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892f0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892f0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.863] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290863\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892f0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892f0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892f0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0221.863] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892f0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892f0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892f0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.863] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892f0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892f0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892f0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.863] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0221.863] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290863\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290863\\temporaryfile")) returned 1 [0221.863] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x892f0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x892f0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892f0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.863] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.863] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290863" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290863")) returned 1 [0221.863] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 0 [0221.865] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.866] WriteFile (in: hFile=0xe0, lpBuffer=0x2c05f0*, nNumberOfBytesToWrite=0xbb70, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c05f0*, lpNumberOfBytesWritten=0x18fdb8*=0xbb70, lpOverlapped=0x0) returned 1 [0221.867] CloseHandle (hObject=0xe0) returned 1 [0221.867] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.867] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x892f0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x892f0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0221.868] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x617be070, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.868] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x617be070, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0221.868] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x617be070, dwReserved1=0x1d301bf, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0221.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x25cdd0 [0221.869] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0221.869] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x2760 [0221.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2768) returned 0x299460 [0221.869] ReadFile (in: hFile=0xe4, lpBuffer=0x299468, nNumberOfBytesToRead=0x2760, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdb0*=0x2760, lpOverlapped=0x0) returned 1 [0221.873] CloseHandle (hObject=0xe4) returned 1 [0221.873] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1 [0221.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0221.874] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.874] GetTickCount () returned 0x4703f [0221.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0221.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0221.874] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290879\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290879\\...."), lpSecurityAttributes=0x256210) returned 1 [0221.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290879\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290879\\....\\temporaryfile")) returned 0 [0221.875] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290879\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290879\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290879\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290879\\temporaryfile")) returned 1 [0221.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290879\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x893166c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x893166c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x893166c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0221.876] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x893166c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x893166c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x893166c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0221.876] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x893166c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x893166c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x893166c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290879\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x893166c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x893166c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x893166c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0221.876] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x893166c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x893166c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x893166c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.876] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x893166c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x893166c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x893166c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.876] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0221.876] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290879\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290879\\temporaryfile")) returned 1 [0221.877] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x893166c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x893166c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x893166c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.877] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0221.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290879" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290879")) returned 1 [0221.877] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 0 [0221.877] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0221.878] WriteFile (in: hFile=0xe4, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2768, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fd98*=0x2768, lpOverlapped=0x0) returned 1 [0221.879] CloseHandle (hObject=0xe4) returned 1 [0221.879] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0221.880] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x4758 [0221.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4760) returned 0x2b4a70 [0221.880] ReadFile (in: hFile=0xe4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4758, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdb0*=0x4758, lpOverlapped=0x0) returned 1 [0221.882] CloseHandle (hObject=0xe4) returned 1 [0221.882] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1 [0221.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0221.883] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.883] GetTickCount () returned 0x4704f [0221.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0221.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0221.884] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895\\...."), lpSecurityAttributes=0x256210) returned 1 [0221.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895\\....\\temporaryfile")) returned 0 [0221.884] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895\\temporaryfile")) returned 1 [0221.885] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0221.885] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.886] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.886] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0221.886] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.886] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.886] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0221.886] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895\\temporaryfile")) returned 1 [0221.886] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.886] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0221.886] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895")) returned 1 [0221.886] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 0 [0221.887] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0221.887] WriteFile (in: hFile=0xe4, lpBuffer=0x2b91e0*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2b91e0*, lpNumberOfBytesWritten=0x18fd98*=0x4760, lpOverlapped=0x0) returned 1 [0221.888] CloseHandle (hObject=0xe4) returned 1 [0221.889] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.889] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0221.889] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.889] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.889] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.889] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeeeb5310, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0221.890] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeeeb5310, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0221.890] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeeeb5310, dwReserved1=0x1d301be, cFileName="1033", cAlternateFileName="")) returned 1 [0221.890] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0xeeeb5310, dwReserved1=0x1d301be, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0221.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x2561c8 [0221.890] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.891] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaf88 [0221.891] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaf90) returned 0x2b4a70 [0221.891] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xaf88, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0xaf88, lpOverlapped=0x0) returned 1 [0221.893] CloseHandle (hObject=0xdc) returned 1 [0221.893] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll")) returned 1 [0221.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0221.894] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.894] GetTickCount () returned 0x4704f [0221.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.895] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0221.895] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895\\...."), lpSecurityAttributes=0x256228) returned 1 [0221.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895\\....\\temporaryfile")) returned 0 [0221.895] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895\\temporaryfile")) returned 1 [0221.897] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.897] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0221.897] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.897] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.897] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.897] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.897] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.897] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895\\temporaryfile")) returned 1 [0221.897] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8933c820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8933c820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8933c820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77163ca3, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.897] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.897] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290895" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290895")) returned 1 [0221.898] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 0 [0221.898] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0221.899] WriteFile (in: hFile=0xdc, lpBuffer=0x2bfa10*, nNumberOfBytesToWrite=0xaf90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bfa10*, lpNumberOfBytesWritten=0x18fdd8*=0xaf90, lpOverlapped=0x0) returned 1 [0221.901] CloseHandle (hObject=0xdc) returned 1 [0221.901] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0221.901] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x89362980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89362980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0221.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0221.901] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeeeb5310, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.902] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeeeb5310, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0221.902] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0xeeeb5310, dwReserved1=0x1d301be, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0221.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561c8 [0221.902] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.903] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2988 [0221.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2990) returned 0x299460 [0221.903] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x2988, lpOverlapped=0x0) returned 1 [0221.904] CloseHandle (hObject=0xe0) returned 1 [0221.905] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll")) returned 1 [0221.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0221.905] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.906] GetTickCount () returned 0x4705e [0221.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0221.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0221.906] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290910\\...."), lpSecurityAttributes=0x256228) returned 1 [0221.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290910\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290910\\....\\temporaryfile")) returned 0 [0221.907] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290910\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290910\\temporaryfile")) returned 1 [0221.908] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290910\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89362980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89362980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89362980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.908] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89362980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89362980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89362980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="..", cAlternateFileName="")) returned 1 [0221.908] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89362980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89362980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89362980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.908] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290910\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89362980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89362980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89362980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.908] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89362980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89362980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89362980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.908] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89362980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89362980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89362980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.908] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.908] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290910\\temporaryfile")) returned 1 [0221.912] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89362980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89362980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89362980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x12, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.912] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0221.912] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290910" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290910")) returned 1 [0221.912] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 0 [0221.912] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0221.913] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdb8*=0x2990, lpOverlapped=0x0) returned 1 [0221.914] CloseHandle (hObject=0xe0) returned 1 [0221.914] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.914] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x89362980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89362980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0221.915] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.915] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0221.915] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0221.916] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0221.916] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="14", cAlternateFileName="")) returned 1 [0221.916] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="14", cAlternateFileName="")) returned 0 [0221.916] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0221.916] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0221.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0221.916] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.916] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0221.916] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="BIN", cAlternateFileName="")) returned 1 [0221.917] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="BIN", cAlternateFileName="")) returned 0 [0221.917] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0221.917] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0221.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0221.917] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0221.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0221.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="1033", cAlternateFileName="")) returned 1 [0221.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0221.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0221.918] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0221.918] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x267d78 [0221.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x267d80) returned 0x2650020 [0221.919] ReadFile (in: hFile=0xe4, lpBuffer=0x2650028, nNumberOfBytesToRead=0x267d78, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdb0*=0x267d78, lpOverlapped=0x0) returned 1 [0221.982] CloseHandle (hObject=0xe4) returned 1 [0221.983] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll")) returned 1 [0221.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0221.986] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0221.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0221.986] GetTickCount () returned 0x470ac [0221.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0221.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0221.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0221.987] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290988\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290988\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0221.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290988\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290988\\....\\temporaryfile")) returned 0 [0221.988] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290988\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290988\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290988\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290988\\temporaryfile")) returned 1 [0221.989] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290988\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89421060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89421060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89421060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0221.989] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89421060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89421060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89421060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="..", cAlternateFileName="")) returned 1 [0221.989] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89421060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89421060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89421060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0221.989] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290988\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89421060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89421060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89421060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0221.990] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89421060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89421060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89421060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.990] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89421060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89421060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89421060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0221.990] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0221.990] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290988\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290988\\temporaryfile")) returned 1 [0221.990] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89421060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89421060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89421060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x15, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0221.990] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0221.990] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18290988" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18290988")) returned 1 [0221.990] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 0 [0222.182] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0222.183] WriteFile (in: hFile=0xe4, lpBuffer=0x2b30028*, nNumberOfBytesToWrite=0x267d80, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2b30028*, lpNumberOfBytesWritten=0x18fd98*=0x267d80, lpOverlapped=0x0) returned 1 [0222.223] CloseHandle (hObject=0xe4) returned 1 [0222.244] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0222.245] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x14cd90 [0222.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14cd98) returned 0x2650020 [0222.245] ReadFile (in: hFile=0xe4, lpBuffer=0x2650028, nNumberOfBytesToRead=0x14cd90, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdb0*=0x14cd90, lpOverlapped=0x0) returned 1 [0222.280] CloseHandle (hObject=0xe4) returned 1 [0222.280] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll")) returned 1 [0222.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0222.283] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0222.283] GetTickCount () returned 0x471d5 [0222.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0222.284] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291285\\...."), lpSecurityAttributes=0x256210) returned 1 [0222.284] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291285\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291285\\....\\temporaryfile")) returned 0 [0222.285] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291285\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291285\\temporaryfile")) returned 1 [0222.286] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291285\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x896f4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x896f4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x896f4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.286] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x896f4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x896f4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x896f4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.286] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x896f4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x896f4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x896f4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.286] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291285\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x896f4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x896f4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x896f4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0222.286] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x896f4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x896f4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x896f4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.286] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x896f4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x896f4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x896f4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.286] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0222.287] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291285\\temporaryfile")) returned 1 [0222.287] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x896f4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x896f4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x896f4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.287] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.287] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291285" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291285")) returned 1 [0222.287] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 0 [0222.356] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0222.357] WriteFile (in: hFile=0xe4, lpBuffer=0x28f0028*, nNumberOfBytesToWrite=0x14cd98, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x28f0028*, lpNumberOfBytesWritten=0x18fd98*=0x14cd98, lpOverlapped=0x0) returned 1 [0222.379] CloseHandle (hObject=0xe4) returned 1 [0222.390] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.390] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x897b3160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x897b3160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0222.390] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.391] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0222.391] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0xeedaa970, dwReserved1=0x1d301be, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0222.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa) returned 0x2561c8 [0222.391] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe8 [0222.391] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x18fd90 | out: lpFileSizeHigh=0x18fd90*=0x0) returned 0x296a5 [0222.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x296ad) returned 0x2b4a70 [0222.391] ReadFile (in: hFile=0xe8, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x296a5, lpNumberOfBytesRead=0x18fd90, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fd90*=0x296a5, lpOverlapped=0x0) returned 1 [0222.393] CloseHandle (hObject=0xe8) returned 1 [0222.393] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0222.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0222.395] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc3c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0222.395] GetTickCount () returned 0x47242 [0222.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0222.396] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291394\\...."), lpSecurityAttributes=0x256210) returned 1 [0222.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291394\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291394\\....\\temporaryfile")) returned 0 [0222.397] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291394\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291394\\temporaryfile")) returned 1 [0222.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291394\\*", lpFindFileData=0x18fb14 | out: lpFindFileData=0x18fb14*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x897ff420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89825580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89825580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0222.399] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb14 | out: lpFindFileData=0x18fb14*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x897ff420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89825580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89825580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.399] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb14 | out: lpFindFileData=0x18fb14*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x897ff420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x897ff420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x897ff420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.399] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291394\\TemporaryFile\\*", lpFindFileData=0x18f7b4 | out: lpFindFileData=0x18f7b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x897ff420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x897ff420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x897ff420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0222.399] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7b4 | out: lpFindFileData=0x18f7b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x897ff420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x897ff420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x897ff420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.399] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7b4 | out: lpFindFileData=0x18f7b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x897ff420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x897ff420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x897ff420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.399] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0222.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291394\\temporaryfile")) returned 1 [0222.399] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb14 | out: lpFindFileData=0x18fb14*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x897ff420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x897ff420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x897ff420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.399] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0222.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291394" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291394")) returned 1 [0222.399] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 0 [0222.404] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.SKYSTARS" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe8 [0222.404] WriteFile (in: hFile=0xe8, lpBuffer=0x2de130*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x18fd78, lpOverlapped=0x0 | out: lpBuffer=0x2de130*, lpNumberOfBytesWritten=0x18fd78*=0x296b0, lpOverlapped=0x0) returned 1 [0222.407] CloseHandle (hObject=0xe8) returned 1 [0222.407] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.407] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x89825580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89825580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0222.407] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.408] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.408] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0222.408] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0222.408] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0222.408] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0222.408] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0222.408] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0222.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0222.408] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0222.409] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa8e [0222.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa96) returned 0x25f580 [0222.409] ReadFile (in: hFile=0xd8, lpBuffer=0x25f588, nNumberOfBytesToRead=0xa8e, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fe10*=0xa8e, lpOverlapped=0x0) returned 1 [0222.410] CloseHandle (hObject=0xd8) returned 1 [0222.411] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 1 [0222.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0222.411] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.411] GetTickCount () returned 0x47251 [0222.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0222.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0222.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0222.412] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291409\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291409\\...."), lpSecurityAttributes=0x256228) returned 1 [0222.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291409\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291409\\....\\temporaryfile")) returned 0 [0222.412] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291409\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291409\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291409\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291409\\temporaryfile")) returned 1 [0222.414] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291409\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89825580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8984b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8984b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0222.414] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89825580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8984b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8984b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.414] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89825580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89825580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89825580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.414] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291409\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89825580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89825580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89825580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.414] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89825580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89825580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89825580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.414] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89825580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89825580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89825580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.414] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.414] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291409\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291409\\temporaryfile")) returned 1 [0222.414] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89825580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89825580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89825580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.414] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0222.414] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291409" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291409")) returned 1 [0222.415] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 0 [0222.415] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.SKYSTARS" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0222.415] WriteFile (in: hFile=0xd8, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xa98, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdf8*=0xa98, lpOverlapped=0x0) returned 1 [0222.416] CloseHandle (hObject=0xd8) returned 1 [0222.416] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0222.416] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8984b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8984b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0222.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0222.416] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0222.417] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0222.417] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0222.417] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0222.417] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0222.417] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0222.417] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0222.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0222.417] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0222.418] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0222.418] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="TTS20", cAlternateFileName="")) returned 1 [0222.418] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="TTS20", cAlternateFileName="")) returned 0 [0222.419] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0222.419] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0222.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0222.419] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.419] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0222.419] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="en-US", cAlternateFileName="")) returned 1 [0222.419] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0222.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x256228 [0222.419] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.420] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa200 [0222.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa208) returned 0x2b4a70 [0222.420] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xa200, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xa200, lpOverlapped=0x0) returned 1 [0222.422] CloseHandle (hObject=0xe0) returned 1 [0222.422] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll")) returned 0 [0222.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0222.422] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0222.422] GetTickCount () returned 0x47261 [0222.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0222.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0222.422] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291425\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291425\\...."), lpSecurityAttributes=0x256198) returned 1 [0222.423] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291425\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291425\\....\\temporaryfile")) returned 0 [0222.423] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291425\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291425\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291425\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291425\\temporaryfile")) returned 1 [0222.425] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291425\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8984b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8984b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8984b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.425] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8984b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8984b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8984b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0222.425] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8984b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8984b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8984b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.425] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291425\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8984b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8984b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8984b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0222.425] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8984b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8984b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8984b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.425] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8984b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8984b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8984b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.425] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0222.425] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291425\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291425\\temporaryfile")) returned 1 [0222.426] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8984b6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8984b6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8984b6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.426] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.426] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291425" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291425")) returned 1 [0222.426] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 1 [0222.427] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0222.427] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.428] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2c400 [0222.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c408) returned 0x2b4a70 [0222.428] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2c400, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2c400, lpOverlapped=0x0) returned 1 [0222.431] CloseHandle (hObject=0xe0) returned 1 [0222.431] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll")) returned 0 [0222.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0222.431] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0222.431] GetTickCount () returned 0x47271 [0222.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0222.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0222.431] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441\\...."), lpSecurityAttributes=0x256228) returned 1 [0222.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441\\....\\temporaryfile")) returned 0 [0222.432] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441\\temporaryfile")) returned 1 [0222.433] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.433] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.433] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.433] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0222.433] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.433] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.433] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0222.434] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441\\temporaryfile")) returned 1 [0222.434] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.434] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.434] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441")) returned 1 [0222.434] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 1 [0222.437] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0222.437] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0222.437] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2600 [0222.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2608) returned 0x299460 [0222.437] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x2600, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x2600, lpOverlapped=0x0) returned 1 [0222.439] CloseHandle (hObject=0xe0) returned 1 [0222.439] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll")) returned 0 [0222.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0222.439] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0222.439] GetTickCount () returned 0x47271 [0222.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0222.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0222.440] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441\\...."), lpSecurityAttributes=0x256198) returned 1 [0222.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441\\....\\temporaryfile")) returned 0 [0222.440] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441\\temporaryfile")) returned 1 [0222.441] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.441] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.441] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.442] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0222.442] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.442] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.442] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0222.442] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441\\temporaryfile")) returned 1 [0222.442] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89871840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89871840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89871840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.442] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.442] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291441" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291441")) returned 1 [0222.442] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 1 [0222.443] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0222.443] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.443] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0222.443] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.444] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0222.444] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0222.444] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0222.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15) returned 0x25cdf0 [0222.444] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0222.444] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x5b400 [0222.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b408) returned 0x2b4a70 [0222.444] ReadFile (in: hFile=0xe4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5b400, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdb0*=0x5b400, lpOverlapped=0x0) returned 1 [0222.448] CloseHandle (hObject=0xe4) returned 1 [0222.448] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll")) returned 0 [0222.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0222.448] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0222.448] GetTickCount () returned 0x47280 [0222.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0222.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0222.449] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291456\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291456\\...."), lpSecurityAttributes=0x256228) returned 1 [0222.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291456\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291456\\....\\temporaryfile")) returned 0 [0222.449] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291456\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291456\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291456\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291456\\temporaryfile")) returned 1 [0222.450] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291456\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898979a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898979a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898979a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0222.450] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898979a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898979a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898979a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.450] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898979a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898979a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898979a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.450] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291456\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898979a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898979a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898979a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0222.450] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898979a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898979a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898979a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.450] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898979a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898979a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898979a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.450] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0222.451] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291456\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291456\\temporaryfile")) returned 1 [0222.451] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898979a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898979a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898979a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.451] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0222.451] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291456" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291456")) returned 1 [0222.451] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 1 [0222.461] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0222.461] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0222.462] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xa00 [0222.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa08) returned 0x25f580 [0222.462] ReadFile (in: hFile=0xe4, lpBuffer=0x25f588, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdb0*=0xa00, lpOverlapped=0x0) returned 1 [0222.463] CloseHandle (hObject=0xe4) returned 1 [0222.463] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui")) returned 0 [0222.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0222.463] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0222.463] GetTickCount () returned 0x47290 [0222.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0222.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0222.464] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472\\...."), lpSecurityAttributes=0x256228) returned 1 [0222.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472\\....\\temporaryfile")) returned 0 [0222.464] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472\\temporaryfile")) returned 1 [0222.465] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0222.465] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.466] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.466] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0222.466] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.466] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.466] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0222.466] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472\\temporaryfile")) returned 1 [0222.466] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.466] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0222.466] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472")) returned 1 [0222.466] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 1 [0222.467] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xffffffff [0222.467] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.467] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0222.467] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0222.467] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0222.467] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 0 [0222.468] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0222.468] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x18fc68 | out: lpFindFileData=0x18fc68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0222.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0222.468] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0222.468] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.468] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.468] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0222.468] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0222.468] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0222.470] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0222.471] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="ado", cAlternateFileName="")) returned 1 [0222.471] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0222.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0222.471] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0222.472] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x7200 [0222.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7208) returned 0x2b4a70 [0222.472] ReadFile (in: hFile=0xd8, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x7200, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe10*=0x7200, lpOverlapped=0x0) returned 1 [0222.473] CloseHandle (hObject=0xd8) returned 1 [0222.473] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0 [0222.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0222.473] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.473] GetTickCount () returned 0x47290 [0222.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0222.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0222.474] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0222.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472\\....\\temporaryfile")) returned 0 [0222.475] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472\\temporaryfile")) returned 1 [0222.476] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898e3c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898e3c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2350048, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0222.476] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898e3c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898e3c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2350048, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.476] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2350048, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.476] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.476] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.476] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.476] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.476] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472\\temporaryfile")) returned 1 [0222.477] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x898bdb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x898bdb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x898bdb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2350048, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.477] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0222.477] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291472" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291472")) returned 1 [0222.477] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 1 [0222.478] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\directdb.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0222.478] WriteFile (in: hFile=0xd8, lpBuffer=0x2bbc88*, nNumberOfBytesToWrite=0x7208, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2bbc88*, lpNumberOfBytesWritten=0x18fdf8*=0x7208, lpOverlapped=0x0) returned 1 [0222.480] CloseHandle (hObject=0xd8) returned 1 [0222.480] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0222.480] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xd8800 [0222.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd8808) returned 0x2250020 [0222.480] ReadFile (in: hFile=0xd8, lpBuffer=0x2250028, nNumberOfBytesToRead=0xd8800, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fe10*=0xd8800, lpOverlapped=0x0) returned 1 [0222.497] CloseHandle (hObject=0xd8) returned 1 [0222.497] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0 [0222.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0222.497] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.498] GetTickCount () returned 0x472af [0222.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0222.498] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291503\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291503\\...."), lpSecurityAttributes=0x256210) returned 1 [0222.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291503\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291503\\....\\temporaryfile")) returned 0 [0222.499] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291503\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291503\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291503\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291503\\temporaryfile")) returned 1 [0222.500] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291503\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89909dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89909dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89909dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0222.500] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89909dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89909dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89909dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.500] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89909dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89909dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89909dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.500] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291503\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89909dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89909dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89909dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0222.500] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89909dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89909dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89909dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.500] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89909dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89909dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89909dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.500] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0222.500] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291503\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291503\\temporaryfile")) returned 1 [0222.500] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89909dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89909dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89909dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.500] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0222.500] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291503" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291503")) returned 1 [0222.500] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 1 [0222.551] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\wab32.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0222.552] WriteFile (in: hFile=0xd8, lpBuffer=0x2730028*, nNumberOfBytesToWrite=0xd8808, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2730028*, lpNumberOfBytesWritten=0x18fdf8*=0xd8808, lpOverlapped=0x0) returned 1 [0222.564] CloseHandle (hObject=0xd8) returned 1 [0222.572] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0222.572] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x10c400 [0222.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10c408) returned 0x2650020 [0222.572] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x10c400, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x10c400, lpOverlapped=0x0) returned 1 [0222.604] CloseHandle (hObject=0xd8) returned 1 [0222.604] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0 [0222.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0222.604] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.604] GetTickCount () returned 0x4731c [0222.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0222.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0222.605] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291612\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291612\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0222.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291612\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291612\\....\\temporaryfile")) returned 0 [0222.606] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291612\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291612\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291612\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291612\\temporaryfile")) returned 1 [0222.607] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291612\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89a14760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89a14760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89a14760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0222.607] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89a14760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89a14760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89a14760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.607] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89a14760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89a14760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89a14760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.607] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291612\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89a14760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89a14760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89a14760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.607] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89a14760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89a14760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89a14760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.607] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89a14760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89a14760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89a14760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.607] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.607] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291612\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291612\\temporaryfile")) returned 1 [0222.607] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89a14760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89a14760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89a14760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.608] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0222.608] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291612" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291612")) returned 1 [0222.608] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 1 [0222.667] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0222.667] WriteFile (in: hFile=0xd8, lpBuffer=0x2870028*, nNumberOfBytesToWrite=0x10c408, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2870028*, lpNumberOfBytesWritten=0x18fdf8*=0x10c408, lpOverlapped=0x0) returned 1 [0222.698] CloseHandle (hObject=0xd8) returned 1 [0222.708] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0222.708] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89aacce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89aacce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0222.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0222.708] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0222.709] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0222.709] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0xfd85ef28, dwReserved1=0x1ca0431, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0222.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0222.710] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.711] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3912 [0222.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x391a) returned 0x2b4a70 [0222.711] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3912, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3912, lpOverlapped=0x0) returned 1 [0222.712] CloseHandle (hObject=0xdc) returned 1 [0222.712] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0 [0222.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0222.712] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.712] GetTickCount () returned 0x47389 [0222.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0222.713] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0222.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721\\....\\temporaryfile")) returned 0 [0222.713] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721\\temporaryfile")) returned 1 [0222.715] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.715] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.715] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.715] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.715] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.715] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.715] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.715] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721\\temporaryfile")) returned 1 [0222.715] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.715] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.716] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721")) returned 1 [0222.716] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 1 [0222.716] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.717] WriteFile (in: hFile=0xdc, lpBuffer=0x2b83a0*, nNumberOfBytesToWrite=0x3918, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b83a0*, lpNumberOfBytesWritten=0x18fdd8*=0x3918, lpOverlapped=0x0) returned 1 [0222.718] CloseHandle (hObject=0xdc) returned 1 [0222.718] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.718] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3a67 [0222.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3a6f) returned 0x2b4a70 [0222.718] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3a67, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3a67, lpOverlapped=0x0) returned 1 [0222.720] CloseHandle (hObject=0xdc) returned 1 [0222.720] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0 [0222.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0222.720] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.720] GetTickCount () returned 0x47389 [0222.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0222.721] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721\\...."), lpSecurityAttributes=0x256210) returned 1 [0222.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721\\....\\temporaryfile")) returned 0 [0222.721] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721\\temporaryfile")) returned 1 [0222.722] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.723] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.723] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.723] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.723] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.723] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.723] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721\\temporaryfile")) returned 1 [0222.723] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b1f100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b1f100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b1f100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.723] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291721" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291721")) returned 1 [0222.723] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 1 [0222.724] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.725] WriteFile (in: hFile=0xdc, lpBuffer=0x2b84f0*, nNumberOfBytesToWrite=0x3a70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b84f0*, lpNumberOfBytesWritten=0x18fdd8*=0x3a70, lpOverlapped=0x0) returned 1 [0222.726] CloseHandle (hObject=0xdc) returned 1 [0222.726] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.726] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2000 [0222.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2008) returned 0x299460 [0222.726] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2000, lpOverlapped=0x0) returned 1 [0222.728] CloseHandle (hObject=0xdc) returned 1 [0222.728] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0 [0222.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0222.728] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.728] GetTickCount () returned 0x47399 [0222.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0222.729] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291737\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291737\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0222.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291737\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291737\\....\\temporaryfile")) returned 0 [0222.729] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291737\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291737\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291737\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291737\\temporaryfile")) returned 1 [0222.730] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291737\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b45260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b45260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b45260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.730] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b45260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b45260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b45260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.730] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b45260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b45260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b45260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.730] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291737\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b45260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b45260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b45260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.731] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b45260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b45260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b45260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.731] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b45260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b45260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b45260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.731] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.731] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291737\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291737\\temporaryfile")) returned 1 [0222.731] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89b45260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89b45260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89b45260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.731] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.731] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291737" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291737")) returned 1 [0222.731] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 1 [0222.732] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.732] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2008, lpOverlapped=0x0) returned 1 [0222.733] CloseHandle (hObject=0xdc) returned 1 [0222.733] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.734] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16e000 [0222.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16e008) returned 0x2650020 [0222.734] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x16e000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x16e000, lpOverlapped=0x0) returned 1 [0222.785] CloseHandle (hObject=0xdc) returned 1 [0222.785] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0 [0222.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0222.785] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.785] GetTickCount () returned 0x473c8 [0222.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0222.786] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291784\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291784\\...."), lpSecurityAttributes=0x256210) returned 1 [0222.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291784\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291784\\....\\temporaryfile")) returned 0 [0222.786] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291784\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291784\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291784\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291784\\temporaryfile")) returned 1 [0222.787] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291784\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89bb7680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89bb7680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89bb7680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89bb7680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89bb7680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89bb7680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89bb7680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89bb7680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89bb7680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291784\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89bb7680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89bb7680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89bb7680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.788] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89bb7680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89bb7680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89bb7680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.788] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89bb7680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89bb7680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89bb7680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.788] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.788] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291784\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291784\\temporaryfile")) returned 1 [0222.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89bb7680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89bb7680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89bb7680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.788] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.788] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291784" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291784")) returned 1 [0222.788] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 1 [0222.882] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.883] WriteFile (in: hFile=0xdc, lpBuffer=0x2930028*, nNumberOfBytesToWrite=0x16e008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2930028*, lpNumberOfBytesWritten=0x18fdd8*=0x16e008, lpOverlapped=0x0) returned 1 [0222.908] CloseHandle (hObject=0xdc) returned 1 [0222.931] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.932] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x11000 [0222.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11008) returned 0x2b4a70 [0222.932] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x11000, lpOverlapped=0x0) returned 1 [0222.934] CloseHandle (hObject=0xdc) returned 1 [0222.934] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0 [0222.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0222.934] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.934] GetTickCount () returned 0x47464 [0222.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0222.935] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291940\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291940\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0222.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291940\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291940\\....\\temporaryfile")) returned 0 [0222.935] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291940\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291940\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291940\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291940\\temporaryfile")) returned 1 [0222.937] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291940\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d34440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d34440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d34440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.937] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d34440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d34440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d34440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.937] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d34440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d34440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d34440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.937] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291940\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d34440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d34440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d34440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.937] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d34440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d34440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d34440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.937] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d34440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d34440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d34440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.937] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.937] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291940\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291940\\temporaryfile")) returned 1 [0222.937] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d34440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d34440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d34440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.937] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.937] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291940" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291940")) returned 1 [0222.938] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 1 [0222.944] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.945] WriteFile (in: hFile=0xdc, lpBuffer=0x2c5a88*, nNumberOfBytesToWrite=0x11008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c5a88*, lpNumberOfBytesWritten=0x18fdd8*=0x11008, lpOverlapped=0x0) returned 1 [0222.947] CloseHandle (hObject=0xdc) returned 1 [0222.947] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.947] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x12000 [0222.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12008) returned 0x2b4a70 [0222.947] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x12000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x12000, lpOverlapped=0x0) returned 1 [0222.949] CloseHandle (hObject=0xdc) returned 1 [0222.949] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0 [0222.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0222.949] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.949] GetTickCount () returned 0x47473 [0222.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0222.950] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291955\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291955\\...."), lpSecurityAttributes=0x256210) returned 1 [0222.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291955\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291955\\....\\temporaryfile")) returned 0 [0222.950] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291955\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291955\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291955\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291955\\temporaryfile")) returned 1 [0222.952] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291955\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d5a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d5a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d5a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.952] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d5a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d5a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d5a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.952] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d5a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d5a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d5a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.952] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291955\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d5a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d5a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d5a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.952] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d5a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d5a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d5a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.952] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d5a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d5a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d5a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.952] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.952] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291955\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291955\\temporaryfile")) returned 1 [0222.952] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d5a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d5a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d5a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.952] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.953] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291955" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291955")) returned 1 [0222.953] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 1 [0222.954] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.955] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6a88*, nNumberOfBytesToWrite=0x12008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6a88*, lpNumberOfBytesWritten=0x18fdd8*=0x12008, lpOverlapped=0x0) returned 1 [0222.956] CloseHandle (hObject=0xdc) returned 1 [0222.957] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.957] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17000 [0222.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17008) returned 0x2b4a70 [0222.957] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x17000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x17000, lpOverlapped=0x0) returned 1 [0222.959] CloseHandle (hObject=0xdc) returned 1 [0222.959] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0 [0222.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0222.959] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.959] GetTickCount () returned 0x47483 [0222.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0222.960] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0222.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971\\....\\temporaryfile")) returned 0 [0222.960] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971\\temporaryfile")) returned 1 [0222.962] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.962] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.962] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.962] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.962] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.962] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.962] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.962] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971\\temporaryfile")) returned 1 [0222.962] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.962] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.962] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971")) returned 1 [0222.962] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 1 [0222.964] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.965] WriteFile (in: hFile=0xdc, lpBuffer=0x2cba88*, nNumberOfBytesToWrite=0x17008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cba88*, lpNumberOfBytesWritten=0x18fdd8*=0x17008, lpOverlapped=0x0) returned 1 [0222.967] CloseHandle (hObject=0xdc) returned 1 [0222.967] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.968] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18000 [0222.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18008) returned 0x2b4a70 [0222.968] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x18000, lpOverlapped=0x0) returned 1 [0222.970] CloseHandle (hObject=0xdc) returned 1 [0222.970] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0 [0222.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0222.970] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.970] GetTickCount () returned 0x47483 [0222.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0222.971] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971\\...."), lpSecurityAttributes=0x256210) returned 1 [0222.971] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971\\....\\temporaryfile")) returned 0 [0222.971] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971\\temporaryfile")) returned 1 [0222.973] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.973] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.973] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.973] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.973] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.973] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971\\temporaryfile")) returned 1 [0222.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89d80700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89d80700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89d80700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.973] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.973] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291971" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291971")) returned 1 [0222.974] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 1 [0222.975] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.976] WriteFile (in: hFile=0xdc, lpBuffer=0x2cca88*, nNumberOfBytesToWrite=0x18008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cca88*, lpNumberOfBytesWritten=0x18fdd8*=0x18008, lpOverlapped=0x0) returned 1 [0222.978] CloseHandle (hObject=0xdc) returned 1 [0222.978] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.979] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18000 [0222.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18008) returned 0x2b4a70 [0222.979] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x18000, lpOverlapped=0x0) returned 1 [0222.980] CloseHandle (hObject=0xdc) returned 1 [0222.980] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0 [0222.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0222.980] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.980] GetTickCount () returned 0x47493 [0222.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0222.981] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291987\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291987\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0222.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291987\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291987\\....\\temporaryfile")) returned 0 [0222.981] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291987\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291987\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291987\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291987\\temporaryfile")) returned 1 [0222.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291987\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89da6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89da6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89da6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89da6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89da6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89da6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89da6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89da6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89da6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291987\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89da6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89da6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89da6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.983] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89da6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89da6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89da6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.983] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89da6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89da6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89da6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.983] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291987\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291987\\temporaryfile")) returned 1 [0222.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89da6860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89da6860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89da6860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.983] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18291987" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18291987")) returned 1 [0222.984] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 1 [0222.985] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.986] WriteFile (in: hFile=0xdc, lpBuffer=0x2cca88*, nNumberOfBytesToWrite=0x18008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cca88*, lpNumberOfBytesWritten=0x18fdd8*=0x18008, lpOverlapped=0x0) returned 1 [0222.988] CloseHandle (hObject=0xdc) returned 1 [0222.988] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.988] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18000 [0222.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18008) returned 0x2b4a70 [0222.988] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x18000, lpOverlapped=0x0) returned 1 [0222.990] CloseHandle (hObject=0xdc) returned 1 [0222.990] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0 [0222.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0222.990] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0222.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0222.990] GetTickCount () returned 0x474a2 [0222.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0222.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0222.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0222.991] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002\\...."), lpSecurityAttributes=0x256210) returned 1 [0222.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002\\....\\temporaryfile")) returned 0 [0222.992] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002\\temporaryfile")) returned 1 [0222.993] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0222.993] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.993] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0222.993] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0222.993] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.993] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0222.993] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0222.993] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002\\temporaryfile")) returned 1 [0222.993] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0222.994] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0222.994] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002")) returned 1 [0222.994] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 1 [0222.995] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.996] WriteFile (in: hFile=0xdc, lpBuffer=0x2cca88*, nNumberOfBytesToWrite=0x18008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cca88*, lpNumberOfBytesWritten=0x18fdd8*=0x18008, lpOverlapped=0x0) returned 1 [0222.998] CloseHandle (hObject=0xdc) returned 1 [0222.999] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0222.999] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x72000 [0222.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x72008) returned 0x2450048 [0222.999] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x72000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x72000, lpOverlapped=0x0) returned 1 [0223.004] CloseHandle (hObject=0xdc) returned 1 [0223.004] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0 [0223.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.004] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.004] GetTickCount () returned 0x474a2 [0223.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.004] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002\\....\\temporaryfile")) returned 0 [0223.005] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002\\temporaryfile")) returned 1 [0223.006] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89df2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89df2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.007] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89df2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89df2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.007] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.007] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.007] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.007] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.007] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.007] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002\\temporaryfile")) returned 1 [0223.007] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89dcc9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89dcc9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89dcc9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.007] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.007] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292002" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292002")) returned 1 [0223.007] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 1 [0223.022] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.022] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x72008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x72008, lpOverlapped=0x0) returned 1 [0223.029] CloseHandle (hObject=0xdc) returned 1 [0223.029] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.030] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5000 [0223.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5008) returned 0x2b4a70 [0223.031] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x5000, lpOverlapped=0x0) returned 1 [0223.032] CloseHandle (hObject=0xdc) returned 1 [0223.032] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0 [0223.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.032] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.032] GetTickCount () returned 0x474c1 [0223.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.033] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292033\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292033\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.033] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292033\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292033\\....\\temporaryfile")) returned 0 [0223.033] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292033\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292033\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292033\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292033\\temporaryfile")) returned 1 [0223.034] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292033\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e18c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e18c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e18c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.034] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e18c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e18c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e18c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.034] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e18c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e18c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e18c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.034] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292033\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e18c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e18c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e18c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.035] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e18c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e18c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e18c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.035] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e18c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e18c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e18c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.035] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.035] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292033\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292033\\temporaryfile")) returned 1 [0223.035] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e18c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e18c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e18c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.035] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.035] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292033" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292033")) returned 1 [0223.035] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 1 [0223.036] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.037] WriteFile (in: hFile=0xdc, lpBuffer=0x2b9a88*, nNumberOfBytesToWrite=0x5008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b9a88*, lpNumberOfBytesWritten=0x18fdd8*=0x5008, lpOverlapped=0x0) returned 1 [0223.038] CloseHandle (hObject=0xdc) returned 1 [0223.038] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.038] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf000 [0223.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf008) returned 0x2b4a70 [0223.039] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0xf000, lpOverlapped=0x0) returned 1 [0223.040] CloseHandle (hObject=0xdc) returned 1 [0223.040] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0 [0223.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.040] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.040] GetTickCount () returned 0x474d1 [0223.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.041] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292049\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292049\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292049\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292049\\....\\temporaryfile")) returned 0 [0223.041] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292049\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292049\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292049\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292049\\temporaryfile")) returned 1 [0223.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292049\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e3ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e3ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e3ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.043] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e3ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e3ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e3ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.043] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e3ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e3ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e3ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.043] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292049\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e3ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e3ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e3ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.043] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e3ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e3ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e3ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.043] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e3ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e3ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e3ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.043] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.043] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292049\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292049\\temporaryfile")) returned 1 [0223.043] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e3ede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e3ede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e3ede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.043] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.043] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292049" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292049")) returned 1 [0223.043] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 1 [0223.045] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.045] WriteFile (in: hFile=0xdc, lpBuffer=0x2c3a88*, nNumberOfBytesToWrite=0xf008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c3a88*, lpNumberOfBytesWritten=0x18fdd8*=0xf008, lpOverlapped=0x0) returned 1 [0223.047] CloseHandle (hObject=0xdc) returned 1 [0223.047] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.048] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x79000 [0223.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x79008) returned 0x2350048 [0223.048] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x79000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x79000, lpOverlapped=0x0) returned 1 [0223.052] CloseHandle (hObject=0xdc) returned 1 [0223.052] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0 [0223.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.052] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.052] GetTickCount () returned 0x474e1 [0223.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.053] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292065\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292065\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292065\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292065\\....\\temporaryfile")) returned 0 [0223.054] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292065\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292065\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292065\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292065\\temporaryfile")) returned 1 [0223.055] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292065\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e64f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e64f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e64f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e64f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e64f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e64f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e64f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e64f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e64f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.055] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292065\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e64f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e64f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e64f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.055] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e64f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e64f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e64f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.055] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e64f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e64f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e64f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.055] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.055] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292065\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292065\\temporaryfile")) returned 1 [0223.056] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89e64f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89e64f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89e64f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.056] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.056] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292065" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292065")) returned 1 [0223.056] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 1 [0223.081] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.082] WriteFile (in: hFile=0xdc, lpBuffer=0x23c9060*, nNumberOfBytesToWrite=0x79008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23c9060*, lpNumberOfBytesWritten=0x18fdd8*=0x79008, lpOverlapped=0x0) returned 1 [0223.089] CloseHandle (hObject=0xdc) returned 1 [0223.091] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.092] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7000 [0223.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7008) returned 0x2b4a70 [0223.092] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x7000, lpOverlapped=0x0) returned 1 [0223.094] CloseHandle (hObject=0xdc) returned 1 [0223.094] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0 [0223.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.094] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.094] GetTickCount () returned 0x47500 [0223.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.095] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292096\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292096\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292096\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292096\\....\\temporaryfile")) returned 0 [0223.095] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292096\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292096\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292096\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292096\\temporaryfile")) returned 1 [0223.096] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292096\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89eb1200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89eb1200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89eb1200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.096] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89eb1200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89eb1200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89eb1200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.096] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89eb1200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89eb1200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89eb1200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.096] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292096\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89eb1200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89eb1200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89eb1200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.097] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89eb1200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89eb1200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89eb1200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.097] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89eb1200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89eb1200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89eb1200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.097] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.097] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292096\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292096\\temporaryfile")) returned 1 [0223.097] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89eb1200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89eb1200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89eb1200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.097] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.097] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292096" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292096")) returned 1 [0223.097] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 1 [0223.098] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.099] WriteFile (in: hFile=0xdc, lpBuffer=0x2bba88*, nNumberOfBytesToWrite=0x7008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bba88*, lpNumberOfBytesWritten=0x18fdd8*=0x7008, lpOverlapped=0x0) returned 1 [0223.100] CloseHandle (hObject=0xdc) returned 1 [0223.100] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.101] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a000 [0223.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a008) returned 0x2b4a70 [0223.101] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1a000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a000, lpOverlapped=0x0) returned 1 [0223.103] CloseHandle (hObject=0xdc) returned 1 [0223.103] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0 [0223.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.103] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.103] GetTickCount () returned 0x4750f [0223.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.104] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292111\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292111\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.104] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292111\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292111\\....\\temporaryfile")) returned 0 [0223.104] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292111\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292111\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292111\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292111\\temporaryfile")) returned 1 [0223.105] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292111\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89ed7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89ed7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89ed7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.106] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89ed7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89ed7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89ed7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.106] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89ed7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89ed7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89ed7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.106] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292111\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89ed7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89ed7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89ed7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.106] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89ed7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89ed7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89ed7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.106] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89ed7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89ed7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89ed7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.106] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.106] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292111\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292111\\temporaryfile")) returned 1 [0223.106] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89ed7360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89ed7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89ed7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.106] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.106] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292111" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292111")) returned 1 [0223.106] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 1 [0223.109] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.110] WriteFile (in: hFile=0xdc, lpBuffer=0x2cea88*, nNumberOfBytesToWrite=0x1a008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cea88*, lpNumberOfBytesWritten=0x18fdd8*=0x1a008, lpOverlapped=0x0) returned 1 [0223.112] CloseHandle (hObject=0xdc) returned 1 [0223.112] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0223.112] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89ed7360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89ed7360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0223.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0223.112] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.113] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 1 [0223.113] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0223.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11) returned 0x25cdb0 [0223.113] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.113] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4400 [0223.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4408) returned 0x2b4a70 [0223.113] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4400, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4400, lpOverlapped=0x0) returned 1 [0223.114] CloseHandle (hObject=0xe0) returned 1 [0223.115] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0 [0223.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.115] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.115] GetTickCount () returned 0x4751f [0223.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0223.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea80 [0223.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.115] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127\\....\\temporaryfile")) returned 0 [0223.116] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127\\temporaryfile")) returned 1 [0223.117] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.117] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.117] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.117] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.117] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.117] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.117] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.117] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127\\temporaryfile")) returned 1 [0223.118] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.118] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.118] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127")) returned 1 [0223.118] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 1 [0223.118] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.119] WriteFile (in: hFile=0xe0, lpBuffer=0x2b8e88*, nNumberOfBytesToWrite=0x4408, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b8e88*, lpNumberOfBytesWritten=0x18fdb8*=0x4408, lpOverlapped=0x0) returned 1 [0223.120] CloseHandle (hObject=0xe0) returned 1 [0223.120] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.120] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0223.120] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.121] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0223.121] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0223.121] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 1 [0223.121] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0223.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11) returned 0x25cdb0 [0223.121] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.121] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16e00 [0223.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16e08) returned 0x2b4a70 [0223.122] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x16e00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16e00, lpOverlapped=0x0) returned 1 [0223.124] CloseHandle (hObject=0xdc) returned 1 [0223.124] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0 [0223.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.124] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.124] GetTickCount () returned 0x4751f [0223.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0223.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.124] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.125] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127\\....\\temporaryfile")) returned 0 [0223.125] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127\\temporaryfile")) returned 1 [0223.126] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.126] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.127] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.127] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.127] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.127] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.127] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.127] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127\\temporaryfile")) returned 1 [0223.127] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89efd4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.127] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.127] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292127" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292127")) returned 1 [0223.127] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 1 [0223.129] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.129] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb888*, nNumberOfBytesToWrite=0x16e08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb888*, lpNumberOfBytesWritten=0x18fdd8*=0x16e08, lpOverlapped=0x0) returned 1 [0223.132] CloseHandle (hObject=0xdc) returned 1 [0223.132] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0223.132] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x89efd4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89efd4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0223.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0223.132] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0223.133] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd885082, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0223.137] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd885082, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0223.137] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0xfd885082, dwReserved1=0x1ca0431, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0223.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561c8 [0223.137] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.138] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x276 [0223.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x27e) returned 0x259e70 [0223.138] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x276, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x276, lpOverlapped=0x0) returned 1 [0223.140] CloseHandle (hObject=0xdc) returned 1 [0223.140] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0 [0223.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.140] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.140] GetTickCount () returned 0x4752f [0223.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.140] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292143\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292143\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292143\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292143\\....\\temporaryfile")) returned 0 [0223.141] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292143\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292143\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292143\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292143\\temporaryfile")) returned 1 [0223.142] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292143\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f23620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f23620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f23620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.142] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f23620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f23620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f23620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.142] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f23620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f23620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f23620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.142] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292143\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f23620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f23620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f23620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.142] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f23620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f23620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f23620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.142] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f23620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f23620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f23620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.143] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.143] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292143\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292143\\temporaryfile")) returned 1 [0223.143] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f23620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f23620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f23620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.143] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.143] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292143" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292143")) returned 1 [0223.143] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 1 [0223.143] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.144] WriteFile (in: hFile=0xdc, lpBuffer=0x25a100*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a100*, lpNumberOfBytesWritten=0x18fdd8*=0x280, lpOverlapped=0x0) returned 1 [0223.145] CloseHandle (hObject=0xdc) returned 1 [0223.145] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.145] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x26f [0223.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x277) returned 0x259e70 [0223.145] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x26f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x26f, lpOverlapped=0x0) returned 1 [0223.147] CloseHandle (hObject=0xdc) returned 1 [0223.147] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0 [0223.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.147] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.147] GetTickCount () returned 0x4753e [0223.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.152] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158\\....\\temporaryfile")) returned 0 [0223.153] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158\\temporaryfile")) returned 1 [0223.154] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.154] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.154] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.154] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.154] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.154] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.154] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.154] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158\\temporaryfile")) returned 1 [0223.154] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.154] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.154] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158")) returned 1 [0223.155] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 1 [0223.155] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.155] WriteFile (in: hFile=0xdc, lpBuffer=0x25a0f8*, nNumberOfBytesToWrite=0x278, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a0f8*, lpNumberOfBytesWritten=0x18fdd8*=0x278, lpOverlapped=0x0) returned 1 [0223.156] CloseHandle (hObject=0xdc) returned 1 [0223.156] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.157] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x206 [0223.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20e) returned 0x28f1f8 [0223.157] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x206, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x206, lpOverlapped=0x0) returned 1 [0223.158] CloseHandle (hObject=0xdc) returned 1 [0223.158] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg")) returned 0 [0223.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.159] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.159] GetTickCount () returned 0x4753e [0223.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.159] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158\\....\\temporaryfile")) returned 0 [0223.160] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158\\temporaryfile")) returned 1 [0223.161] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.161] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.161] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.161] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.162] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.162] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.162] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.162] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158\\temporaryfile")) returned 1 [0223.162] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f49780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f49780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f49780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.162] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.162] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292158" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292158")) returned 1 [0223.162] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned 1 [0223.162] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.163] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x210, lpOverlapped=0x0) returned 1 [0223.164] CloseHandle (hObject=0xdc) returned 1 [0223.164] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.164] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x24c [0223.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x254) returned 0x28f1f8 [0223.165] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x24c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x24c, lpOverlapped=0x0) returned 1 [0223.165] CloseHandle (hObject=0xdc) returned 1 [0223.165] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg")) returned 0 [0223.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.166] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.166] GetTickCount () returned 0x4754e [0223.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.166] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292174\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292174\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292174\\....\\temporaryfile")) returned 0 [0223.167] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292174\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292174\\temporaryfile")) returned 1 [0223.168] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292174\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f6f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f6f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f6f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.168] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f6f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f6f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f6f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.168] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f6f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f6f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f6f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.168] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292174\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f6f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f6f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f6f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.168] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f6f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f6f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f6f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.168] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f6f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f6f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f6f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.168] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.168] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292174\\temporaryfile")) returned 1 [0223.169] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x89f6f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x89f6f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x89f6f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.169] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.169] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292174" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292174")) returned 1 [0223.169] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned 1 [0223.169] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.169] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x250, lpOverlapped=0x0) returned 1 [0223.170] CloseHandle (hObject=0xdc) returned 1 [0223.171] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.171] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb7000 [0223.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb7008) returned 0x1d70020 [0223.171] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xb7000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xb7000, lpOverlapped=0x0) returned 1 [0223.234] CloseHandle (hObject=0xdc) returned 1 [0223.234] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0 [0223.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.234] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.234] GetTickCount () returned 0x4758c [0223.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.235] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292236\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292236\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292236\\....\\temporaryfile")) returned 0 [0223.236] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292236\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292236\\temporaryfile")) returned 1 [0223.237] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292236\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a007e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a007e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a007e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.237] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a007e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a007e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a007e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.237] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a007e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a007e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a007e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.237] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292236\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a007e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a007e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a007e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.238] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a007e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a007e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a007e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.238] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a007e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a007e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a007e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.238] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292236\\temporaryfile")) returned 1 [0223.238] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a007e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a007e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a007e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.238] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292236" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292236")) returned 1 [0223.238] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") returned 1 [0223.288] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.289] WriteFile (in: hFile=0xdc, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xb7008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdd8*=0xb7008, lpOverlapped=0x0) returned 1 [0223.300] CloseHandle (hObject=0xdc) returned 1 [0223.307] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.308] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2000 [0223.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2008) returned 0x299460 [0223.309] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2000, lpOverlapped=0x0) returned 1 [0223.310] CloseHandle (hObject=0xdc) returned 1 [0223.310] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0 [0223.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.310] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.310] GetTickCount () returned 0x475da [0223.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.311] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292314\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292314\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.311] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292314\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292314\\....\\temporaryfile")) returned 0 [0223.311] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292314\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292314\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292314\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292314\\temporaryfile")) returned 1 [0223.313] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292314\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0c6540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0c6540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0c6540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.313] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0c6540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0c6540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0c6540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.313] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0c6540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0c6540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0c6540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.313] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292314\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0c6540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0c6540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0c6540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.313] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0c6540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0c6540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0c6540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.313] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0c6540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0c6540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0c6540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.313] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.313] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292314\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292314\\temporaryfile")) returned 1 [0223.313] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0c6540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0c6540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0c6540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.313] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.314] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292314" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292314")) returned 1 [0223.314] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 1 [0223.314] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.315] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2008, lpOverlapped=0x0) returned 1 [0223.316] CloseHandle (hObject=0xdc) returned 1 [0223.316] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.316] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c000 [0223.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c008) returned 0x2b4a70 [0223.316] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1c000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1c000, lpOverlapped=0x0) returned 1 [0223.318] CloseHandle (hObject=0xdc) returned 1 [0223.319] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll")) returned 0 [0223.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.319] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.319] GetTickCount () returned 0x475ea [0223.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.319] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330\\....\\temporaryfile")) returned 0 [0223.320] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330\\temporaryfile")) returned 1 [0223.321] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.321] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.321] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.321] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.322] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.322] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.322] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.322] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330\\temporaryfile")) returned 1 [0223.322] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.322] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.322] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330")) returned 1 [0223.322] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll") returned 1 [0223.324] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.325] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0a88*, nNumberOfBytesToWrite=0x1c008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0a88*, lpNumberOfBytesWritten=0x18fdd8*=0x1c008, lpOverlapped=0x0) returned 1 [0223.327] CloseHandle (hObject=0xdc) returned 1 [0223.327] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.327] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2000 [0223.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2008) returned 0x299460 [0223.328] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2000, lpOverlapped=0x0) returned 1 [0223.331] CloseHandle (hObject=0xdc) returned 1 [0223.331] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll")) returned 0 [0223.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.331] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.331] GetTickCount () returned 0x475ea [0223.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.332] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330\\....\\temporaryfile")) returned 0 [0223.333] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330\\temporaryfile")) returned 1 [0223.334] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a112800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a112800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.334] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a112800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a112800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.334] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.334] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.334] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.334] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.335] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.335] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330\\temporaryfile")) returned 1 [0223.335] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a0ec6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a0ec6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a0ec6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.335] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.335] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292330" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292330")) returned 1 [0223.335] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll") returned 1 [0223.335] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.336] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2008, lpOverlapped=0x0) returned 1 [0223.337] CloseHandle (hObject=0xdc) returned 1 [0223.337] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.337] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3f000 [0223.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3f008) returned 0x2b4a70 [0223.338] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3f000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3f000, lpOverlapped=0x0) returned 1 [0223.340] CloseHandle (hObject=0xdc) returned 1 [0223.340] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0 [0223.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.340] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.340] GetTickCount () returned 0x475f9 [0223.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.341] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292345\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292345\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292345\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292345\\....\\temporaryfile")) returned 0 [0223.342] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292345\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292345\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292345\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292345\\temporaryfile")) returned 1 [0223.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292345\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a112800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a112800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a112800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.343] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a112800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a112800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a112800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.343] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a112800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a112800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a112800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292345\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a112800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a112800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a112800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.343] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a112800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a112800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a112800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.343] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a112800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a112800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a112800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.343] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.343] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292345\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292345\\temporaryfile")) returned 1 [0223.344] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a112800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a112800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a112800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.344] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292345" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292345")) returned 1 [0223.344] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 1 [0223.350] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.351] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x3f008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x3f008, lpOverlapped=0x0) returned 1 [0223.355] CloseHandle (hObject=0xdc) returned 1 [0223.356] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.357] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2000 [0223.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2008) returned 0x299460 [0223.357] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2000, lpOverlapped=0x0) returned 1 [0223.358] CloseHandle (hObject=0xdc) returned 1 [0223.358] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0 [0223.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.358] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.358] GetTickCount () returned 0x47609 [0223.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.359] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292361\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292361\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292361\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292361\\....\\temporaryfile")) returned 0 [0223.359] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292361\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292361\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292361\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292361\\temporaryfile")) returned 1 [0223.361] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292361\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a138960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a138960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a138960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.361] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a138960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a138960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a138960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.361] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a138960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a138960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a138960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.361] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292361\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a138960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a138960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a138960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.361] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a138960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a138960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a138960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.361] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a138960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a138960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a138960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.361] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.361] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292361\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292361\\temporaryfile")) returned 1 [0223.361] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a138960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a138960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a138960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.361] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.361] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292361" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292361")) returned 1 [0223.362] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 1 [0223.362] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.362] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2008, lpOverlapped=0x0) returned 1 [0223.363] CloseHandle (hObject=0xdc) returned 1 [0223.364] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.364] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18000 [0223.364] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18008) returned 0x2b4a70 [0223.364] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x18000, lpOverlapped=0x0) returned 1 [0223.366] CloseHandle (hObject=0xdc) returned 1 [0223.366] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll")) returned 0 [0223.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.366] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.366] GetTickCount () returned 0x47619 [0223.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.367] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377\\....\\temporaryfile")) returned 0 [0223.367] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377\\temporaryfile")) returned 1 [0223.368] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.369] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.369] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.369] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.369] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.369] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.369] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.369] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377\\temporaryfile")) returned 1 [0223.369] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.369] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.369] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377")) returned 1 [0223.369] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll") returned 1 [0223.371] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.372] WriteFile (in: hFile=0xdc, lpBuffer=0x2cca88*, nNumberOfBytesToWrite=0x18008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cca88*, lpNumberOfBytesWritten=0x18fdd8*=0x18008, lpOverlapped=0x0) returned 1 [0223.374] CloseHandle (hObject=0xdc) returned 1 [0223.374] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.374] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4a000 [0223.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4a008) returned 0x2b4a70 [0223.374] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4a000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4a000, lpOverlapped=0x0) returned 1 [0223.377] CloseHandle (hObject=0xdc) returned 1 [0223.377] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0 [0223.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.378] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.378] GetTickCount () returned 0x47619 [0223.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.378] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377\\....\\temporaryfile")) returned 0 [0223.379] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377\\temporaryfile")) returned 1 [0223.381] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a184c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a184c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.381] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a184c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a184c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.381] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.381] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.381] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.381] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.381] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377\\temporaryfile")) returned 1 [0223.381] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a15eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a15eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a15eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.381] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292377" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292377")) returned 1 [0223.381] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 1 [0223.387] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.387] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x4a008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x4a008, lpOverlapped=0x0) returned 1 [0223.394] CloseHandle (hObject=0xdc) returned 1 [0223.394] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.395] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2000 [0223.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2008) returned 0x299460 [0223.395] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2000, lpOverlapped=0x0) returned 1 [0223.397] CloseHandle (hObject=0xdc) returned 1 [0223.397] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0 [0223.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.397] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.397] GetTickCount () returned 0x47638 [0223.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.397] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408\\....\\temporaryfile")) returned 0 [0223.398] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408\\temporaryfile")) returned 1 [0223.399] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.399] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.399] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.399] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.399] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.399] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.400] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.400] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408\\temporaryfile")) returned 1 [0223.400] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.400] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.400] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408")) returned 1 [0223.400] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 1 [0223.400] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.401] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2008, lpOverlapped=0x0) returned 1 [0223.402] CloseHandle (hObject=0xdc) returned 1 [0223.402] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.403] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2000 [0223.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2008) returned 0x299460 [0223.403] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2000, lpOverlapped=0x0) returned 1 [0223.404] CloseHandle (hObject=0xdc) returned 1 [0223.404] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0 [0223.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.405] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.405] GetTickCount () returned 0x47638 [0223.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.405] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408\\....\\temporaryfile")) returned 0 [0223.406] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408\\temporaryfile")) returned 1 [0223.407] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.407] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.407] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.407] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.407] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.407] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.408] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.408] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408\\temporaryfile")) returned 1 [0223.408] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1aad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1aad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1aad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.408] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.408] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292408" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292408")) returned 1 [0223.408] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 1 [0223.408] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.409] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2008, lpOverlapped=0x0) returned 1 [0223.410] CloseHandle (hObject=0xdc) returned 1 [0223.410] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.411] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5f000 [0223.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5f008) returned 0x2b4a70 [0223.411] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5f000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x5f000, lpOverlapped=0x0) returned 1 [0223.416] CloseHandle (hObject=0xdc) returned 1 [0223.416] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0 [0223.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.417] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.417] GetTickCount () returned 0x47647 [0223.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.417] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292423\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292423\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292423\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292423\\....\\temporaryfile")) returned 0 [0223.418] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292423\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292423\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292423\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292423\\temporaryfile")) returned 1 [0223.419] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292423\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1d0ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1d0ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1d0ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.419] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1d0ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1d0ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1d0ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.419] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1d0ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1d0ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1d0ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.419] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292423\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1d0ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1d0ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1d0ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.419] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1d0ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1d0ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1d0ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.419] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1d0ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1d0ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1d0ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.419] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.419] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292423\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292423\\temporaryfile")) returned 1 [0223.420] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1d0ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a1d0ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a1d0ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.420] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.420] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292423" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292423")) returned 1 [0223.420] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll") returned 1 [0223.427] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.428] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x5f008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x5f008, lpOverlapped=0x0) returned 1 [0223.436] CloseHandle (hObject=0xdc) returned 1 [0223.436] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.437] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d000 [0223.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d008) returned 0x2b4a70 [0223.437] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3d000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3d000, lpOverlapped=0x0) returned 1 [0223.440] CloseHandle (hObject=0xdc) returned 1 [0223.441] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0 [0223.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.441] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.441] GetTickCount () returned 0x47657 [0223.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.442] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292439\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292439\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.442] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292439\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292439\\....\\temporaryfile")) returned 0 [0223.442] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292439\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292439\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292439\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292439\\temporaryfile")) returned 1 [0223.443] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292439\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1f7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a21d1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a21d1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a1f7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a21d1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a21d1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a21d1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a21d1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a21d1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292439\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a21d1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a21d1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a21d1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.444] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a21d1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a21d1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a21d1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.444] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a21d1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a21d1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a21d1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.444] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.444] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292439\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292439\\temporaryfile")) returned 1 [0223.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a21d1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a21d1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a21d1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.444] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.444] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292439" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292439")) returned 1 [0223.444] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 1 [0223.448] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.449] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x3d008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x3d008, lpOverlapped=0x0) returned 1 [0223.454] CloseHandle (hObject=0xdc) returned 1 [0223.454] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.455] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2000 [0223.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2008) returned 0x299460 [0223.455] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2000, lpOverlapped=0x0) returned 1 [0223.456] CloseHandle (hObject=0xdc) returned 1 [0223.456] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0 [0223.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.456] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.457] GetTickCount () returned 0x47667 [0223.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.457] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292455\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292455\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.463] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292455\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292455\\....\\temporaryfile")) returned 0 [0223.463] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292455\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292455\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292455\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292455\\temporaryfile")) returned 1 [0223.465] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292455\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a21d1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.465] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a21d1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.465] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.465] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292455\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.465] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.465] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.465] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.465] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292455\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292455\\temporaryfile")) returned 1 [0223.465] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.465] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.465] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292455" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292455")) returned 1 [0223.466] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 1 [0223.466] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.466] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2008, lpOverlapped=0x0) returned 1 [0223.467] CloseHandle (hObject=0xdc) returned 1 [0223.468] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.469] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe000 [0223.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe008) returned 0x2b4a70 [0223.469] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xe000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0xe000, lpOverlapped=0x0) returned 1 [0223.470] CloseHandle (hObject=0xdc) returned 1 [0223.470] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0 [0223.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.471] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.471] GetTickCount () returned 0x47676 [0223.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.471] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292470\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292470\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292470\\....\\temporaryfile")) returned 0 [0223.472] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292470\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292470\\temporaryfile")) returned 1 [0223.473] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292470\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.474] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.474] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.474] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292470\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.474] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.474] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.474] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.474] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292470\\temporaryfile")) returned 1 [0223.474] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a243300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a243300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a243300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.474] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.474] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292470" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292470")) returned 1 [0223.474] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 1 [0223.475] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.477] WriteFile (in: hFile=0xdc, lpBuffer=0x2c2a88*, nNumberOfBytesToWrite=0xe008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c2a88*, lpNumberOfBytesWritten=0x18fdd8*=0xe008, lpOverlapped=0x0) returned 1 [0223.479] CloseHandle (hObject=0xdc) returned 1 [0223.479] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0223.479] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8a269460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a269460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0223.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0223.479] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.481] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 1 [0223.481] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0223.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10) returned 0x256210 [0223.481] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.481] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2600 [0223.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2608) returned 0x299460 [0223.481] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x2600, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x2600, lpOverlapped=0x0) returned 1 [0223.483] CloseHandle (hObject=0xe0) returned 1 [0223.483] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0 [0223.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.483] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.483] GetTickCount () returned 0x47686 [0223.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.484] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292486\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292486\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.484] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292486\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292486\\....\\temporaryfile")) returned 0 [0223.484] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292486\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292486\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292486\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292486\\temporaryfile")) returned 1 [0223.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292486\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a269460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a269460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a269460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a269460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a269460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a269460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a269460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a269460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a269460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.486] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292486\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a269460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a269460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a269460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0223.486] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a269460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a269460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a269460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.486] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a269460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a269460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a269460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.486] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0223.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292486\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292486\\temporaryfile")) returned 1 [0223.486] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a269460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a269460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a269460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.486] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292486" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292486")) returned 1 [0223.486] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 1 [0223.487] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.487] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2608, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdb8*=0x2608, lpOverlapped=0x0) returned 1 [0223.488] CloseHandle (hObject=0xe0) returned 1 [0223.488] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.489] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1400 [0223.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1408) returned 0x25b528 [0223.489] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x1400, lpOverlapped=0x0) returned 1 [0223.490] CloseHandle (hObject=0xe0) returned 1 [0223.490] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui")) returned 0 [0223.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.490] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.491] GetTickCount () returned 0x47695 [0223.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.491] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.492] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501\\....\\temporaryfile")) returned 0 [0223.492] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501\\temporaryfile")) returned 1 [0223.493] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.493] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.493] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.493] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0223.494] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.494] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.494] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0223.494] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501\\temporaryfile")) returned 1 [0223.494] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.494] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.494] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501")) returned 1 [0223.494] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned 1 [0223.494] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.495] WriteFile (in: hFile=0xe0, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1408, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdb8*=0x1408, lpOverlapped=0x0) returned 1 [0223.496] CloseHandle (hObject=0xe0) returned 1 [0223.496] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.496] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1600 [0223.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1608) returned 0x299460 [0223.497] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x1600, lpOverlapped=0x0) returned 1 [0223.498] CloseHandle (hObject=0xe0) returned 1 [0223.498] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0 [0223.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.498] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.498] GetTickCount () returned 0x47695 [0223.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.499] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501\\....\\temporaryfile")) returned 0 [0223.499] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501\\temporaryfile")) returned 1 [0223.500] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.501] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.501] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.501] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0223.501] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.501] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.501] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0223.501] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501\\temporaryfile")) returned 1 [0223.501] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a28f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a28f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a28f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.501] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.501] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292501" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292501")) returned 1 [0223.501] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 1 [0223.502] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.502] WriteFile (in: hFile=0xe0, lpBuffer=0x29aa78*, nNumberOfBytesToWrite=0x1608, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29aa78*, lpNumberOfBytesWritten=0x18fdb8*=0x1608, lpOverlapped=0x0) returned 1 [0223.503] CloseHandle (hObject=0xe0) returned 1 [0223.503] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.505] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3600 [0223.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3608) returned 0x2b4a70 [0223.505] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x3600, lpOverlapped=0x0) returned 1 [0223.506] CloseHandle (hObject=0xe0) returned 1 [0223.506] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0 [0223.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.506] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.507] GetTickCount () returned 0x476a5 [0223.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.508] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517\\....\\temporaryfile")) returned 0 [0223.508] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517\\temporaryfile")) returned 1 [0223.509] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.509] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.509] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.509] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0223.509] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.509] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.510] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0223.510] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517\\temporaryfile")) returned 1 [0223.510] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.510] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.510] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517")) returned 1 [0223.510] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 1 [0223.510] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.511] WriteFile (in: hFile=0xe0, lpBuffer=0x2b8088*, nNumberOfBytesToWrite=0x3608, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b8088*, lpNumberOfBytesWritten=0x18fdb8*=0x3608, lpOverlapped=0x0) returned 1 [0223.512] CloseHandle (hObject=0xe0) returned 1 [0223.512] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.513] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1c00 [0223.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c08) returned 0x299460 [0223.513] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x1c00, lpOverlapped=0x0) returned 1 [0223.514] CloseHandle (hObject=0xe0) returned 1 [0223.514] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0 [0223.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.514] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.514] GetTickCount () returned 0x476a5 [0223.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0223.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.515] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517\\....\\temporaryfile")) returned 0 [0223.516] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517\\temporaryfile")) returned 1 [0223.517] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.517] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.517] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.517] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0223.517] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.517] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.517] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0223.518] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517\\temporaryfile")) returned 1 [0223.518] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2b5720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2b5720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2b5720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.518] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.518] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292517" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292517")) returned 1 [0223.518] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 1 [0223.518] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.519] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x1c08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdb8*=0x1c08, lpOverlapped=0x0) returned 1 [0223.520] CloseHandle (hObject=0xe0) returned 1 [0223.520] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.521] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1600 [0223.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1608) returned 0x299460 [0223.521] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x1600, lpOverlapped=0x0) returned 1 [0223.522] CloseHandle (hObject=0xe0) returned 1 [0223.522] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0 [0223.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.522] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.522] GetTickCount () returned 0x476b5 [0223.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0223.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.523] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.523] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533\\....\\temporaryfile")) returned 0 [0223.523] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533\\temporaryfile")) returned 1 [0223.524] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.525] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.525] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.525] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0223.525] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.525] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.525] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0223.525] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533\\temporaryfile")) returned 1 [0223.525] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.525] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.525] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533")) returned 1 [0223.525] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned 1 [0223.526] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.526] WriteFile (in: hFile=0xe0, lpBuffer=0x29aa78*, nNumberOfBytesToWrite=0x1608, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29aa78*, lpNumberOfBytesWritten=0x18fdb8*=0x1608, lpOverlapped=0x0) returned 1 [0223.527] CloseHandle (hObject=0xe0) returned 1 [0223.527] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.527] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0223.528] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.528] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0223.528] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf53e90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0223.529] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf53e90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0223.529] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf53e90, dwReserved1=0x1d301bf, cFileName="1033", cAlternateFileName="")) returned 1 [0223.529] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf53e90, dwReserved1=0x1d301bf, cFileName="1033", cAlternateFileName="")) returned 0 [0223.529] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0223.529] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf53e90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0223.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0223.529] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf53e90, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.530] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf53e90, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0223.530] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0xf53e90, dwReserved1=0x1d301bf, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0223.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561c8 [0223.530] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.530] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe580 [0223.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe588) returned 0x2b4a70 [0223.530] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xe580, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xe580, lpOverlapped=0x0) returned 1 [0223.533] CloseHandle (hObject=0xe0) returned 1 [0223.533] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll")) returned 1 [0223.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.534] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.534] GetTickCount () returned 0x476b5 [0223.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0223.535] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533\\....\\temporaryfile")) returned 0 [0223.536] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533\\temporaryfile")) returned 1 [0223.537] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3019e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3019e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.537] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3019e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3019e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.537] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.537] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0223.537] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.537] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.537] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0223.537] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533\\temporaryfile")) returned 1 [0223.537] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a2db880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a2db880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a2db880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.537] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.537] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292533" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292533")) returned 1 [0223.538] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 0 [0223.539] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0223.539] WriteFile (in: hFile=0xe0, lpBuffer=0x2c3008*, nNumberOfBytesToWrite=0xe588, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c3008*, lpNumberOfBytesWritten=0x18fdb8*=0xe588, lpOverlapped=0x0) returned 1 [0223.541] CloseHandle (hObject=0xe0) returned 1 [0223.541] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.541] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8a3019e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3019e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0223.541] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.541] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0223.542] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd885082, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0223.543] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd885082, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0223.543] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd885082, dwReserved1=0x1ca0431, cFileName="en-US", cAlternateFileName="")) returned 1 [0223.543] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0xfd885082, dwReserved1=0x1ca0431, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0223.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561c8 [0223.543] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.544] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f000 [0223.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f008) returned 0x2b4a70 [0223.544] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1f000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1f000, lpOverlapped=0x0) returned 1 [0223.546] CloseHandle (hObject=0xdc) returned 1 [0223.546] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0 [0223.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.547] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.547] GetTickCount () returned 0x476c4 [0223.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.547] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292548\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292548\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292548\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292548\\....\\temporaryfile")) returned 0 [0223.548] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292548\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292548\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292548\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292548\\temporaryfile")) returned 1 [0223.549] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292548\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3019e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3019e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3019e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.549] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3019e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3019e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3019e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.549] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3019e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3019e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3019e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.549] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292548\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3019e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3019e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3019e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.549] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3019e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3019e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3019e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.549] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3019e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3019e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3019e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.550] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.550] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292548\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292548\\temporaryfile")) returned 1 [0223.550] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3019e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3019e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3019e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.550] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.550] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292548" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292548")) returned 1 [0223.550] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 1 [0223.552] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.553] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3a88*, nNumberOfBytesToWrite=0x1f008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3a88*, lpNumberOfBytesWritten=0x18fdd8*=0x1f008, lpOverlapped=0x0) returned 1 [0223.556] CloseHandle (hObject=0xdc) returned 1 [0223.556] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.557] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6a000 [0223.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6a008) returned 0x2450048 [0223.557] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x6a000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x6a000, lpOverlapped=0x0) returned 1 [0223.563] CloseHandle (hObject=0xdc) returned 1 [0223.563] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0 [0223.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.563] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.563] GetTickCount () returned 0x476d4 [0223.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.564] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292564\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292564\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292564\\....\\temporaryfile")) returned 0 [0223.565] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292564\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292564\\temporaryfile")) returned 1 [0223.566] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292564\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a327b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a327b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a327b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.566] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a327b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a327b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a327b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.566] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a327b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a327b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a327b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.566] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292564\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a327b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a327b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a327b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.566] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a327b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a327b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a327b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.566] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a327b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a327b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a327b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.566] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.566] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292564\\temporaryfile")) returned 1 [0223.566] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a327b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a327b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a327b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.567] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.567] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292564" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292564")) returned 1 [0223.567] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 1 [0223.578] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.578] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x6a008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x6a008, lpOverlapped=0x0) returned 1 [0223.594] CloseHandle (hObject=0xdc) returned 1 [0223.594] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.595] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb6000 [0223.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb6008) returned 0x1d70020 [0223.595] ReadFile (in: hFile=0xdc, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xb6000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdf0*=0xb6000, lpOverlapped=0x0) returned 1 [0223.619] CloseHandle (hObject=0xdc) returned 1 [0223.619] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0 [0223.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.619] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.619] GetTickCount () returned 0x47712 [0223.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.620] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292626\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292626\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292626\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292626\\....\\temporaryfile")) returned 0 [0223.620] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292626\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292626\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292626\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292626\\temporaryfile")) returned 1 [0223.622] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292626\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3c00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3c00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3c00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.622] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3c00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3c00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3c00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.622] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3c00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3c00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3c00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.622] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292626\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3c00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3c00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3c00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.622] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3c00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3c00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3c00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.622] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3c00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3c00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3c00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.622] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292626\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292626\\temporaryfile")) returned 1 [0223.622] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a3c00c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a3c00c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a3c00c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.622] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292626" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292626")) returned 1 [0223.622] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 1 [0223.665] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.666] WriteFile (in: hFile=0xdc, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xb6008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdd8*=0xb6008, lpOverlapped=0x0) returned 1 [0223.677] CloseHandle (hObject=0xdc) returned 1 [0223.684] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.684] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf000 [0223.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf008) returned 0x2b4a70 [0223.684] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0xf000, lpOverlapped=0x0) returned 1 [0223.686] CloseHandle (hObject=0xdc) returned 1 [0223.686] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0 [0223.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.686] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.686] GetTickCount () returned 0x47751 [0223.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.687] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292689\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292689\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292689\\....\\temporaryfile")) returned 0 [0223.687] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292689\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292689\\temporaryfile")) returned 1 [0223.688] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292689\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a458640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a458640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a458640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.689] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a458640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a458640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a458640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.689] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a458640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a458640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a458640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.689] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292689\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a458640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a458640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a458640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.689] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a458640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a458640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a458640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.689] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a458640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a458640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a458640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.689] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.689] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292689\\temporaryfile")) returned 1 [0223.689] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a458640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a458640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a458640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.689] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.689] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292689" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292689")) returned 1 [0223.689] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 1 [0223.691] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.692] WriteFile (in: hFile=0xdc, lpBuffer=0x2c3a88*, nNumberOfBytesToWrite=0xf008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c3a88*, lpNumberOfBytesWritten=0x18fdd8*=0xf008, lpOverlapped=0x0) returned 1 [0223.693] CloseHandle (hObject=0xdc) returned 1 [0223.694] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.694] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x20000 [0223.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20008) returned 0x2b4a70 [0223.694] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x20000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x20000, lpOverlapped=0x0) returned 1 [0223.696] CloseHandle (hObject=0xdc) returned 1 [0223.696] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0 [0223.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.696] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.696] GetTickCount () returned 0x47760 [0223.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.697] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292704\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292704\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.697] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292704\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292704\\....\\temporaryfile")) returned 0 [0223.697] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292704\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292704\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292704\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292704\\temporaryfile")) returned 1 [0223.698] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292704\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a47e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a47e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a47e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.698] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a47e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a47e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a47e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.699] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a47e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a47e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a47e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.699] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292704\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a47e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a47e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a47e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.699] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a47e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a47e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a47e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.699] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a47e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a47e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a47e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.699] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.699] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292704\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292704\\temporaryfile")) returned 1 [0223.699] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a47e7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a47e7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a47e7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.699] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.699] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292704" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292704")) returned 1 [0223.699] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 1 [0223.702] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.703] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4a88*, nNumberOfBytesToWrite=0x20008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4a88*, lpNumberOfBytesWritten=0x18fdd8*=0x20008, lpOverlapped=0x0) returned 1 [0223.705] CloseHandle (hObject=0xdc) returned 1 [0223.705] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.706] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9000 [0223.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9008) returned 0x2b4a70 [0223.706] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x9000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x9000, lpOverlapped=0x0) returned 1 [0223.708] CloseHandle (hObject=0xdc) returned 1 [0223.708] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0 [0223.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.708] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.708] GetTickCount () returned 0x47770 [0223.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.709] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292720\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292720\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292720\\....\\temporaryfile")) returned 0 [0223.709] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292720\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292720\\temporaryfile")) returned 1 [0223.711] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292720\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4a4900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4a4900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4a4900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.711] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4a4900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4a4900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4a4900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.711] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4a4900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4a4900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4a4900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.711] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292720\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4a4900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4a4900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4a4900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.711] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4a4900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4a4900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4a4900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.711] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4a4900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4a4900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4a4900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.711] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.711] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292720\\temporaryfile")) returned 1 [0223.711] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4a4900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4a4900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4a4900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.711] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.711] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292720" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292720")) returned 1 [0223.712] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 1 [0223.712] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.713] WriteFile (in: hFile=0xdc, lpBuffer=0x2bda88*, nNumberOfBytesToWrite=0x9008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bda88*, lpNumberOfBytesWritten=0x18fdd8*=0x9008, lpOverlapped=0x0) returned 1 [0223.714] CloseHandle (hObject=0xdc) returned 1 [0223.714] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.715] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10d000 [0223.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10d008) returned 0x2650020 [0223.715] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x10d000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x10d000, lpOverlapped=0x0) returned 1 [0223.752] CloseHandle (hObject=0xdc) returned 1 [0223.752] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0 [0223.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.753] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.753] GetTickCount () returned 0x4778f [0223.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0223.753] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292751\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292751\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292751\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292751\\....\\temporaryfile")) returned 0 [0223.758] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292751\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292751\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292751\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292751\\temporaryfile")) returned 1 [0223.760] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292751\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4f0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a516d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a516d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.760] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4f0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a516d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a516d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.760] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4f0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4f0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4f0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.760] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292751\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4f0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4f0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4f0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0223.760] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4f0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4f0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4f0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.760] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4f0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4f0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4f0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.760] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0223.760] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292751\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292751\\temporaryfile")) returned 1 [0223.760] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a4f0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a4f0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a4f0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.760] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.760] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292751" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292751")) returned 1 [0223.760] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 1 [0223.828] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.829] WriteFile (in: hFile=0xdc, lpBuffer=0x2870028*, nNumberOfBytesToWrite=0x10d008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2870028*, lpNumberOfBytesWritten=0x18fdd8*=0x10d008, lpOverlapped=0x0) returned 1 [0223.847] CloseHandle (hObject=0xdc) returned 1 [0223.864] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.865] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14000 [0223.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14008) returned 0x2b4a70 [0223.865] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x14000, lpOverlapped=0x0) returned 1 [0223.866] CloseHandle (hObject=0xdc) returned 1 [0223.867] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0 [0223.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.867] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.867] GetTickCount () returned 0x4780c [0223.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.868] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876\\....\\temporaryfile")) returned 0 [0223.868] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876\\temporaryfile")) returned 1 [0223.869] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.870] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.870] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.870] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.870] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.870] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876\\temporaryfile")) returned 1 [0223.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.870] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.870] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876")) returned 1 [0223.870] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 1 [0223.872] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.872] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8a88*, nNumberOfBytesToWrite=0x14008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8a88*, lpNumberOfBytesWritten=0x18fdd8*=0x14008, lpOverlapped=0x0) returned 1 [0223.874] CloseHandle (hObject=0xdc) returned 1 [0223.874] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.875] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x264c [0223.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2654) returned 0x299460 [0223.875] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x264c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x264c, lpOverlapped=0x0) returned 1 [0223.877] CloseHandle (hObject=0xdc) returned 1 [0223.877] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0 [0223.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.877] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.877] GetTickCount () returned 0x4780c [0223.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.878] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876\\....\\temporaryfile")) returned 0 [0223.879] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876\\temporaryfile")) returned 1 [0223.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a647820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a647820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.880] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a647820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a647820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.880] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.881] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.881] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.881] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.881] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876\\temporaryfile")) returned 1 [0223.881] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6216c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6216c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6216c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.881] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.881] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292876" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292876")) returned 1 [0223.881] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 1 [0223.882] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.882] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2650, lpOverlapped=0x0) returned 1 [0223.883] CloseHandle (hObject=0xdc) returned 1 [0223.883] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.883] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x26f7 [0223.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26ff) returned 0x299460 [0223.884] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x26f7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x26f7, lpOverlapped=0x0) returned 1 [0223.885] CloseHandle (hObject=0xdc) returned 1 [0223.885] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0 [0223.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0223.885] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.885] GetTickCount () returned 0x4781b [0223.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.886] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292891\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292891\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0223.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292891\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292891\\....\\temporaryfile")) returned 0 [0223.887] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292891\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292891\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292891\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292891\\temporaryfile")) returned 1 [0223.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292891\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a647820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a647820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a647820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.888] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a647820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a647820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a647820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.888] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a647820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a647820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a647820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292891\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a647820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a647820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a647820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.888] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a647820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a647820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a647820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.889] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a647820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a647820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a647820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.889] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.889] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292891\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292891\\temporaryfile")) returned 1 [0223.889] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a647820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a647820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a647820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.889] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.889] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292891" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292891")) returned 1 [0223.889] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 1 [0223.889] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.891] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2700, lpOverlapped=0x0) returned 1 [0223.892] CloseHandle (hObject=0xdc) returned 1 [0223.892] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0223.892] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x128000 [0223.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x128008) returned 0x2650020 [0223.893] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x128000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x128000, lpOverlapped=0x0) returned 1 [0223.927] CloseHandle (hObject=0xdc) returned 1 [0223.927] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0 [0223.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0223.927] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0223.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0223.927] GetTickCount () returned 0x4784a [0223.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0223.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0223.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0223.927] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292938\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292938\\...."), lpSecurityAttributes=0x256210) returned 1 [0223.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292938\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292938\\....\\temporaryfile")) returned 0 [0223.928] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292938\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292938\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292938\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292938\\temporaryfile")) returned 1 [0223.929] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292938\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6b9c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6b9c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6b9c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0223.929] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6b9c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6b9c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6b9c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.929] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6b9c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6b9c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6b9c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0223.929] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292938\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6b9c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6b9c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6b9c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0223.930] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6b9c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6b9c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6b9c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.930] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6b9c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6b9c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6b9c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0223.930] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0223.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292938\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292938\\temporaryfile")) returned 1 [0223.930] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a6b9c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a6b9c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a6b9c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0223.930] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0223.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18292938" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18292938")) returned 1 [0223.930] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 1 [0224.005] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0224.006] WriteFile (in: hFile=0xdc, lpBuffer=0x28b0028*, nNumberOfBytesToWrite=0x128008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x28b0028*, lpNumberOfBytesWritten=0x18fdd8*=0x128008, lpOverlapped=0x0) returned 1 [0224.164] CloseHandle (hObject=0xdc) returned 1 [0224.175] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0224.179] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4000 [0224.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4008) returned 0x2b4a70 [0224.179] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4000, lpOverlapped=0x0) returned 1 [0224.180] CloseHandle (hObject=0xdc) returned 1 [0224.180] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0 [0224.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0224.180] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.180] GetTickCount () returned 0x47944 [0224.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0224.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0224.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0224.181] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293188\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0224.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293188\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293188\\....\\temporaryfile")) returned 0 [0224.182] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293188\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293188\\temporaryfile")) returned 1 [0224.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293188\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a91b240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a91b240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a91b240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0224.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a91b240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a91b240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a91b240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a91b240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a91b240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a91b240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293188\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a91b240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a91b240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a91b240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0224.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a91b240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a91b240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a91b240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a91b240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a91b240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a91b240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.184] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0224.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293188\\temporaryfile")) returned 1 [0224.184] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a91b240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a91b240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a91b240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.184] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0224.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293188" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293188")) returned 1 [0224.184] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 1 [0224.185] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0224.185] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8a88*, nNumberOfBytesToWrite=0x4008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8a88*, lpNumberOfBytesWritten=0x18fdd8*=0x4008, lpOverlapped=0x0) returned 1 [0224.186] CloseHandle (hObject=0xdc) returned 1 [0224.186] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0224.187] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x59000 [0224.187] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x59008) returned 0x2b4a70 [0224.187] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x59000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x59000, lpOverlapped=0x0) returned 1 [0224.191] CloseHandle (hObject=0xdc) returned 1 [0224.191] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0 [0224.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0224.191] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.191] GetTickCount () returned 0x47953 [0224.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0224.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0224.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0224.192] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293203\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293203\\...."), lpSecurityAttributes=0x256210) returned 1 [0224.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293203\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293203\\....\\temporaryfile")) returned 0 [0224.192] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293203\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293203\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293203\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293203\\temporaryfile")) returned 1 [0224.193] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293203\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9413a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9413a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9413a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0224.194] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9413a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9413a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9413a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.194] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9413a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9413a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9413a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.194] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293203\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9413a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9413a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9413a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0224.194] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9413a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9413a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9413a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.194] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9413a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9413a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9413a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.194] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0224.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293203\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293203\\temporaryfile")) returned 1 [0224.194] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9413a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9413a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9413a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.194] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0224.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293203" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293203")) returned 1 [0224.194] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 1 [0224.205] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0224.205] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x59008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x59008, lpOverlapped=0x0) returned 1 [0224.211] CloseHandle (hObject=0xdc) returned 1 [0224.211] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0224.212] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2000 [0224.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2008) returned 0x299460 [0224.212] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2000, lpOverlapped=0x0) returned 1 [0224.213] CloseHandle (hObject=0xdc) returned 1 [0224.213] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0 [0224.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0224.213] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.213] GetTickCount () returned 0x47963 [0224.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0224.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0224.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0224.214] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293219\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293219\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0224.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293219\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293219\\....\\temporaryfile")) returned 0 [0224.215] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293219\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293219\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293219\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293219\\temporaryfile")) returned 1 [0224.216] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293219\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a967500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a967500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a967500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0224.216] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a967500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a967500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a967500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.216] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a967500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a967500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a967500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.216] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293219\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a967500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a967500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a967500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0224.217] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a967500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a967500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a967500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.217] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a967500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a967500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a967500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.217] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0224.217] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293219\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293219\\temporaryfile")) returned 1 [0224.217] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a967500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a967500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a967500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.217] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0224.217] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293219" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293219")) returned 1 [0224.217] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 1 [0224.218] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0224.218] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2008, lpOverlapped=0x0) returned 1 [0224.219] CloseHandle (hObject=0xdc) returned 1 [0224.219] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0224.220] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x44e18 [0224.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x44e20) returned 0x2b4a70 [0224.220] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x44e18, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x44e18, lpOverlapped=0x0) returned 1 [0224.224] CloseHandle (hObject=0xdc) returned 1 [0224.224] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll")) returned 1 [0224.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0224.227] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.227] GetTickCount () returned 0x47973 [0224.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0224.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0224.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0224.227] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293235\\...."), lpSecurityAttributes=0x256210) returned 1 [0224.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293235\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293235\\....\\temporaryfile")) returned 0 [0224.228] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293235\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293235\\temporaryfile")) returned 1 [0224.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293235\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a98d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a98d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a98d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0224.229] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a98d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a98d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a98d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.229] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a98d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a98d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a98d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293235\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a98d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a98d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a98d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0224.229] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a98d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a98d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a98d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.229] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a98d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a98d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a98d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.230] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0224.230] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293235\\temporaryfile")) returned 1 [0224.230] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a98d660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a98d660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a98d660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.230] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0224.230] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293235" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293235")) returned 1 [0224.230] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 0 [0224.238] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0224.238] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x44e20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x44e20, lpOverlapped=0x0) returned 1 [0224.243] CloseHandle (hObject=0xdc) returned 1 [0224.243] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0224.244] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30a18 [0224.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30a20) returned 0x2b4a70 [0224.244] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x30a18, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x30a18, lpOverlapped=0x0) returned 1 [0224.246] CloseHandle (hObject=0xdc) returned 1 [0224.246] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll")) returned 1 [0224.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0224.248] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.248] GetTickCount () returned 0x47982 [0224.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0224.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0224.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0224.249] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293250\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293250\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0224.249] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293250\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293250\\....\\temporaryfile")) returned 0 [0224.249] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293250\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293250\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293250\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293250\\temporaryfile")) returned 1 [0224.251] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293250\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9b37c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9b37c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9b37c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0224.251] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9b37c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9b37c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9b37c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.251] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9b37c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9b37c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9b37c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.251] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293250\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9b37c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9b37c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9b37c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0224.251] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9b37c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9b37c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9b37c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.251] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9b37c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9b37c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9b37c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.251] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0224.251] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293250\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293250\\temporaryfile")) returned 1 [0224.251] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9b37c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9b37c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9b37c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.251] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0224.251] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293250" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293250")) returned 1 [0224.251] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 0 [0224.255] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0224.255] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x30a20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x30a20, lpOverlapped=0x0) returned 1 [0224.258] CloseHandle (hObject=0xdc) returned 1 [0224.258] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0224.259] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8a9d9920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9d9920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0224.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0224.259] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0224.259] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 1 [0224.259] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x1eab37af, dwReserved1=0x1cbf8ea, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0224.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11) returned 0x25cdf0 [0224.259] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.260] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1600 [0224.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1608) returned 0x299460 [0224.260] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x1600, lpOverlapped=0x0) returned 1 [0224.261] CloseHandle (hObject=0xe0) returned 1 [0224.261] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0 [0224.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0224.261] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.261] GetTickCount () returned 0x47992 [0224.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0224.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0224.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0224.262] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293266\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293266\\...."), lpSecurityAttributes=0x256210) returned 1 [0224.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293266\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293266\\....\\temporaryfile")) returned 0 [0224.262] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293266\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293266\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293266\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293266\\temporaryfile")) returned 1 [0224.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293266\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9d9920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9d9920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9d9920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0224.264] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9d9920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9d9920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9d9920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.264] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9d9920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9d9920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9d9920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.264] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293266\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9d9920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9d9920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9d9920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0224.264] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9d9920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9d9920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9d9920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.264] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9d9920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9d9920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9d9920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.264] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0224.264] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293266\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293266\\temporaryfile")) returned 1 [0224.264] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9d9920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9d9920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9d9920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.264] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0224.264] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293266" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293266")) returned 1 [0224.264] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 1 [0224.265] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.267] WriteFile (in: hFile=0xe0, lpBuffer=0x29aa78*, nNumberOfBytesToWrite=0x1608, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29aa78*, lpNumberOfBytesWritten=0x18fdb8*=0x1608, lpOverlapped=0x0) returned 1 [0224.268] CloseHandle (hObject=0xe0) returned 1 [0224.268] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.269] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xba00 [0224.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xba08) returned 0x2b4a70 [0224.269] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xba00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xba00, lpOverlapped=0x0) returned 1 [0224.270] CloseHandle (hObject=0xe0) returned 1 [0224.270] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0 [0224.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0224.270] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.270] GetTickCount () returned 0x479a1 [0224.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0224.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0224.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0224.271] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281\\...."), lpSecurityAttributes=0x256210) returned 1 [0224.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281\\....\\temporaryfile")) returned 0 [0224.272] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281\\temporaryfile")) returned 1 [0224.273] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0224.273] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.273] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.273] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0224.273] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.273] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.273] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0224.273] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281\\temporaryfile")) returned 1 [0224.273] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.273] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0224.273] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281")) returned 1 [0224.274] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 1 [0224.275] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.275] WriteFile (in: hFile=0xe0, lpBuffer=0x2c0488*, nNumberOfBytesToWrite=0xba08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c0488*, lpNumberOfBytesWritten=0x18fdb8*=0xba08, lpOverlapped=0x0) returned 1 [0224.276] CloseHandle (hObject=0xe0) returned 1 [0224.277] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.277] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xac00 [0224.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xac08) returned 0x2b4a70 [0224.277] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xac00, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xac00, lpOverlapped=0x0) returned 1 [0224.279] CloseHandle (hObject=0xe0) returned 1 [0224.279] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0 [0224.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0224.279] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.279] GetTickCount () returned 0x479a1 [0224.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0224.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0224.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0224.280] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281\\...."), lpSecurityAttributes=0x256210) returned 1 [0224.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281\\....\\temporaryfile")) returned 0 [0224.281] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281\\temporaryfile")) returned 1 [0224.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0224.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0224.282] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.282] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.282] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0224.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281\\temporaryfile")) returned 1 [0224.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8a9ffa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8a9ffa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8a9ffa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.282] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0224.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293281" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293281")) returned 1 [0224.283] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 1 [0224.284] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.284] WriteFile (in: hFile=0xe0, lpBuffer=0x2bf688*, nNumberOfBytesToWrite=0xac08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bf688*, lpNumberOfBytesWritten=0x18fdb8*=0xac08, lpOverlapped=0x0) returned 1 [0224.285] CloseHandle (hObject=0xe0) returned 1 [0224.286] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.286] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4600 [0224.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4608) returned 0x2b4a70 [0224.286] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4600, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4600, lpOverlapped=0x0) returned 1 [0224.287] CloseHandle (hObject=0xe0) returned 1 [0224.288] DeleteFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0 [0224.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0224.288] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.288] GetTickCount () returned 0x479b1 [0224.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0224.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0224.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0224.288] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0224.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297\\....\\temporaryfile")) returned 0 [0224.289] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297\\temporaryfile")) returned 1 [0224.290] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0224.290] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.290] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.290] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0224.290] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.290] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.290] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0224.290] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297\\temporaryfile")) returned 1 [0224.291] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.291] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0224.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297")) returned 1 [0224.291] PathFileExistsA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 1 [0224.291] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.SKYSTARS" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0224.292] WriteFile (in: hFile=0xe0, lpBuffer=0x2b9088*, nNumberOfBytesToWrite=0x4608, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b9088*, lpNumberOfBytesWritten=0x18fdb8*=0x4608, lpOverlapped=0x0) returned 1 [0224.293] CloseHandle (hObject=0xe0) returned 1 [0224.293] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0224.293] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0224.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9a0 [0224.293] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0224.293] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0224.294] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0224.294] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0224.294] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80046d91, dwReserved1=0x1ca0444, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0224.295] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9ef07a9b, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9ef07a9b, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80046d91, dwReserved1=0x1ca0444, cFileName="..", cAlternateFileName="")) returned 1 [0224.295] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x80046d91, dwReserved1=0x1ca0444, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0224.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17) returned 0x25cdf0 [0224.295] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.296] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xc600 [0224.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc608) returned 0x2b4a70 [0224.296] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xc600, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0xc600, lpOverlapped=0x0) returned 1 [0224.298] CloseHandle (hObject=0xd4) returned 1 [0224.299] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax")) returned 0 [0224.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0224.299] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0224.299] GetTickCount () returned 0x479b1 [0224.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0224.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0224.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0224.299] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0224.300] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297\\....\\temporaryfile")) returned 0 [0224.300] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297\\temporaryfile")) returned 1 [0224.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa4bd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa4bd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0224.301] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa4bd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa4bd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.301] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0224.302] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.302] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.302] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0224.302] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297\\temporaryfile")) returned 1 [0224.302] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa25be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa25be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa25be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.302] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0224.302] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293297" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293297")) returned 1 [0224.302] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 1 [0224.303] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.307] WriteFile (in: hFile=0xd4, lpBuffer=0x2c1088*, nNumberOfBytesToWrite=0xc608, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2c1088*, lpNumberOfBytesWritten=0x18fe18*=0xc608, lpOverlapped=0x0) returned 1 [0224.308] CloseHandle (hObject=0xd4) returned 1 [0224.308] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.309] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x1303c [0224.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13044) returned 0x2b4a70 [0224.309] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1303c, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x1303c, lpOverlapped=0x0) returned 1 [0224.311] CloseHandle (hObject=0xd4) returned 1 [0224.311] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf")) returned 0 [0224.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0224.312] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.312] GetTickCount () returned 0x479c1 [0224.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0224.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0224.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0224.313] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293313\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293313\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0224.313] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293313\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293313\\....\\temporaryfile")) returned 0 [0224.313] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293313\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293313\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293313\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293313\\temporaryfile")) returned 1 [0224.314] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293313\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa4bd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa4bd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa4bd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0224.314] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa4bd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa4bd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa4bd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.315] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa4bd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa4bd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa4bd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.315] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293313\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa4bd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa4bd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa4bd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0224.315] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa4bd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa4bd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa4bd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.315] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa4bd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa4bd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa4bd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.315] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0224.315] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293313\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293313\\temporaryfile")) returned 1 [0224.315] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa4bd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa4bd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa4bd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.315] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0224.315] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293313" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293313")) returned 1 [0224.316] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 1 [0224.317] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.317] WriteFile (in: hFile=0xd4, lpBuffer=0x2c7ac8*, nNumberOfBytesToWrite=0x13040, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2c7ac8*, lpNumberOfBytesWritten=0x18fe18*=0x13040, lpOverlapped=0x0) returned 1 [0224.319] CloseHandle (hObject=0xd4) returned 1 [0224.319] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.319] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xf000 [0224.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf008) returned 0x2b4a70 [0224.320] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xf000, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0xf000, lpOverlapped=0x0) returned 1 [0224.322] CloseHandle (hObject=0xd4) returned 1 [0224.322] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax")) returned 0 [0224.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0224.322] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0224.322] GetTickCount () returned 0x479d0 [0224.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0224.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0224.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0224.322] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293328\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293328\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0224.323] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293328\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293328\\....\\temporaryfile")) returned 0 [0224.323] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293328\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293328\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293328\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293328\\temporaryfile")) returned 1 [0224.324] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293328\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa71ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa71ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa71ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0224.324] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa71ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa71ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa71ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.324] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa71ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa71ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa71ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.324] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293328\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa71ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa71ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa71ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0224.324] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa71ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa71ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa71ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.324] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa71ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa71ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa71ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.324] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0224.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293328\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293328\\temporaryfile")) returned 1 [0224.325] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8aa71ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8aa71ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8aa71ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.325] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0224.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293328" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293328")) returned 1 [0224.325] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 1 [0224.326] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.326] WriteFile (in: hFile=0xd4, lpBuffer=0x2c3a88*, nNumberOfBytesToWrite=0xf008, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2c3a88*, lpNumberOfBytesWritten=0x18fe18*=0xf008, lpOverlapped=0x0) returned 1 [0224.328] CloseHandle (hObject=0xd4) returned 1 [0224.328] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.328] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x227600 [0224.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x227608) returned 0x2650020 [0224.329] ReadFile (in: hFile=0xd4, lpBuffer=0x2650028, nNumberOfBytesToRead=0x227600, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe30*=0x227600, lpOverlapped=0x0) returned 1 [0224.395] CloseHandle (hObject=0xd4) returned 1 [0224.395] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe")) returned 0 [0224.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0224.395] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.395] GetTickCount () returned 0x47a1e [0224.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0224.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0224.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0224.396] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293406\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293406\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0224.396] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293406\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293406\\....\\temporaryfile")) returned 0 [0224.396] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293406\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293406\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293406\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293406\\temporaryfile")) returned 1 [0224.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293406\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab30580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ab30580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ab30580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0224.398] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab30580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ab30580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ab30580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.398] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab30580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ab30580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ab30580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293406\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab30580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ab30580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ab30580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0224.398] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab30580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ab30580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ab30580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.398] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab30580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ab30580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ab30580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.398] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0224.398] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293406\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293406\\temporaryfile")) returned 1 [0224.398] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab30580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ab30580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ab30580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.398] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0224.398] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293406" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293406")) returned 1 [0224.399] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 1 [0224.536] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.536] WriteFile (in: hFile=0xd4, lpBuffer=0x2ab0028*, nNumberOfBytesToWrite=0x227608, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2ab0028*, lpNumberOfBytesWritten=0x18fe18*=0x227608, lpOverlapped=0x0) returned 1 [0224.584] CloseHandle (hObject=0xd4) returned 1 [0224.697] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.698] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xddb8 [0224.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xddc0) returned 0x2b4a70 [0224.698] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xddb8, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0xddb8, lpOverlapped=0x0) returned 1 [0224.700] CloseHandle (hObject=0xd4) returned 1 [0224.700] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf")) returned 0 [0224.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0224.700] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.700] GetTickCount () returned 0x47b47 [0224.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0224.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0224.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0224.701] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293703\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293703\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0224.702] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293703\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293703\\....\\temporaryfile")) returned 0 [0224.702] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293703\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293703\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293703\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293703\\temporaryfile")) returned 1 [0224.703] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293703\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae03fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae03fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae03fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0224.703] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae03fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae03fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae03fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.703] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae03fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae03fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae03fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.703] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293703\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae03fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae03fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae03fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0224.703] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae03fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae03fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae03fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.704] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae03fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae03fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae03fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.704] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0224.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293703\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293703\\temporaryfile")) returned 1 [0224.704] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae03fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae03fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae03fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.704] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0224.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293703" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293703")) returned 1 [0224.704] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 1 [0224.705] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.706] WriteFile (in: hFile=0xd4, lpBuffer=0x2c2840*, nNumberOfBytesToWrite=0xddc0, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2c2840*, lpNumberOfBytesWritten=0x18fe18*=0xddc0, lpOverlapped=0x0) returned 1 [0224.707] CloseHandle (hObject=0xd4) returned 1 [0224.707] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.708] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xa200 [0224.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa208) returned 0x2b4a70 [0224.709] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xa200, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0xa200, lpOverlapped=0x0) returned 1 [0224.713] CloseHandle (hObject=0xd4) returned 1 [0224.713] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax")) returned 0 [0224.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0224.713] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0224.713] GetTickCount () returned 0x47b56 [0224.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0224.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0224.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0224.714] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293718\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293718\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0224.714] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293718\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293718\\....\\temporaryfile")) returned 0 [0224.714] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293718\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293718\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293718\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293718\\temporaryfile")) returned 1 [0224.716] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293718\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae2a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae2a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae2a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0224.716] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae2a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae2a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae2a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.716] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae2a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae2a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae2a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.716] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293718\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae2a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae2a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae2a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0224.716] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae2a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae2a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae2a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.716] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae2a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae2a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae2a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.716] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0224.716] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293718\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293718\\temporaryfile")) returned 1 [0224.716] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae2a100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae2a100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae2a100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.716] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0224.716] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293718" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293718")) returned 1 [0224.717] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 1 [0224.717] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.718] WriteFile (in: hFile=0xd4, lpBuffer=0x2bec88*, nNumberOfBytesToWrite=0xa208, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2bec88*, lpNumberOfBytesWritten=0x18fe18*=0xa208, lpOverlapped=0x0) returned 1 [0224.719] CloseHandle (hObject=0xd4) returned 1 [0224.719] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.720] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xa800 [0224.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa808) returned 0x2b4a70 [0224.720] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xa800, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0xa800, lpOverlapped=0x0) returned 1 [0224.721] CloseHandle (hObject=0xd4) returned 1 [0224.721] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax")) returned 0 [0224.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0224.722] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0224.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0224.722] GetTickCount () returned 0x47b66 [0224.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0224.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0224.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0224.722] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293734\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293734\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0224.723] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293734\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293734\\....\\temporaryfile")) returned 0 [0224.723] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293734\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293734\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293734\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293734\\temporaryfile")) returned 1 [0224.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293734\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae50260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae50260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae50260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0224.724] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae50260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae50260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae50260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.724] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae50260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae50260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae50260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0224.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293734\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae50260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae50260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae50260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0224.724] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae50260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae50260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae50260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0224.724] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae50260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae50260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae50260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0224.724] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0224.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293734\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293734\\temporaryfile")) returned 1 [0224.725] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ae50260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ae50260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ae50260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0224.725] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0224.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18293734" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18293734")) returned 1 [0224.725] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\offset.ax") returned 1 [0224.726] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\offset.ax.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.726] WriteFile (in: hFile=0xd4, lpBuffer=0x2bf288*, nNumberOfBytesToWrite=0xa808, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2bf288*, lpNumberOfBytesWritten=0x18fe18*=0xa808, lpOverlapped=0x0) returned 1 [0224.728] CloseHandle (hObject=0xd4) returned 1 [0224.728] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0224.728] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xe46400 [0224.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe46408) returned 0x2650020 [0224.729] ReadFile (in: hFile=0xd4, lpBuffer=0x2650028, nNumberOfBytesToRead=0xe46400, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe30*=0xe46400, lpOverlapped=0x0) returned 1 [0225.329] CloseHandle (hObject=0xd4) returned 1 [0225.329] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll")) returned 0 [0225.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0225.329] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0225.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0225.330] GetTickCount () returned 0x47dc6 [0225.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0225.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0225.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0225.331] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18294342\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18294342\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0225.331] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18294342\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18294342\\....\\temporaryfile")) returned 0 [0225.331] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18294342\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18294342\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18294342\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18294342\\temporaryfile")) returned 1 [0225.333] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18294342\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8b41d800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8b41d800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8b41d800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0225.333] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8b41d800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8b41d800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8b41d800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.333] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8b41d800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8b41d800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8b41d800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0225.333] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18294342\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8b41d800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8b41d800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8b41d800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0225.333] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8b41d800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8b41d800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8b41d800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.333] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8b41d800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8b41d800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8b41d800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0225.333] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0225.333] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18294342\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18294342\\temporaryfile")) returned 1 [0225.333] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8b41d800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8b41d800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8b41d800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0225.333] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0225.333] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18294342" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18294342")) returned 1 [0225.333] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned 1 [0226.281] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0226.283] WriteFile (in: hFile=0xd4, lpBuffer=0x42f0028*, nNumberOfBytesToWrite=0xe46408, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x42f0028*, lpNumberOfBytesWritten=0x18fe18*=0xe46408, lpOverlapped=0x0) returned 1 [0226.570] CloseHandle (hObject=0xd4) returned 1 [0226.705] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0226.706] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x432600 [0226.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x432608) returned 0x2650020 [0226.706] ReadFile (in: hFile=0xd4, lpBuffer=0x2650028, nNumberOfBytesToRead=0x432600, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe30*=0x432600, lpOverlapped=0x0) returned 1 [0226.841] CloseHandle (hObject=0xd4) returned 1 [0226.841] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll")) returned 0 [0226.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0226.841] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0226.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0226.841] GetTickCount () returned 0x483a0 [0226.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0226.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0226.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0226.842] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18295840\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18295840\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0226.843] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18295840\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18295840\\....\\temporaryfile")) returned 0 [0226.843] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18295840\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18295840\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18295840\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18295840\\temporaryfile")) returned 1 [0226.844] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18295840\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c265c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c28bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c28bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0226.845] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c265c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c28bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c28bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.845] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c28bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c28bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c28bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0226.845] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18295840\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c28bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c28bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c28bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0226.845] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c28bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c28bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c28bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.845] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c28bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c28bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c28bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0226.845] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0226.845] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18295840\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18295840\\temporaryfile")) returned 1 [0226.845] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c28bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c28bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c28bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0226.845] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0226.845] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18295840" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18295840")) returned 1 [0226.845] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned 1 [0227.053] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.054] WriteFile (in: hFile=0xd4, lpBuffer=0x2ed0028*, nNumberOfBytesToWrite=0x432608, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2ed0028*, lpNumberOfBytesWritten=0x18fe18*=0x432608, lpOverlapped=0x0) returned 1 [0227.137] CloseHandle (hObject=0xd4) returned 1 [0227.174] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.175] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x1c4600 [0227.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c4608) returned 0x2650020 [0227.175] ReadFile (in: hFile=0xd4, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1c4600, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe30*=0x1c4600, lpOverlapped=0x0) returned 1 [0227.239] CloseHandle (hObject=0xd4) returned 1 [0227.239] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll")) returned 0 [0227.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0227.240] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.240] GetTickCount () returned 0x48535 [0227.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0227.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0227.240] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296245\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296245\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0227.241] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296245\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296245\\....\\temporaryfile")) returned 0 [0227.241] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296245\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296245\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296245\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296245\\temporaryfile")) returned 1 [0227.243] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296245\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c643fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c643fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c643fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0227.243] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c643fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c643fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c643fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.243] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c643fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c643fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c643fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.243] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296245\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c643fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c643fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c643fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.243] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c643fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c643fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c643fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.243] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c643fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c643fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c643fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.243] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0227.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296245\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296245\\temporaryfile")) returned 1 [0227.243] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c643fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c643fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c643fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.243] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0227.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296245" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296245")) returned 1 [0227.244] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 1 [0227.324] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.325] WriteFile (in: hFile=0xd4, lpBuffer=0x29f0028*, nNumberOfBytesToWrite=0x1c4608, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x29f0028*, lpNumberOfBytesWritten=0x18fe18*=0x1c4608, lpOverlapped=0x0) returned 1 [0227.366] CloseHandle (hObject=0xd4) returned 1 [0227.382] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.383] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x1cc000 [0227.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1cc008) returned 0x2650020 [0227.384] ReadFile (in: hFile=0xd4, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1cc000, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe30*=0x1cc000, lpOverlapped=0x0) returned 1 [0227.430] CloseHandle (hObject=0xd4) returned 1 [0227.430] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll")) returned 0 [0227.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.430] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.430] GetTickCount () returned 0x485f1 [0227.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0227.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0227.431] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296433\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296433\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.431] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296433\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296433\\....\\temporaryfile")) returned 0 [0227.432] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296433\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296433\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296433\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296433\\temporaryfile")) returned 1 [0227.433] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296433\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c80d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c80d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c80d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0227.433] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c80d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c80d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c80d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.433] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c80d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c80d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c80d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.433] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296433\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c80d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c80d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c80d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.433] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c80d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c80d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c80d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.433] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c80d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c80d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c80d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.433] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0227.433] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296433\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296433\\temporaryfile")) returned 1 [0227.434] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c80d040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c80d040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c80d040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.434] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0227.434] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296433" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296433")) returned 1 [0227.434] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned 1 [0227.527] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.527] WriteFile (in: hFile=0xd4, lpBuffer=0x29f0028*, nNumberOfBytesToWrite=0x1cc008, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x29f0028*, lpNumberOfBytesWritten=0x18fe18*=0x1cc008, lpOverlapped=0x0) returned 1 [0227.558] CloseHandle (hObject=0xd4) returned 1 [0227.575] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.576] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x13400 [0227.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13408) returned 0x2b4a70 [0227.576] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x13400, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x13400, lpOverlapped=0x0) returned 1 [0227.578] CloseHandle (hObject=0xd4) returned 1 [0227.578] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax")) returned 0 [0227.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0227.578] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0227.578] GetTickCount () returned 0x4868d [0227.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0227.579] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0227.579] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589\\....\\temporaryfile")) returned 0 [0227.579] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589\\temporaryfile")) returned 1 [0227.581] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0227.581] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.581] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.581] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.581] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.581] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.581] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0227.581] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589\\temporaryfile")) returned 1 [0227.581] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.581] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0227.581] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589")) returned 1 [0227.582] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned 1 [0227.583] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.583] WriteFile (in: hFile=0xd4, lpBuffer=0x2c7e88*, nNumberOfBytesToWrite=0x13408, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2c7e88*, lpNumberOfBytesWritten=0x18fe18*=0x13408, lpOverlapped=0x0) returned 1 [0227.585] CloseHandle (hObject=0xd4) returned 1 [0227.585] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.586] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xce00 [0227.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xce08) returned 0x2b4a70 [0227.586] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xce00, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0xce00, lpOverlapped=0x0) returned 1 [0227.588] CloseHandle (hObject=0xd4) returned 1 [0227.588] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax")) returned 0 [0227.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.588] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0227.588] GetTickCount () returned 0x4868d [0227.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0227.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0227.589] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.589] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589\\....\\temporaryfile")) returned 0 [0227.589] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589\\temporaryfile")) returned 1 [0227.591] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0227.591] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.591] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.591] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.591] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.591] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.603] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0227.603] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589\\temporaryfile")) returned 1 [0227.603] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c989e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c989e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c989e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.603] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0227.603] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296589" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296589")) returned 1 [0227.603] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned 1 [0227.604] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.605] WriteFile (in: hFile=0xd4, lpBuffer=0x2c1888*, nNumberOfBytesToWrite=0xce08, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2c1888*, lpNumberOfBytesWritten=0x18fe18*=0xce08, lpOverlapped=0x0) returned 1 [0227.606] CloseHandle (hObject=0xd4) returned 1 [0227.606] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.607] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x18208 [0227.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18210) returned 0x2b4a70 [0227.607] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x18208, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x18208, lpOverlapped=0x0) returned 1 [0227.609] CloseHandle (hObject=0xd4) returned 1 [0227.609] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf")) returned 0 [0227.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0227.609] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.609] GetTickCount () returned 0x486ac [0227.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0227.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0227.610] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0227.610] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620\\....\\temporaryfile")) returned 0 [0227.610] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620\\temporaryfile")) returned 1 [0227.611] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0227.611] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.612] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.612] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.612] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.612] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.612] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0227.612] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620\\temporaryfile")) returned 1 [0227.612] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.612] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0227.612] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620")) returned 1 [0227.612] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned 1 [0227.614] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\secretst.ttf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.614] WriteFile (in: hFile=0xd4, lpBuffer=0x2ccc90*, nNumberOfBytesToWrite=0x18210, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2ccc90*, lpNumberOfBytesWritten=0x18fe18*=0x18210, lpOverlapped=0x0) returned 1 [0227.616] CloseHandle (hObject=0xd4) returned 1 [0227.617] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.617] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x13600 [0227.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13608) returned 0x2b4a70 [0227.617] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x13600, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x13600, lpOverlapped=0x0) returned 1 [0227.619] CloseHandle (hObject=0xd4) returned 1 [0227.619] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax")) returned 0 [0227.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.619] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0227.619] GetTickCount () returned 0x486ac [0227.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0227.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0227.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0227.620] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.620] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620\\....\\temporaryfile")) returned 0 [0227.620] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620\\temporaryfile")) returned 1 [0227.622] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.622] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.622] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.622] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.622] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.622] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.622] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620\\temporaryfile")) returned 1 [0227.622] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9d60c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9d60c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9d60c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.622] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0227.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296620" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296620")) returned 1 [0227.623] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax") returned 1 [0227.624] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.625] WriteFile (in: hFile=0xd4, lpBuffer=0x2c8088*, nNumberOfBytesToWrite=0x13608, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2c8088*, lpNumberOfBytesWritten=0x18fe18*=0x13608, lpOverlapped=0x0) returned 1 [0227.626] CloseHandle (hObject=0xd4) returned 1 [0227.627] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.627] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xca00 [0227.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xca08) returned 0x2b4a70 [0227.627] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xca00, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0xca00, lpOverlapped=0x0) returned 1 [0227.629] CloseHandle (hObject=0xd4) returned 1 [0227.629] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax")) returned 0 [0227.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.629] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0227.629] GetTickCount () returned 0x486bb [0227.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0227.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0227.630] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296635\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296635\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.630] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296635\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296635\\....\\temporaryfile")) returned 0 [0227.630] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296635\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296635\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296635\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296635\\temporaryfile")) returned 1 [0227.631] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296635\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9fc220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9fc220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9fc220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0227.631] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9fc220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9fc220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9fc220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.631] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9fc220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9fc220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9fc220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.632] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296635\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9fc220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9fc220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9fc220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.632] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9fc220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9fc220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9fc220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.632] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9fc220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9fc220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9fc220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.632] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0227.632] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296635\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296635\\temporaryfile")) returned 1 [0227.632] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8c9fc220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8c9fc220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8c9fc220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.632] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0227.632] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296635" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296635")) returned 1 [0227.636] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\sonicsptransform.ax") returned 1 [0227.637] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.637] WriteFile (in: hFile=0xd4, lpBuffer=0x2c1488*, nNumberOfBytesToWrite=0xca08, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2c1488*, lpNumberOfBytesWritten=0x18fe18*=0xca08, lpOverlapped=0x0) returned 1 [0227.638] CloseHandle (hObject=0xd4) returned 1 [0227.639] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.639] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x4a000 [0227.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4a008) returned 0x2b4a70 [0227.639] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4a000, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x4a000, lpOverlapped=0x0) returned 1 [0227.682] CloseHandle (hObject=0xd4) returned 1 [0227.682] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll")) returned 0 [0227.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0227.682] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.682] GetTickCount () returned 0x486ea [0227.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0227.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0227.683] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296682\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296682\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0227.683] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296682\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296682\\....\\temporaryfile")) returned 0 [0227.684] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296682\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296682\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296682\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296682\\temporaryfile")) returned 1 [0227.685] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296682\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ca6e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ca6e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ca6e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0227.686] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ca6e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ca6e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ca6e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.686] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ca6e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ca6e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ca6e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.686] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296682\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ca6e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ca6e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ca6e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.686] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ca6e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ca6e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ca6e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.686] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ca6e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ca6e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ca6e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.686] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0227.686] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296682\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296682\\temporaryfile")) returned 1 [0227.686] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ca6e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ca6e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ca6e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.686] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0227.686] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296682" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296682")) returned 1 [0227.686] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll") returned 1 [0227.694] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0227.695] WriteFile (in: hFile=0xd4, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x4a008, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fe18*=0x4a008, lpOverlapped=0x0) returned 1 [0227.701] CloseHandle (hObject=0xd4) returned 1 [0227.701] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0227.701] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8ca947a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ca947a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0227.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0227.701] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ead9a68, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0227.701] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ead9a68, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 1 [0227.701] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x1ead9a68, dwReserved1=0x1cbf8ea, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0227.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11) returned 0x25cdb0 [0227.702] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.702] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xca00 [0227.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xca08) returned 0x2b4a70 [0227.702] ReadFile (in: hFile=0xd8, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xca00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe10*=0xca00, lpOverlapped=0x0) returned 1 [0227.704] CloseHandle (hObject=0xd8) returned 1 [0227.704] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui")) returned 0 [0227.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.704] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.704] GetTickCount () returned 0x48709 [0227.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0227.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0227.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.705] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296713\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296713\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.705] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296713\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296713\\....\\temporaryfile")) returned 0 [0227.705] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296713\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296713\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296713\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296713\\temporaryfile")) returned 1 [0227.707] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296713\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8caba900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8caba900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8caba900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.707] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8caba900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8caba900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8caba900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.707] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8caba900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8caba900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8caba900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.707] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296713\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8caba900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8caba900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8caba900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.707] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8caba900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8caba900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8caba900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.707] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8caba900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8caba900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8caba900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.707] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.707] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296713\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296713\\temporaryfile")) returned 1 [0227.707] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8caba900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8caba900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8caba900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.707] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.707] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296713" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296713")) returned 1 [0227.708] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 1 [0227.709] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.710] WriteFile (in: hFile=0xd8, lpBuffer=0x2c1488*, nNumberOfBytesToWrite=0xca08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2c1488*, lpNumberOfBytesWritten=0x18fdf8*=0xca08, lpOverlapped=0x0) returned 1 [0227.711] CloseHandle (hObject=0xd8) returned 1 [0227.711] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.713] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3000 [0227.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3008) returned 0x299460 [0227.713] ReadFile (in: hFile=0xd8, lpBuffer=0x299468, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fe10*=0x3000, lpOverlapped=0x0) returned 1 [0227.716] CloseHandle (hObject=0xd8) returned 1 [0227.716] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui")) returned 0 [0227.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.716] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.716] GetTickCount () returned 0x48719 [0227.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0227.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0227.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.717] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.717] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729\\....\\temporaryfile")) returned 0 [0227.717] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729\\temporaryfile")) returned 1 [0227.719] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.719] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.719] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.719] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.719] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.719] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.719] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.719] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729\\temporaryfile")) returned 1 [0227.719] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.720] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.720] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729")) returned 1 [0227.720] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 1 [0227.720] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.722] WriteFile (in: hFile=0xd8, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x3008, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdf8*=0x3008, lpOverlapped=0x0) returned 1 [0227.723] CloseHandle (hObject=0xd8) returned 1 [0227.723] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.724] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1c00 [0227.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c08) returned 0x299460 [0227.724] ReadFile (in: hFile=0xd8, lpBuffer=0x299468, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fe10*=0x1c00, lpOverlapped=0x0) returned 1 [0227.725] CloseHandle (hObject=0xd8) returned 1 [0227.725] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui")) returned 0 [0227.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.725] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.725] GetTickCount () returned 0x48719 [0227.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0227.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0227.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.726] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.727] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729\\....\\temporaryfile")) returned 0 [0227.727] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729\\temporaryfile")) returned 1 [0227.728] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.728] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.728] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.728] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.728] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.728] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.728] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.728] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729\\temporaryfile")) returned 1 [0227.729] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cae0a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.729] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296729" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296729")) returned 1 [0227.729] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 1 [0227.729] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.730] WriteFile (in: hFile=0xd8, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x1c08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdf8*=0x1c08, lpOverlapped=0x0) returned 1 [0227.731] CloseHandle (hObject=0xd8) returned 1 [0227.731] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0227.731] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8cae0a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cae0a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0227.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0227.731] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0227.731] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80046d91, dwReserved1=0x1ca0444, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0227.733] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80046d91, dwReserved1=0x1ca0444, cFileName="..", cAlternateFileName="")) returned 1 [0227.733] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x80046d91, dwReserved1=0x1ca0444, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0227.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x2561e0 [0227.733] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.733] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x30e4 [0227.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30ec) returned 0x299460 [0227.733] ReadFile (in: hFile=0xd8, lpBuffer=0x299468, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fe10*=0x30e4, lpOverlapped=0x0) returned 1 [0227.735] CloseHandle (hObject=0xd8) returned 1 [0227.735] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh")) returned 0 [0227.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0227.735] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.735] GetTickCount () returned 0x48729 [0227.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0227.736] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0227.736] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745\\....\\temporaryfile")) returned 0 [0227.736] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745\\temporaryfile")) returned 1 [0227.737] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.738] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.738] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.738] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.738] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.738] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.738] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.738] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745\\temporaryfile")) returned 1 [0227.738] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.738] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0227.738] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745")) returned 1 [0227.738] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned 1 [0227.739] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.739] WriteFile (in: hFile=0xd8, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x30e8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdf8*=0x30e8, lpOverlapped=0x0) returned 1 [0227.740] CloseHandle (hObject=0xd8) returned 1 [0227.740] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.741] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x6d1f [0227.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6d27) returned 0x2b4a70 [0227.741] ReadFile (in: hFile=0xd8, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6d1f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe10*=0x6d1f, lpOverlapped=0x0) returned 1 [0227.743] CloseHandle (hObject=0xd8) returned 1 [0227.743] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0 [0227.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.743] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.743] GetTickCount () returned 0x48729 [0227.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0227.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0227.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.744] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.744] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745\\....\\temporaryfile")) returned 0 [0227.745] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745\\temporaryfile")) returned 1 [0227.746] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.746] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.746] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.746] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.746] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.746] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.746] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.746] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745\\temporaryfile")) returned 1 [0227.746] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb06bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb06bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb06bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.746] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.746] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296745" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296745")) returned 1 [0227.747] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 1 [0227.747] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.748] WriteFile (in: hFile=0xd8, lpBuffer=0x2bb7a8*, nNumberOfBytesToWrite=0x6d28, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2bb7a8*, lpNumberOfBytesWritten=0x18fdf8*=0x6d28, lpOverlapped=0x0) returned 1 [0227.749] CloseHandle (hObject=0xd8) returned 1 [0227.749] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.749] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xb7835 [0227.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb783d) returned 0x1d70020 [0227.750] ReadFile (in: hFile=0xd8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xb7835, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe10*=0xb7835, lpOverlapped=0x0) returned 1 [0227.773] CloseHandle (hObject=0xd8) returned 1 [0227.773] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0 [0227.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.773] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.774] GetTickCount () returned 0x48748 [0227.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0227.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0227.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.774] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296776\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296776\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.775] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296776\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296776\\....\\temporaryfile")) returned 0 [0227.775] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296776\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296776\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296776\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296776\\temporaryfile")) returned 1 [0227.776] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296776\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb52e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb52e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb52e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.776] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb52e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb52e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb52e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.776] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb52e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb52e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb52e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.776] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296776\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb52e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb52e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb52e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.776] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb52e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb52e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb52e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.776] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb52e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb52e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb52e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.777] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296776\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296776\\temporaryfile")) returned 1 [0227.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cb52e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cb52e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cb52e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.777] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296776" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296776")) returned 1 [0227.777] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 1 [0227.822] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.822] WriteFile (in: hFile=0xd8, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xb7840, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdf8*=0xb7840, lpOverlapped=0x0) returned 1 [0227.834] CloseHandle (hObject=0xd8) returned 1 [0227.841] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.841] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x379f [0227.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x37a7) returned 0x2b4a70 [0227.841] ReadFile (in: hFile=0xd8, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x379f, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe10*=0x379f, lpOverlapped=0x0) returned 1 [0227.843] CloseHandle (hObject=0xd8) returned 1 [0227.843] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml")) returned 0 [0227.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0227.843] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.843] GetTickCount () returned 0x48796 [0227.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0227.844] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0227.844] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854\\....\\temporaryfile")) returned 0 [0227.844] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854\\temporaryfile")) returned 1 [0227.845] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.845] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.846] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.846] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.846] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.846] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.846] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.846] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854\\temporaryfile")) returned 1 [0227.846] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.846] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0227.846] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854")) returned 1 [0227.846] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml") returned 1 [0227.847] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.847] WriteFile (in: hFile=0xd8, lpBuffer=0x2b8228*, nNumberOfBytesToWrite=0x37a8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2b8228*, lpNumberOfBytesWritten=0x18fdf8*=0x37a8, lpOverlapped=0x0) returned 1 [0227.848] CloseHandle (hObject=0xd8) returned 1 [0227.848] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.849] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x8edf [0227.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8ee7) returned 0x2b4a70 [0227.849] ReadFile (in: hFile=0xd8, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x8edf, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe10*=0x8edf, lpOverlapped=0x0) returned 1 [0227.850] CloseHandle (hObject=0xd8) returned 1 [0227.850] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx")) returned 0 [0227.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.851] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.851] GetTickCount () returned 0x48796 [0227.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0227.851] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.852] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854\\....\\temporaryfile")) returned 0 [0227.852] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854\\temporaryfile")) returned 1 [0227.853] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.854] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.854] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.854] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.854] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.854] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.854] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.854] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854\\temporaryfile")) returned 1 [0227.854] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc11560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.854] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0227.854] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296854" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296854")) returned 1 [0227.854] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 1 [0227.855] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0227.856] WriteFile (in: hFile=0xd8, lpBuffer=0x2bd968*, nNumberOfBytesToWrite=0x8ee8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2bd968*, lpNumberOfBytesWritten=0x18fdf8*=0x8ee8, lpOverlapped=0x0) returned 1 [0227.857] CloseHandle (hObject=0xd8) returned 1 [0227.857] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0227.857] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8cc11560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc11560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0227.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0227.857] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f0852f1, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0227.859] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f0852f1, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0227.860] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x9f0852f1, dwReserved1=0x1cbf8eb, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0227.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23) returned 0x259688 [0227.860] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.861] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x278b [0227.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2793) returned 0x299460 [0227.861] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x278b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x278b, lpOverlapped=0x0) returned 1 [0227.863] CloseHandle (hObject=0xdc) returned 1 [0227.863] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0 [0227.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.863] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.863] GetTickCount () returned 0x487a5 [0227.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.864] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.864] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869\\....\\temporaryfile")) returned 0 [0227.864] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869\\temporaryfile")) returned 1 [0227.865] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.865] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.865] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.866] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.866] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.866] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.866] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869\\temporaryfile")) returned 1 [0227.866] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.866] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869")) returned 1 [0227.866] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 1 [0227.867] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.867] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2790, lpOverlapped=0x0) returned 1 [0227.868] CloseHandle (hObject=0xdc) returned 1 [0227.868] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.869] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcd6 [0227.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcde) returned 0x25f580 [0227.869] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xcd6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xcd6, lpOverlapped=0x0) returned 1 [0227.870] CloseHandle (hObject=0xdc) returned 1 [0227.870] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0 [0227.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.871] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.871] GetTickCount () returned 0x487a5 [0227.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea80 [0227.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.871] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.872] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869\\....\\temporaryfile")) returned 0 [0227.872] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869\\temporaryfile")) returned 1 [0227.873] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.873] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.873] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.874] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.874] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.874] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.874] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.874] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869\\temporaryfile")) returned 1 [0227.874] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc376c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc376c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc376c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.874] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.874] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296869" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296869")) returned 1 [0227.874] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 1 [0227.875] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.875] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xce0, lpOverlapped=0x0) returned 1 [0227.876] CloseHandle (hObject=0xdc) returned 1 [0227.876] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.877] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcf4 [0227.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcfc) returned 0x25f580 [0227.877] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xcf4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xcf4, lpOverlapped=0x0) returned 1 [0227.878] CloseHandle (hObject=0xdc) returned 1 [0227.878] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0 [0227.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.879] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.879] GetTickCount () returned 0x487b5 [0227.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.879] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.880] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885\\....\\temporaryfile")) returned 0 [0227.880] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885\\temporaryfile")) returned 1 [0227.881] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.882] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.882] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.882] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.882] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.882] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.882] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.882] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885\\temporaryfile")) returned 1 [0227.882] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.882] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.882] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885")) returned 1 [0227.882] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 1 [0227.883] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.883] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xcf8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xcf8, lpOverlapped=0x0) returned 1 [0227.884] CloseHandle (hObject=0xdc) returned 1 [0227.884] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.885] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2e55 [0227.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e5d) returned 0x299460 [0227.885] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x2e55, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x2e55, lpOverlapped=0x0) returned 1 [0227.886] CloseHandle (hObject=0xdc) returned 1 [0227.886] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0 [0227.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.887] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.887] GetTickCount () returned 0x487b5 [0227.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.887] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.888] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885\\....\\temporaryfile")) returned 0 [0227.888] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885\\temporaryfile")) returned 1 [0227.889] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc83980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc83980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.889] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc83980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc83980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.889] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.889] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.890] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.890] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.890] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.890] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885\\temporaryfile")) returned 1 [0227.890] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc5d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc5d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc5d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.890] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.890] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296885" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296885")) returned 1 [0227.890] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 1 [0227.891] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.891] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x2e60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x2e60, lpOverlapped=0x0) returned 1 [0227.892] CloseHandle (hObject=0xdc) returned 1 [0227.892] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.893] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xce8 [0227.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcf0) returned 0x25f580 [0227.893] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xce8, lpOverlapped=0x0) returned 1 [0227.901] CloseHandle (hObject=0xdc) returned 1 [0227.901] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0 [0227.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.902] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.902] GetTickCount () returned 0x487c5 [0227.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.902] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296901\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296901\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.903] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296901\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296901\\....\\temporaryfile")) returned 0 [0227.904] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296901\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296901\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296901\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296901\\temporaryfile")) returned 1 [0227.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296901\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc83980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cca9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cca9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.905] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc83980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cca9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cca9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.905] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc83980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc83980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc83980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296901\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc83980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc83980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc83980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.905] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc83980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc83980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc83980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.905] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc83980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc83980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc83980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.906] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296901\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296901\\temporaryfile")) returned 1 [0227.906] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cc83980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cc83980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cc83980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.906] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296901" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296901")) returned 1 [0227.906] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 1 [0227.906] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.907] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xcf0, lpOverlapped=0x0) returned 1 [0227.908] CloseHandle (hObject=0xdc) returned 1 [0227.908] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.909] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd8b [0227.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd93) returned 0x25f580 [0227.909] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xd8b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xd8b, lpOverlapped=0x0) returned 1 [0227.910] CloseHandle (hObject=0xdc) returned 1 [0227.910] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0 [0227.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.910] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.910] GetTickCount () returned 0x487d4 [0227.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.911] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296916\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296916\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.911] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296916\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296916\\....\\temporaryfile")) returned 0 [0227.912] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296916\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296916\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296916\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296916\\temporaryfile")) returned 1 [0227.913] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296916\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cca9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cca9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cca9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.913] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cca9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cca9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cca9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.913] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cca9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cca9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cca9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.913] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296916\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cca9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cca9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cca9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.913] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cca9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cca9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cca9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.913] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cca9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cca9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cca9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.913] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.913] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296916\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296916\\temporaryfile")) returned 1 [0227.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cca9ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cca9ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cca9ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.917] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.917] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296916" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296916")) returned 1 [0227.917] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 1 [0227.918] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.918] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xd90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xd90, lpOverlapped=0x0) returned 1 [0227.919] CloseHandle (hObject=0xdc) returned 1 [0227.919] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.920] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1276 [0227.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x127e) returned 0x25b528 [0227.920] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1276, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1276, lpOverlapped=0x0) returned 1 [0227.922] CloseHandle (hObject=0xdc) returned 1 [0227.922] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0 [0227.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.922] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.922] GetTickCount () returned 0x487e4 [0227.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.923] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.923] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.923] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932\\....\\temporaryfile")) returned 0 [0227.923] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932\\temporaryfile")) returned 1 [0227.924] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.924] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.925] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.925] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.925] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.925] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.925] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.925] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932\\temporaryfile")) returned 1 [0227.925] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.925] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.925] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932")) returned 1 [0227.925] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp") returned 1 [0227.926] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.926] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x1280, lpOverlapped=0x0) returned 1 [0227.927] CloseHandle (hObject=0xdc) returned 1 [0227.927] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.927] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6a91 [0227.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6a99) returned 0x2b4a70 [0227.928] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6a91, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x6a91, lpOverlapped=0x0) returned 1 [0227.929] CloseHandle (hObject=0xdc) returned 1 [0227.929] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0 [0227.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.929] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.930] GetTickCount () returned 0x487e4 [0227.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.930] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.931] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932\\....\\temporaryfile")) returned 0 [0227.931] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932\\temporaryfile")) returned 1 [0227.932] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.932] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.932] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.932] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.932] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.932] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.932] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.932] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932\\temporaryfile")) returned 1 [0227.933] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cccfc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cccfc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cccfc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.933] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.933] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296932" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296932")) returned 1 [0227.933] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 1 [0227.934] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.935] WriteFile (in: hFile=0xdc, lpBuffer=0x2bb520*, nNumberOfBytesToWrite=0x6a98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bb520*, lpNumberOfBytesWritten=0x18fdd8*=0x6a98, lpOverlapped=0x0) returned 1 [0227.936] CloseHandle (hObject=0xdc) returned 1 [0227.936] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.937] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf26 [0227.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf2e) returned 0x25f580 [0227.937] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xf26, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xf26, lpOverlapped=0x0) returned 1 [0227.939] CloseHandle (hObject=0xdc) returned 1 [0227.939] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0 [0227.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.939] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0227.939] GetTickCount () returned 0x487f3 [0227.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.940] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.940] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947\\....\\temporaryfile")) returned 0 [0227.940] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947\\temporaryfile")) returned 1 [0227.941] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.941] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.941] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.942] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.942] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.942] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.942] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.942] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947\\temporaryfile")) returned 1 [0227.942] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.942] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.942] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947")) returned 1 [0227.942] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 1 [0227.943] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.943] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xf30, lpOverlapped=0x0) returned 1 [0227.944] CloseHandle (hObject=0xdc) returned 1 [0227.944] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.944] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13c3 [0227.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13cb) returned 0x25b528 [0227.944] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13c3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13c3, lpOverlapped=0x0) returned 1 [0227.946] CloseHandle (hObject=0xdc) returned 1 [0227.946] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0 [0227.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.946] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.946] GetTickCount () returned 0x487f3 [0227.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.947] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.947] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947\\....\\temporaryfile")) returned 0 [0227.948] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947\\temporaryfile")) returned 1 [0227.949] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.949] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.949] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.949] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.949] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.949] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.949] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.949] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947\\temporaryfile")) returned 1 [0227.949] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ccf5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ccf5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ccf5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.949] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.950] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296947" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296947")) returned 1 [0227.950] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png") returned 1 [0227.950] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.950] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13c8, lpOverlapped=0x0) returned 1 [0227.951] CloseHandle (hObject=0xdc) returned 1 [0227.952] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.952] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6a91 [0227.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6a99) returned 0x2b4a70 [0227.952] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6a91, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x6a91, lpOverlapped=0x0) returned 1 [0227.954] CloseHandle (hObject=0xdc) returned 1 [0227.954] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0 [0227.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.954] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.954] GetTickCount () returned 0x48803 [0227.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.955] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.955] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963\\....\\temporaryfile")) returned 0 [0227.955] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963\\temporaryfile")) returned 1 [0227.956] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.956] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.956] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.956] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.956] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.957] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.957] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.957] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963\\temporaryfile")) returned 1 [0227.957] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.957] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.957] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963")) returned 1 [0227.957] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 1 [0227.958] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.958] WriteFile (in: hFile=0xdc, lpBuffer=0x2bb520*, nNumberOfBytesToWrite=0x6a98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bb520*, lpNumberOfBytesWritten=0x18fdd8*=0x6a98, lpOverlapped=0x0) returned 1 [0227.959] CloseHandle (hObject=0xdc) returned 1 [0227.959] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.960] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0227.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0227.960] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0227.961] CloseHandle (hObject=0xdc) returned 1 [0227.961] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0 [0227.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.962] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.962] GetTickCount () returned 0x48803 [0227.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.962] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.963] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963\\....\\temporaryfile")) returned 0 [0227.963] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963\\temporaryfile")) returned 1 [0227.964] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.964] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.964] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.964] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.964] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.964] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.965] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.965] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963\\temporaryfile")) returned 1 [0227.965] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd1bf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd1bf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd1bf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.965] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.965] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296963" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296963")) returned 1 [0227.965] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 1 [0227.965] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.966] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0227.967] CloseHandle (hObject=0xdc) returned 1 [0227.967] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.967] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf26 [0227.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf2e) returned 0x25f580 [0227.967] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xf26, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xf26, lpOverlapped=0x0) returned 1 [0227.969] CloseHandle (hObject=0xdc) returned 1 [0227.969] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0 [0227.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.969] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.969] GetTickCount () returned 0x48813 [0227.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.970] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.970] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979\\....\\temporaryfile")) returned 0 [0227.970] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979\\temporaryfile")) returned 1 [0227.971] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.971] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.971] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.971] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.972] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.972] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.972] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.972] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979\\temporaryfile")) returned 1 [0227.972] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.972] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.972] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979")) returned 1 [0227.972] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 1 [0227.972] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.973] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xf30, lpOverlapped=0x0) returned 1 [0227.974] CloseHandle (hObject=0xdc) returned 1 [0227.974] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.975] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc8f [0227.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc97) returned 0x25f580 [0227.975] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc8f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xc8f, lpOverlapped=0x0) returned 1 [0227.977] CloseHandle (hObject=0xdc) returned 1 [0227.977] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0 [0227.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.977] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.977] GetTickCount () returned 0x48813 [0227.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.978] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.978] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979\\....\\temporaryfile")) returned 0 [0227.978] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979\\temporaryfile")) returned 1 [0227.979] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.980] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.980] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.980] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.980] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.980] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.980] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.980] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979\\temporaryfile")) returned 1 [0227.980] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd42060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd42060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd42060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.980] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.980] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296979" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296979")) returned 1 [0227.980] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 1 [0227.981] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.981] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xc98, lpOverlapped=0x0) returned 1 [0227.982] CloseHandle (hObject=0xdc) returned 1 [0227.982] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.983] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13c3 [0227.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13cb) returned 0x25b528 [0227.983] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13c3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13c3, lpOverlapped=0x0) returned 1 [0227.984] CloseHandle (hObject=0xdc) returned 1 [0227.984] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png")) returned 0 [0227.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.984] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.984] GetTickCount () returned 0x48822 [0227.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.985] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.985] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994\\....\\temporaryfile")) returned 0 [0227.986] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994\\temporaryfile")) returned 1 [0227.987] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.987] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.987] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.987] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.987] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994\\temporaryfile")) returned 1 [0227.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.987] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994")) returned 1 [0227.988] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned 1 [0227.988] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.988] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13c8, lpOverlapped=0x0) returned 1 [0227.989] CloseHandle (hObject=0xdc) returned 1 [0227.989] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.990] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0227.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0227.990] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0227.991] CloseHandle (hObject=0xdc) returned 1 [0227.991] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp")) returned 0 [0227.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0227.991] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0227.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0227.992] GetTickCount () returned 0x48822 [0227.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0227.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0227.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0227.992] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0227.993] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994\\....\\temporaryfile")) returned 0 [0227.993] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994\\temporaryfile")) returned 1 [0227.994] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0227.994] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.994] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0227.994] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0227.994] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.994] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0227.994] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0227.995] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994\\temporaryfile")) returned 1 [0227.995] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cd681c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cd681c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cd681c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0227.995] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0227.995] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18296994" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18296994")) returned 1 [0227.995] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp") returned 1 [0227.995] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0227.996] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.131] CloseHandle (hObject=0xdc) returned 1 [0228.133] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.134] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5c9f [0228.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5ca7) returned 0x2b4a70 [0228.134] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5c9f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x5c9f, lpOverlapped=0x0) returned 1 [0228.136] CloseHandle (hObject=0xdc) returned 1 [0228.136] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png")) returned 0 [0228.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.136] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.136] GetTickCount () returned 0x488af [0228.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.137] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297135\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297135\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.137] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297135\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297135\\....\\temporaryfile")) returned 0 [0228.137] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297135\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297135\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297135\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297135\\temporaryfile")) returned 1 [0228.139] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297135\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cebee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cee4f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cee4f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.139] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cebee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cee4f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cee4f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.139] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cebee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cebee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cebee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.139] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297135\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cebee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cebee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cebee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0228.139] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cebee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cebee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cebee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.139] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cebee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cebee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cebee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.139] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0228.139] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297135\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297135\\temporaryfile")) returned 1 [0228.139] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cebee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cebee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cebee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.140] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.140] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297135" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297135")) returned 1 [0228.140] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png") returned 1 [0228.140] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.142] WriteFile (in: hFile=0xdc, lpBuffer=0x2ba728*, nNumberOfBytesToWrite=0x5ca8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ba728*, lpNumberOfBytesWritten=0x18fdd8*=0x5ca8, lpOverlapped=0x0) returned 1 [0228.143] CloseHandle (hObject=0xdc) returned 1 [0228.144] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.144] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x422c [0228.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4234) returned 0x2b4a70 [0228.144] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x422c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x422c, lpOverlapped=0x0) returned 1 [0228.145] CloseHandle (hObject=0xdc) returned 1 [0228.145] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx")) returned 0 [0228.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0228.146] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.146] GetTickCount () returned 0x488be [0228.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0228.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.146] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297150\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297150\\...."), lpSecurityAttributes=0x256228) returned 1 [0228.147] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297150\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297150\\....\\temporaryfile")) returned 0 [0228.147] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297150\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297150\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297150\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297150\\temporaryfile")) returned 1 [0228.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297150\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cee4f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cee4f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cee4f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.149] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cee4f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cee4f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cee4f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.149] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cee4f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cee4f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cee4f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.149] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297150\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cee4f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cee4f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cee4f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.149] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cee4f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cee4f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cee4f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.149] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cee4f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cee4f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cee4f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.149] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.149] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297150\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297150\\temporaryfile")) returned 1 [0228.149] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cee4f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cee4f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cee4f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.149] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.149] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297150" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297150")) returned 1 [0228.149] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned 1 [0228.150] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.150] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8cb8*, nNumberOfBytesToWrite=0x4230, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8cb8*, lpNumberOfBytesWritten=0x18fdd8*=0x4230, lpOverlapped=0x0) returned 1 [0228.151] CloseHandle (hObject=0xdc) returned 1 [0228.152] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.153] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x75ba [0228.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x75c2) returned 0x2b4a70 [0228.153] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x75ba, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x75ba, lpOverlapped=0x0) returned 1 [0228.154] CloseHandle (hObject=0xdc) returned 1 [0228.154] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png")) returned 0 [0228.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.154] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.154] GetTickCount () returned 0x488ce [0228.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.155] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.155] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166\\....\\temporaryfile")) returned 0 [0228.155] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166\\temporaryfile")) returned 1 [0228.157] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.157] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.157] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.157] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.157] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.157] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.157] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.157] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166\\temporaryfile")) returned 1 [0228.157] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.157] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.157] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166")) returned 1 [0228.158] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 1 [0228.158] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.159] WriteFile (in: hFile=0xdc, lpBuffer=0x2bc048*, nNumberOfBytesToWrite=0x75c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bc048*, lpNumberOfBytesWritten=0x18fdd8*=0x75c0, lpOverlapped=0x0) returned 1 [0228.160] CloseHandle (hObject=0xdc) returned 1 [0228.160] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.160] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.161] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.162] CloseHandle (hObject=0xdc) returned 1 [0228.162] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp")) returned 0 [0228.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.162] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.162] GetTickCount () returned 0x488ce [0228.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.163] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.163] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166\\....\\temporaryfile")) returned 0 [0228.163] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166\\temporaryfile")) returned 1 [0228.168] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.168] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.168] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.168] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.168] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.168] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.168] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.168] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166\\temporaryfile")) returned 1 [0228.168] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf0b0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf0b0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf0b0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.168] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.168] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297166" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297166")) returned 1 [0228.170] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 1 [0228.170] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.171] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.172] CloseHandle (hObject=0xdc) returned 1 [0228.172] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.172] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1278 [0228.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1280) returned 0x25b528 [0228.172] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1278, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1278, lpOverlapped=0x0) returned 1 [0228.174] CloseHandle (hObject=0xdc) returned 1 [0228.174] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png")) returned 0 [0228.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.174] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.174] GetTickCount () returned 0x488dd [0228.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.175] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297181\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297181\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.175] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297181\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297181\\....\\temporaryfile")) returned 0 [0228.175] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297181\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297181\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297181\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297181\\temporaryfile")) returned 1 [0228.176] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297181\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf31240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf31240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf31240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.176] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf31240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf31240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf31240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.176] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf31240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf31240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf31240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.176] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297181\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf31240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf31240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf31240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.176] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf31240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf31240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf31240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.177] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf31240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf31240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf31240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.177] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.177] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297181\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297181\\temporaryfile")) returned 1 [0228.177] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf31240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf31240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf31240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.177] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.177] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297181" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297181")) returned 1 [0228.177] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 1 [0228.177] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.178] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x1280, lpOverlapped=0x0) returned 1 [0228.179] CloseHandle (hObject=0xdc) returned 1 [0228.179] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.179] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x166e [0228.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1676) returned 0x299460 [0228.179] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x166e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x166e, lpOverlapped=0x0) returned 1 [0228.185] CloseHandle (hObject=0xdc) returned 1 [0228.185] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png")) returned 0 [0228.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.186] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.186] GetTickCount () returned 0x488ed [0228.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.186] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.187] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197\\....\\temporaryfile")) returned 0 [0228.187] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197\\temporaryfile")) returned 1 [0228.188] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.188] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.188] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.188] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.188] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.188] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.188] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.188] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197\\temporaryfile")) returned 1 [0228.189] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.189] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.189] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197")) returned 1 [0228.189] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 1 [0228.189] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.190] WriteFile (in: hFile=0xdc, lpBuffer=0x29aae8*, nNumberOfBytesToWrite=0x1678, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29aae8*, lpNumberOfBytesWritten=0x18fdd8*=0x1678, lpOverlapped=0x0) returned 1 [0228.190] CloseHandle (hObject=0xdc) returned 1 [0228.192] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.193] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x12ea [0228.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12f2) returned 0x25b528 [0228.193] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12ea, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x12ea, lpOverlapped=0x0) returned 1 [0228.194] CloseHandle (hObject=0xdc) returned 1 [0228.194] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png")) returned 0 [0228.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.194] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.194] GetTickCount () returned 0x488ed [0228.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.195] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.196] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197\\....\\temporaryfile")) returned 0 [0228.196] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197\\temporaryfile")) returned 1 [0228.197] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.197] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.197] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.197] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.197] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.197] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.197] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.197] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197\\temporaryfile")) returned 1 [0228.197] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf573a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf573a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf573a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.198] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.198] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297197" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297197")) returned 1 [0228.198] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png") returned 1 [0228.198] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.198] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x12f0, lpOverlapped=0x0) returned 1 [0228.199] CloseHandle (hObject=0xdc) returned 1 [0228.200] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.200] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13e0 [0228.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0228.201] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13e0, lpOverlapped=0x0) returned 1 [0228.202] CloseHandle (hObject=0xdc) returned 1 [0228.202] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png")) returned 0 [0228.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.202] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.202] GetTickCount () returned 0x488fd [0228.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.203] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.203] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213\\....\\temporaryfile")) returned 0 [0228.203] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213\\temporaryfile")) returned 1 [0228.205] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.205] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.205] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.205] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.205] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213\\temporaryfile")) returned 1 [0228.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.205] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213")) returned 1 [0228.205] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 1 [0228.206] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.206] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13e8, lpOverlapped=0x0) returned 1 [0228.207] CloseHandle (hObject=0xdc) returned 1 [0228.207] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.208] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc3a [0228.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0228.208] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xc3a, lpOverlapped=0x0) returned 1 [0228.209] CloseHandle (hObject=0xdc) returned 1 [0228.210] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png")) returned 0 [0228.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.210] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.210] GetTickCount () returned 0x488fd [0228.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.210] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.211] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213\\....\\temporaryfile")) returned 0 [0228.211] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213\\temporaryfile")) returned 1 [0228.212] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.212] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.212] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.212] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.212] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.213] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.213] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.213] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213\\temporaryfile")) returned 1 [0228.213] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cf7d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cf7d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cf7d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.213] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.213] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297213" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297213")) returned 1 [0228.213] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 1 [0228.213] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.214] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xc40, lpOverlapped=0x0) returned 1 [0228.215] CloseHandle (hObject=0xdc) returned 1 [0228.215] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.216] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13a1 [0228.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0228.216] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13a1, lpOverlapped=0x0) returned 1 [0228.218] CloseHandle (hObject=0xdc) returned 1 [0228.218] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png")) returned 0 [0228.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.218] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.218] GetTickCount () returned 0x4890c [0228.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.218] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.219] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228\\....\\temporaryfile")) returned 0 [0228.219] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228\\temporaryfile")) returned 1 [0228.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.220] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.220] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.220] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.220] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.220] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.220] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228\\temporaryfile")) returned 1 [0228.221] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.221] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228")) returned 1 [0228.221] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 1 [0228.221] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.222] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13a8, lpOverlapped=0x0) returned 1 [0228.222] CloseHandle (hObject=0xdc) returned 1 [0228.223] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.224] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc2e [0228.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0228.224] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xc2e, lpOverlapped=0x0) returned 1 [0228.225] CloseHandle (hObject=0xdc) returned 1 [0228.225] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png")) returned 0 [0228.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.225] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.225] GetTickCount () returned 0x4890c [0228.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.226] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.227] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228\\....\\temporaryfile")) returned 0 [0228.227] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228\\temporaryfile")) returned 1 [0228.228] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.228] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.228] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.228] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.228] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.228] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.228] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.228] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228\\temporaryfile")) returned 1 [0228.228] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfa3660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfa3660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfa3660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.228] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.228] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297228" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297228")) returned 1 [0228.229] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 1 [0228.229] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.229] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xc38, lpOverlapped=0x0) returned 1 [0228.230] CloseHandle (hObject=0xdc) returned 1 [0228.230] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.232] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x135b [0228.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0228.232] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x135b, lpOverlapped=0x0) returned 1 [0228.233] CloseHandle (hObject=0xdc) returned 1 [0228.233] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0 [0228.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.233] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.233] GetTickCount () returned 0x4891c [0228.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.234] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.234] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244\\....\\temporaryfile")) returned 0 [0228.234] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244\\temporaryfile")) returned 1 [0228.235] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.236] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.236] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.236] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.236] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.236] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.236] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.236] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244\\temporaryfile")) returned 1 [0228.236] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.236] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.236] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244")) returned 1 [0228.236] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png") returned 1 [0228.237] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.239] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x1360, lpOverlapped=0x0) returned 1 [0228.240] CloseHandle (hObject=0xdc) returned 1 [0228.240] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.241] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc09 [0228.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0228.241] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xc09, lpOverlapped=0x0) returned 1 [0228.243] CloseHandle (hObject=0xdc) returned 1 [0228.243] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0 [0228.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.243] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.243] GetTickCount () returned 0x4891c [0228.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.244] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.244] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244\\....\\temporaryfile")) returned 0 [0228.244] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244\\temporaryfile")) returned 1 [0228.245] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.246] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.246] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.246] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.246] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.246] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.246] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.246] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244\\temporaryfile")) returned 1 [0228.246] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfc97c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfc97c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfc97c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.246] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.246] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297244" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297244")) returned 1 [0228.246] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png") returned 1 [0228.247] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.247] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xc10, lpOverlapped=0x0) returned 1 [0228.248] CloseHandle (hObject=0xdc) returned 1 [0228.248] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.249] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14fc [0228.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1504) returned 0x299460 [0228.249] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x14fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x14fc, lpOverlapped=0x0) returned 1 [0228.250] CloseHandle (hObject=0xdc) returned 1 [0228.250] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png")) returned 0 [0228.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.250] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.250] GetTickCount () returned 0x4892b [0228.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.251] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.252] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259\\....\\temporaryfile")) returned 0 [0228.252] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259\\temporaryfile")) returned 1 [0228.253] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.253] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.253] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.253] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.253] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.253] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.253] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.253] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259\\temporaryfile")) returned 1 [0228.253] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.253] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.253] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259")) returned 1 [0228.254] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png") returned 1 [0228.254] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.254] WriteFile (in: hFile=0xdc, lpBuffer=0x29a978*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29a978*, lpNumberOfBytesWritten=0x18fdd8*=0x1500, lpOverlapped=0x0) returned 1 [0228.255] CloseHandle (hObject=0xdc) returned 1 [0228.255] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.256] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1274 [0228.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x127c) returned 0x25b528 [0228.256] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1274, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1274, lpOverlapped=0x0) returned 1 [0228.257] CloseHandle (hObject=0xdc) returned 1 [0228.257] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png")) returned 0 [0228.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.257] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.257] GetTickCount () returned 0x4892b [0228.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.258] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.259] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259\\....\\temporaryfile")) returned 0 [0228.259] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259\\temporaryfile")) returned 1 [0228.260] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.260] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.260] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.260] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.260] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.260] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259\\temporaryfile")) returned 1 [0228.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8cfef920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8cfef920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8cfef920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.260] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.261] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297259" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297259")) returned 1 [0228.261] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png") returned 1 [0228.261] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.261] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1278, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x1278, lpOverlapped=0x0) returned 1 [0228.262] CloseHandle (hObject=0xdc) returned 1 [0228.262] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.263] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1266 [0228.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x126e) returned 0x25b528 [0228.263] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1266, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1266, lpOverlapped=0x0) returned 1 [0228.264] CloseHandle (hObject=0xdc) returned 1 [0228.264] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png")) returned 0 [0228.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.264] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.264] GetTickCount () returned 0x4893b [0228.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.265] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.265] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275\\....\\temporaryfile")) returned 0 [0228.266] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275\\temporaryfile")) returned 1 [0228.267] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.267] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.267] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.267] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.267] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.267] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.267] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.267] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275\\temporaryfile")) returned 1 [0228.267] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.267] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.267] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275")) returned 1 [0228.268] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png") returned 1 [0228.268] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.268] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x1270, lpOverlapped=0x0) returned 1 [0228.269] CloseHandle (hObject=0xdc) returned 1 [0228.269] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.270] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x59b9 [0228.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x59c1) returned 0x2b4a70 [0228.270] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x59b9, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x59b9, lpOverlapped=0x0) returned 1 [0228.272] CloseHandle (hObject=0xdc) returned 1 [0228.272] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png")) returned 0 [0228.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.272] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.272] GetTickCount () returned 0x4893b [0228.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.272] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.273] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275\\....\\temporaryfile")) returned 0 [0228.273] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275\\temporaryfile")) returned 1 [0228.274] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.274] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.274] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.274] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.274] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.275] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.275] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.275] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275\\temporaryfile")) returned 1 [0228.275] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d015a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d015a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d015a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.275] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.275] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297275" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297275")) returned 1 [0228.275] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png") returned 1 [0228.276] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.276] WriteFile (in: hFile=0xdc, lpBuffer=0x2ba448*, nNumberOfBytesToWrite=0x59c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ba448*, lpNumberOfBytesWritten=0x18fdd8*=0x59c0, lpOverlapped=0x0) returned 1 [0228.277] CloseHandle (hObject=0xdc) returned 1 [0228.277] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.278] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x160f [0228.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1617) returned 0x299460 [0228.278] ReadFile (in: hFile=0xdc, lpBuffer=0x299468, nNumberOfBytesToRead=0x160f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdf0*=0x160f, lpOverlapped=0x0) returned 1 [0228.279] CloseHandle (hObject=0xdc) returned 1 [0228.279] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png")) returned 0 [0228.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.279] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.279] GetTickCount () returned 0x4894b [0228.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.280] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.280] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291\\....\\temporaryfile")) returned 0 [0228.281] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291\\temporaryfile")) returned 1 [0228.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.282] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.282] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.282] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291\\temporaryfile")) returned 1 [0228.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.282] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291")) returned 1 [0228.282] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png") returned 1 [0228.283] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.283] WriteFile (in: hFile=0xdc, lpBuffer=0x29aa88*, nNumberOfBytesToWrite=0x1618, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29aa88*, lpNumberOfBytesWritten=0x18fdd8*=0x1618, lpOverlapped=0x0) returned 1 [0228.284] CloseHandle (hObject=0xdc) returned 1 [0228.284] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.285] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc8e [0228.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc96) returned 0x25f580 [0228.285] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc8e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xc8e, lpOverlapped=0x0) returned 1 [0228.286] CloseHandle (hObject=0xdc) returned 1 [0228.286] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png")) returned 0 [0228.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.286] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.286] GetTickCount () returned 0x4894b [0228.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.287] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.288] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291\\....\\temporaryfile")) returned 0 [0228.288] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291\\temporaryfile")) returned 1 [0228.292] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.292] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.292] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.292] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.292] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.292] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.292] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.292] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291\\temporaryfile")) returned 1 [0228.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d03bbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d03bbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d03bbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.293] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.293] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297291" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297291")) returned 1 [0228.293] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned 1 [0228.293] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.295] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xc98, lpOverlapped=0x0) returned 1 [0228.296] CloseHandle (hObject=0xdc) returned 1 [0228.296] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.297] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.297] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.298] CloseHandle (hObject=0xdc) returned 1 [0228.298] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp")) returned 0 [0228.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.299] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.299] GetTickCount () returned 0x4895a [0228.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.299] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.300] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306\\....\\temporaryfile")) returned 0 [0228.300] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306\\temporaryfile")) returned 1 [0228.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.301] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.301] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.301] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306\\temporaryfile")) returned 1 [0228.302] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.302] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.302] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306")) returned 1 [0228.302] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 1 [0228.302] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.303] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.303] CloseHandle (hObject=0xdc) returned 1 [0228.304] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.304] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.304] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.305] CloseHandle (hObject=0xdc) returned 1 [0228.305] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp")) returned 0 [0228.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.306] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.306] GetTickCount () returned 0x4895a [0228.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.306] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.307] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306\\....\\temporaryfile")) returned 0 [0228.307] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306\\temporaryfile")) returned 1 [0228.308] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.308] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.308] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.308] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.308] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.308] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.308] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.308] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306\\temporaryfile")) returned 1 [0228.309] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d061d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d061d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d061d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.309] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.309] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297306" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297306")) returned 1 [0228.309] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 1 [0228.309] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.310] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.311] CloseHandle (hObject=0xdc) returned 1 [0228.311] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.311] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.311] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.313] CloseHandle (hObject=0xdc) returned 1 [0228.313] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp")) returned 0 [0228.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.313] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.313] GetTickCount () returned 0x4896a [0228.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.313] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.314] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322\\....\\temporaryfile")) returned 0 [0228.314] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322\\temporaryfile")) returned 1 [0228.315] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.315] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.315] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.315] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.315] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.315] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.315] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.315] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322\\temporaryfile")) returned 1 [0228.316] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.316] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.316] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322")) returned 1 [0228.316] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 1 [0228.316] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.317] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.317] CloseHandle (hObject=0xdc) returned 1 [0228.318] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.318] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.318] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.318] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.319] CloseHandle (hObject=0xdc) returned 1 [0228.319] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp")) returned 0 [0228.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.320] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.320] GetTickCount () returned 0x4896a [0228.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.320] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.321] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322\\....\\temporaryfile")) returned 0 [0228.321] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322\\temporaryfile")) returned 1 [0228.322] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.322] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.322] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.322] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.322] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.322] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.322] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.322] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322\\temporaryfile")) returned 1 [0228.323] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d087ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d087ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d087ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.323] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.323] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297322" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297322")) returned 1 [0228.323] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp") returned 1 [0228.323] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.324] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.325] CloseHandle (hObject=0xdc) returned 1 [0228.325] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.326] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.326] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.327] CloseHandle (hObject=0xdc) returned 1 [0228.327] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp")) returned 0 [0228.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.327] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.327] GetTickCount () returned 0x48979 [0228.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.328] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.328] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337\\....\\temporaryfile")) returned 0 [0228.329] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337\\temporaryfile")) returned 1 [0228.329] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.330] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.330] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.330] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.330] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.330] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337\\temporaryfile")) returned 1 [0228.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.330] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.330] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337")) returned 1 [0228.330] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 1 [0228.331] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.331] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.332] CloseHandle (hObject=0xdc) returned 1 [0228.332] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.333] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.333] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.334] CloseHandle (hObject=0xdc) returned 1 [0228.334] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp")) returned 0 [0228.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.334] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.334] GetTickCount () returned 0x48979 [0228.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.335] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.335] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337\\....\\temporaryfile")) returned 0 [0228.336] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337\\temporaryfile")) returned 1 [0228.337] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.337] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.337] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.337] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.337] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.337] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.337] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.337] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337\\temporaryfile")) returned 1 [0228.337] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0ae000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0ae000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0ae000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.337] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.337] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297337" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297337")) returned 1 [0228.337] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 1 [0228.338] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.338] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.339] CloseHandle (hObject=0xdc) returned 1 [0228.339] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.340] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.340] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.341] CloseHandle (hObject=0xdc) returned 1 [0228.341] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp")) returned 0 [0228.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.341] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.341] GetTickCount () returned 0x48989 [0228.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.342] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.342] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353\\....\\temporaryfile")) returned 0 [0228.342] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353\\temporaryfile")) returned 1 [0228.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.343] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.344] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.344] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.344] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.344] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.344] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353\\temporaryfile")) returned 1 [0228.344] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.344] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353")) returned 1 [0228.344] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned 1 [0228.345] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.345] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.346] CloseHandle (hObject=0xdc) returned 1 [0228.346] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.347] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.347] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.348] CloseHandle (hObject=0xdc) returned 1 [0228.348] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp")) returned 0 [0228.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.349] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.349] GetTickCount () returned 0x48989 [0228.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.349] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.350] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353\\....\\temporaryfile")) returned 0 [0228.350] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353\\temporaryfile")) returned 1 [0228.351] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.351] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.351] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.351] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.351] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.351] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.351] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.352] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353\\temporaryfile")) returned 1 [0228.352] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0d4160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0d4160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0d4160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.352] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.352] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297353" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297353")) returned 1 [0228.352] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp") returned 1 [0228.352] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.353] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.354] CloseHandle (hObject=0xdc) returned 1 [0228.354] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.354] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.354] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.355] CloseHandle (hObject=0xdc) returned 1 [0228.356] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp")) returned 0 [0228.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.356] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.356] GetTickCount () returned 0x48999 [0228.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.356] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.357] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\....\\temporaryfile")) returned 0 [0228.357] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\temporaryfile")) returned 1 [0228.358] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.358] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.358] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.358] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.358] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.358] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.358] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.358] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\temporaryfile")) returned 1 [0228.359] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.359] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.359] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369")) returned 1 [0228.359] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp") returned 1 [0228.359] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.360] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.360] CloseHandle (hObject=0xdc) returned 1 [0228.361] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.361] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.361] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.362] CloseHandle (hObject=0xdc) returned 1 [0228.362] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp")) returned 0 [0228.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.363] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.363] GetTickCount () returned 0x48999 [0228.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.363] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.364] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\....\\temporaryfile")) returned 0 [0228.364] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\temporaryfile")) returned 1 [0228.365] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.365] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.365] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.365] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.365] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.365] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.365] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.365] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\temporaryfile")) returned 1 [0228.366] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d0fa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d0fa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d0fa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.366] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.366] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369")) returned 1 [0228.366] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp") returned 1 [0228.366] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.367] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.367] CloseHandle (hObject=0xdc) returned 1 [0228.368] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.368] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.368] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.371] CloseHandle (hObject=0xdc) returned 1 [0228.371] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp")) returned 0 [0228.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.371] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.371] GetTickCount () returned 0x48999 [0228.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.372] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.372] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\....\\temporaryfile")) returned 0 [0228.372] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\temporaryfile")) returned 1 [0228.373] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.374] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.374] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.374] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.374] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.374] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.374] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.374] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369\\temporaryfile")) returned 1 [0228.374] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.374] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.374] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297369" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297369")) returned 1 [0228.374] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp") returned 1 [0228.375] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.375] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.376] CloseHandle (hObject=0xdc) returned 1 [0228.376] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.377] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d0 [0228.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13d8) returned 0x25b528 [0228.377] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d0, lpOverlapped=0x0) returned 1 [0228.378] CloseHandle (hObject=0xdc) returned 1 [0228.378] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0 [0228.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.378] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.378] GetTickCount () returned 0x489a8 [0228.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea80 [0228.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.379] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.379] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384\\....\\temporaryfile")) returned 0 [0228.380] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384\\temporaryfile")) returned 1 [0228.381] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.381] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.381] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.381] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.381] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.381] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.381] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384\\temporaryfile")) returned 1 [0228.381] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.381] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384")) returned 1 [0228.382] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp") returned 1 [0228.382] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.382] WriteFile (in: hFile=0xdc, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0228.383] CloseHandle (hObject=0xdc) returned 1 [0228.383] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.384] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd86 [0228.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd8e) returned 0x25f580 [0228.384] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xd86, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xd86, lpOverlapped=0x0) returned 1 [0228.385] CloseHandle (hObject=0xdc) returned 1 [0228.385] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0 [0228.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.385] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.386] GetTickCount () returned 0x489a8 [0228.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.386] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.387] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384\\....\\temporaryfile")) returned 0 [0228.387] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384\\temporaryfile")) returned 1 [0228.388] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.388] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.388] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.388] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.388] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.388] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.388] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.388] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384\\temporaryfile")) returned 1 [0228.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d120420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d120420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d120420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.389] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.389] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297384" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297384")) returned 1 [0228.389] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png") returned 1 [0228.389] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.390] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xd90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xd90, lpOverlapped=0x0) returned 1 [0228.390] CloseHandle (hObject=0xdc) returned 1 [0228.391] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.391] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd3e [0228.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd46) returned 0x25f580 [0228.391] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xd3e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xd3e, lpOverlapped=0x0) returned 1 [0228.392] CloseHandle (hObject=0xdc) returned 1 [0228.392] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0 [0228.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.393] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.393] GetTickCount () returned 0x489b8 [0228.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.393] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.394] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400\\....\\temporaryfile")) returned 0 [0228.394] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400\\temporaryfile")) returned 1 [0228.395] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.395] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.395] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.395] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.396] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.396] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400\\temporaryfile")) returned 1 [0228.396] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.396] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.396] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400")) returned 1 [0228.396] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png") returned 1 [0228.396] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.397] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xd48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xd48, lpOverlapped=0x0) returned 1 [0228.398] CloseHandle (hObject=0xdc) returned 1 [0228.398] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.398] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc8e [0228.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc96) returned 0x25f580 [0228.398] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc8e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xc8e, lpOverlapped=0x0) returned 1 [0228.400] CloseHandle (hObject=0xdc) returned 1 [0228.400] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png")) returned 0 [0228.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.400] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.400] GetTickCount () returned 0x489b8 [0228.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.400] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.404] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400\\....\\temporaryfile")) returned 0 [0228.405] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400\\temporaryfile")) returned 1 [0228.406] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d16c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d16c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.406] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d16c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d16c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.406] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.406] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.406] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.406] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.406] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.406] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400\\temporaryfile")) returned 1 [0228.406] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d146580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d146580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d146580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.406] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.406] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297400" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297400")) returned 1 [0228.407] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png") returned 1 [0228.407] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.407] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xc98, lpOverlapped=0x0) returned 1 [0228.408] CloseHandle (hObject=0xdc) returned 1 [0228.408] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.409] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5caa [0228.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5cb2) returned 0x2b4a70 [0228.409] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5caa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x5caa, lpOverlapped=0x0) returned 1 [0228.410] CloseHandle (hObject=0xdc) returned 1 [0228.410] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png")) returned 0 [0228.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0228.411] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.411] GetTickCount () returned 0x489c7 [0228.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0228.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0228.411] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297415\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297415\\...."), lpSecurityAttributes=0x256228) returned 1 [0228.412] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297415\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297415\\....\\temporaryfile")) returned 0 [0228.412] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297415\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297415\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297415\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297415\\temporaryfile")) returned 1 [0228.413] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297415\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d16c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d16c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d16c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0228.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d16c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d16c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d16c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d16c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d16c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d16c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.413] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297415\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d16c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d16c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d16c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.413] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d16c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d16c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d16c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.413] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d16c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d16c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d16c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.413] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.414] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297415\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297415\\temporaryfile")) returned 1 [0228.414] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d16c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d16c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d16c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.414] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0228.414] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297415" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297415")) returned 1 [0228.414] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png") returned 1 [0228.415] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0228.415] WriteFile (in: hFile=0xdc, lpBuffer=0x2ba738*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ba738*, lpNumberOfBytesWritten=0x18fdd8*=0x5cb0, lpOverlapped=0x0) returned 1 [0228.416] CloseHandle (hObject=0xdc) returned 1 [0228.416] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0228.416] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8d16c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d16c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0228.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0228.417] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f9e8c42, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0228.419] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f9e8c42, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0228.419] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x9f9e8c42, dwReserved1=0x1cbf8eb, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0228.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x2561e0 [0228.419] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.419] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x303d [0228.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3045) returned 0x299460 [0228.419] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x303d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x303d, lpOverlapped=0x0) returned 1 [0228.421] CloseHandle (hObject=0xe0) returned 1 [0228.421] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0 [0228.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0228.421] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.421] GetTickCount () returned 0x489d7 [0228.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0228.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.422] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297431\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297431\\...."), lpSecurityAttributes=0x256228) returned 1 [0228.422] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297431\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297431\\....\\temporaryfile")) returned 0 [0228.422] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297431\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297431\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297431\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297431\\temporaryfile")) returned 1 [0228.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297431\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d192840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d192840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d192840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.424] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d192840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d192840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d192840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.424] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d192840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d192840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d192840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.424] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297431\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d192840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d192840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d192840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.424] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d192840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d192840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d192840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.424] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d192840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d192840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d192840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.424] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.424] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297431\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297431\\temporaryfile")) returned 1 [0228.424] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d192840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d192840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d192840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.424] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.424] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297431" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297431")) returned 1 [0228.424] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 1 [0228.425] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.425] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x3048, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdb8*=0x3048, lpOverlapped=0x0) returned 1 [0228.426] CloseHandle (hObject=0xe0) returned 1 [0228.427] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.427] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5354a [0228.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x53552) returned 0x2b4a70 [0228.428] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5354a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x5354a, lpOverlapped=0x0) returned 1 [0228.439] CloseHandle (hObject=0xe0) returned 1 [0228.440] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0 [0228.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.440] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.440] GetTickCount () returned 0x489e7 [0228.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.440] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297447\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.441] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297447\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297447\\....\\temporaryfile")) returned 0 [0228.441] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297447\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297447\\temporaryfile")) returned 1 [0228.442] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297447\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1b89a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1b89a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1b89a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.442] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1b89a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1b89a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1b89a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.442] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1b89a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1b89a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1b89a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.442] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297447\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1b89a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1b89a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1b89a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.442] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1b89a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1b89a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1b89a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.442] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1b89a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1b89a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1b89a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.442] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.443] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297447\\temporaryfile")) returned 1 [0228.443] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1b89a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1b89a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1b89a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.443] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.443] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297447" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297447")) returned 1 [0228.443] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 1 [0228.452] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.452] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x53550, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x53550, lpOverlapped=0x0) returned 1 [0228.458] CloseHandle (hObject=0xe0) returned 1 [0228.458] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.458] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4f6ca [0228.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f6d2) returned 0x2b4a70 [0228.458] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4f6ca, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4f6ca, lpOverlapped=0x0) returned 1 [0228.462] CloseHandle (hObject=0xe0) returned 1 [0228.462] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0 [0228.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.462] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.462] GetTickCount () returned 0x489f6 [0228.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.463] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297462\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297462\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.463] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297462\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297462\\....\\temporaryfile")) returned 0 [0228.464] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297462\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297462\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297462\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297462\\temporaryfile")) returned 1 [0228.465] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297462\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1deb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1deb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1deb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.465] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1deb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1deb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1deb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.465] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1deb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1deb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1deb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.465] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297462\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1deb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1deb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1deb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.465] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1deb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1deb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1deb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.465] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1deb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1deb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1deb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.465] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.465] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297462\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297462\\temporaryfile")) returned 1 [0228.465] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d1deb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d1deb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d1deb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.465] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.466] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297462" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297462")) returned 1 [0228.466] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 1 [0228.471] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.471] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x4f6d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x4f6d0, lpOverlapped=0x0) returned 1 [0228.476] CloseHandle (hObject=0xe0) returned 1 [0228.476] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.477] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2279e [0228.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x227a6) returned 0x2b4a70 [0228.477] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2279e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2279e, lpOverlapped=0x0) returned 1 [0228.479] CloseHandle (hObject=0xe0) returned 1 [0228.479] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0 [0228.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.479] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.479] GetTickCount () returned 0x48a06 [0228.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.480] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297478\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297478\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.480] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297478\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297478\\....\\temporaryfile")) returned 0 [0228.480] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297478\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297478\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297478\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297478\\temporaryfile")) returned 1 [0228.481] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297478\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d204c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d204c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d204c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.481] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d204c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d204c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d204c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.481] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d204c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d204c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d204c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.481] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297478\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d204c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d204c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d204c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.481] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d204c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d204c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d204c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.482] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d204c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d204c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d204c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.482] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.482] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297478\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297478\\temporaryfile")) returned 1 [0228.482] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d204c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d204c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d204c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.482] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.482] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297478" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297478")) returned 1 [0228.482] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 1 [0228.484] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.485] WriteFile (in: hFile=0xe0, lpBuffer=0x2d7228*, nNumberOfBytesToWrite=0x227a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2d7228*, lpNumberOfBytesWritten=0x18fdb8*=0x227a8, lpOverlapped=0x0) returned 1 [0228.487] CloseHandle (hObject=0xe0) returned 1 [0228.487] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.488] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2661e [0228.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26626) returned 0x2b4a70 [0228.488] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2661e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2661e, lpOverlapped=0x0) returned 1 [0228.490] CloseHandle (hObject=0xe0) returned 1 [0228.490] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0 [0228.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.490] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.490] GetTickCount () returned 0x48a15 [0228.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.491] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297493\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297493\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.492] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297493\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297493\\....\\temporaryfile")) returned 0 [0228.492] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297493\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297493\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297493\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297493\\temporaryfile")) returned 1 [0228.493] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297493\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d22adc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d22adc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d22adc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.493] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d22adc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d22adc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d22adc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.493] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d22adc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d22adc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d22adc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.493] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297493\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d22adc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d22adc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d22adc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.493] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d22adc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d22adc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d22adc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.493] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d22adc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d22adc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d22adc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.494] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.494] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297493\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297493\\temporaryfile")) returned 1 [0228.494] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d22adc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d22adc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d22adc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.494] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.494] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297493" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297493")) returned 1 [0228.494] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 1 [0228.497] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.497] WriteFile (in: hFile=0xe0, lpBuffer=0x2db0a8*, nNumberOfBytesToWrite=0x26628, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2db0a8*, lpNumberOfBytesWritten=0x18fdb8*=0x26628, lpOverlapped=0x0) returned 1 [0228.500] CloseHandle (hObject=0xe0) returned 1 [0228.500] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.501] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1c9de [0228.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c9e6) returned 0x2b4a70 [0228.501] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1c9de, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1c9de, lpOverlapped=0x0) returned 1 [0228.503] CloseHandle (hObject=0xe0) returned 1 [0228.503] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0 [0228.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.503] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.503] GetTickCount () returned 0x48a25 [0228.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.504] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297509\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297509\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.504] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297509\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297509\\....\\temporaryfile")) returned 0 [0228.504] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297509\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297509\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297509\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297509\\temporaryfile")) returned 1 [0228.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297509\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d250f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d250f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d250f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.505] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d250f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d250f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d250f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.505] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d250f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d250f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d250f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.506] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297509\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d250f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d250f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d250f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.506] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d250f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d250f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d250f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.506] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d250f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d250f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d250f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.506] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.506] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297509\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297509\\temporaryfile")) returned 1 [0228.506] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d250f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d250f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d250f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.506] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.506] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297509" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297509")) returned 1 [0228.506] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 1 [0228.508] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.509] WriteFile (in: hFile=0xe0, lpBuffer=0x2d1468*, nNumberOfBytesToWrite=0x1c9e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2d1468*, lpNumberOfBytesWritten=0x18fdb8*=0x1c9e8, lpOverlapped=0x0) returned 1 [0228.511] CloseHandle (hObject=0xe0) returned 1 [0228.511] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.512] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2279e [0228.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x227a6) returned 0x2b4a70 [0228.512] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2279e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2279e, lpOverlapped=0x0) returned 1 [0228.514] CloseHandle (hObject=0xe0) returned 1 [0228.514] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv")) returned 0 [0228.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.514] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0228.514] GetTickCount () returned 0x48a35 [0228.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.515] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.515] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525\\....\\temporaryfile")) returned 0 [0228.515] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525\\temporaryfile")) returned 1 [0228.516] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.516] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.516] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.516] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.516] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.516] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.517] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.517] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525\\temporaryfile")) returned 1 [0228.517] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.517] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.517] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525")) returned 1 [0228.517] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 1 [0228.519] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.521] WriteFile (in: hFile=0xe0, lpBuffer=0x2d7228*, nNumberOfBytesToWrite=0x227a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2d7228*, lpNumberOfBytesWritten=0x18fdb8*=0x227a8, lpOverlapped=0x0) returned 1 [0228.523] CloseHandle (hObject=0xe0) returned 1 [0228.523] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.524] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2666c [0228.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26674) returned 0x2b4a70 [0228.524] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2666c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2666c, lpOverlapped=0x0) returned 1 [0228.525] CloseHandle (hObject=0xe0) returned 1 [0228.526] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0 [0228.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.526] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.526] GetTickCount () returned 0x48a35 [0228.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.526] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.527] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525\\....\\temporaryfile")) returned 0 [0228.527] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525\\temporaryfile")) returned 1 [0228.528] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d29d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d29d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.528] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d29d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d29d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.528] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.528] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.529] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.529] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.529] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.529] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525\\temporaryfile")) returned 1 [0228.529] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d277080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d277080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d277080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.529] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.529] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297525" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297525")) returned 1 [0228.529] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 1 [0228.532] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.532] WriteFile (in: hFile=0xe0, lpBuffer=0x2db0f8*, nNumberOfBytesToWrite=0x26670, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2db0f8*, lpNumberOfBytesWritten=0x18fdb8*=0x26670, lpOverlapped=0x0) returned 1 [0228.535] CloseHandle (hObject=0xe0) returned 1 [0228.535] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.535] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2666c [0228.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26674) returned 0x2b4a70 [0228.535] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2666c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2666c, lpOverlapped=0x0) returned 1 [0228.537] CloseHandle (hObject=0xe0) returned 1 [0228.537] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0 [0228.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.538] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.538] GetTickCount () returned 0x48a44 [0228.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.539] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297540\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297540\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.539] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297540\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297540\\....\\temporaryfile")) returned 0 [0228.540] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297540\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297540\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297540\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297540\\temporaryfile")) returned 1 [0228.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297540\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d29d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d29d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d29d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.541] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d29d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d29d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d29d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.541] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d29d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d29d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d29d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297540\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d29d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d29d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d29d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.541] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d29d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d29d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d29d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.541] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d29d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d29d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d29d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.541] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297540\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297540\\temporaryfile")) returned 1 [0228.542] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d29d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d29d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d29d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.542] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.542] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297540" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297540")) returned 1 [0228.542] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 1 [0228.545] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.546] WriteFile (in: hFile=0xe0, lpBuffer=0x2db0f8*, nNumberOfBytesToWrite=0x26670, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2db0f8*, lpNumberOfBytesWritten=0x18fdb8*=0x26670, lpOverlapped=0x0) returned 1 [0228.548] CloseHandle (hObject=0xe0) returned 1 [0228.549] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.550] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2472c [0228.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24734) returned 0x2b4a70 [0228.550] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2472c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2472c, lpOverlapped=0x0) returned 1 [0228.552] CloseHandle (hObject=0xe0) returned 1 [0228.552] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv")) returned 0 [0228.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.552] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.552] GetTickCount () returned 0x48a54 [0228.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.554] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297556\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297556\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.554] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297556\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297556\\....\\temporaryfile")) returned 0 [0228.554] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297556\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297556\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297556\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297556\\temporaryfile")) returned 1 [0228.556] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297556\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2c3340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2c3340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2c3340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.556] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2c3340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2c3340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2c3340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.556] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2c3340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2c3340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2c3340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.556] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297556\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2c3340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2c3340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2c3340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.556] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2c3340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2c3340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2c3340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.556] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2c3340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2c3340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2c3340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.556] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.556] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297556\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297556\\temporaryfile")) returned 1 [0228.556] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2c3340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2c3340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2c3340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.556] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.556] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297556" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297556")) returned 1 [0228.556] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 1 [0228.559] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.559] WriteFile (in: hFile=0xe0, lpBuffer=0x2d91b8*, nNumberOfBytesToWrite=0x24730, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2d91b8*, lpNumberOfBytesWritten=0x18fdb8*=0x24730, lpOverlapped=0x0) returned 1 [0228.562] CloseHandle (hObject=0xe0) returned 1 [0228.562] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.563] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1e96c [0228.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e974) returned 0x2b4a70 [0228.563] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1e96c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1e96c, lpOverlapped=0x0) returned 1 [0228.564] CloseHandle (hObject=0xe0) returned 1 [0228.565] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv")) returned 0 [0228.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.565] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.565] GetTickCount () returned 0x48a63 [0228.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.565] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297571\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297571\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.566] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297571\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297571\\....\\temporaryfile")) returned 0 [0228.566] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297571\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297571\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297571\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297571\\temporaryfile")) returned 1 [0228.567] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297571\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2e94a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2e94a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2e94a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.567] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2e94a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2e94a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2e94a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.567] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2e94a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2e94a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2e94a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.567] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297571\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2e94a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2e94a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2e94a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.567] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2e94a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2e94a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2e94a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.567] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2e94a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2e94a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2e94a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.567] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.567] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297571\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297571\\temporaryfile")) returned 1 [0228.568] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d2e94a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d2e94a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d2e94a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.568] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.568] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297571" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297571")) returned 1 [0228.568] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 1 [0228.570] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.570] WriteFile (in: hFile=0xe0, lpBuffer=0x2d33f8*, nNumberOfBytesToWrite=0x1e970, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2d33f8*, lpNumberOfBytesWritten=0x18fdb8*=0x1e970, lpOverlapped=0x0) returned 1 [0228.573] CloseHandle (hObject=0xe0) returned 1 [0228.573] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.573] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xdc [0228.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe4) returned 0x28aa10 [0228.574] ReadFile (in: hFile=0xe0, lpBuffer=0x28aa18, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x28aa18*, lpNumberOfBytesRead=0x18fdd0*=0xdc, lpOverlapped=0x0) returned 1 [0228.575] CloseHandle (hObject=0xe0) returned 1 [0228.575] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0 [0228.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.575] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.575] GetTickCount () returned 0x48a73 [0228.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.576] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.577] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587\\....\\temporaryfile")) returned 0 [0228.577] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587\\temporaryfile")) returned 1 [0228.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.578] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.578] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.579] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.579] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.579] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.579] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587\\temporaryfile")) returned 1 [0228.579] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.579] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.579] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587")) returned 1 [0228.580] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 1 [0228.580] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.580] WriteFile (in: hFile=0xe0, lpBuffer=0x28ab08*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x28ab08*, lpNumberOfBytesWritten=0x18fdb8*=0xe0, lpOverlapped=0x0) returned 1 [0228.581] CloseHandle (hObject=0xe0) returned 1 [0228.582] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.582] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb6a [0228.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb72) returned 0x25f580 [0228.582] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb6a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb6a, lpOverlapped=0x0) returned 1 [0228.584] CloseHandle (hObject=0xe0) returned 1 [0228.584] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0 [0228.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.584] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.584] GetTickCount () returned 0x48a73 [0228.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.585] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.585] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587\\....\\temporaryfile")) returned 0 [0228.585] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587\\temporaryfile")) returned 1 [0228.586] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.586] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.586] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.586] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.587] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.587] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.587] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.587] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587\\temporaryfile")) returned 1 [0228.587] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d30f600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d30f600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d30f600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.587] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.587] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297587" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297587")) returned 1 [0228.587] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 1 [0228.588] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.588] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb70, lpOverlapped=0x0) returned 1 [0228.589] CloseHandle (hObject=0xe0) returned 1 [0228.589] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.591] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xf63 [0228.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf6b) returned 0x25f580 [0228.592] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xf63, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xf63, lpOverlapped=0x0) returned 1 [0228.593] CloseHandle (hObject=0xe0) returned 1 [0228.593] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png")) returned 0 [0228.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.593] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.593] GetTickCount () returned 0x48a83 [0228.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.594] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.597] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603\\....\\temporaryfile")) returned 0 [0228.598] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603\\temporaryfile")) returned 1 [0228.599] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.599] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.599] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.599] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.599] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.599] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.599] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.599] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603\\temporaryfile")) returned 1 [0228.599] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.599] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.599] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603")) returned 1 [0228.600] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned 1 [0228.600] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.600] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xf68, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xf68, lpOverlapped=0x0) returned 1 [0228.601] CloseHandle (hObject=0xe0) returned 1 [0228.601] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.602] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1197 [0228.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x119f) returned 0x25b528 [0228.602] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1197, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x1197, lpOverlapped=0x0) returned 1 [0228.603] CloseHandle (hObject=0xe0) returned 1 [0228.603] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png")) returned 0 [0228.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.604] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.604] GetTickCount () returned 0x48a83 [0228.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.604] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.605] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603\\....\\temporaryfile")) returned 0 [0228.605] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603\\temporaryfile")) returned 1 [0228.606] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.606] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.606] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.606] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.606] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.606] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.607] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.607] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603\\temporaryfile")) returned 1 [0228.607] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d335760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d335760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d335760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.607] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.607] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297603" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297603")) returned 1 [0228.607] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 1 [0228.607] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.608] WriteFile (in: hFile=0xe0, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdb8*=0x11a0, lpOverlapped=0x0) returned 1 [0228.611] CloseHandle (hObject=0xe0) returned 1 [0228.611] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.612] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11a3 [0228.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11ab) returned 0x25b528 [0228.612] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11a3, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11a3, lpOverlapped=0x0) returned 1 [0228.613] CloseHandle (hObject=0xe0) returned 1 [0228.613] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png")) returned 0 [0228.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0228.613] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.613] GetTickCount () returned 0x48a92 [0228.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.614] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297618\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297618\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0228.615] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297618\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297618\\....\\temporaryfile")) returned 0 [0228.615] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297618\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297618\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297618\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297618\\temporaryfile")) returned 1 [0228.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297618\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d35b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d35b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d35b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.617] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d35b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d35b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d35b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.617] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d35b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d35b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d35b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297618\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d35b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d35b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d35b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.617] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d35b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d35b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d35b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.617] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d35b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d35b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d35b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.617] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.617] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297618\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297618\\temporaryfile")) returned 1 [0228.618] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d35b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d35b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d35b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.618] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.618] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297618" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297618")) returned 1 [0228.618] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 1 [0228.618] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.620] WriteFile (in: hFile=0xe0, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x11a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdb8*=0x11a8, lpOverlapped=0x0) returned 1 [0228.621] CloseHandle (hObject=0xe0) returned 1 [0228.621] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.622] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1068 [0228.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1070) returned 0x25b528 [0228.622] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x1068, lpOverlapped=0x0) returned 1 [0228.623] CloseHandle (hObject=0xe0) returned 1 [0228.623] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png")) returned 0 [0228.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0228.623] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.623] GetTickCount () returned 0x48aa2 [0228.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0228.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.624] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634\\...."), lpSecurityAttributes=0x256228) returned 1 [0228.624] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634\\....\\temporaryfile")) returned 0 [0228.624] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634\\temporaryfile")) returned 1 [0228.625] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.626] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.626] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.626] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.626] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.626] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.626] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.626] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634\\temporaryfile")) returned 1 [0228.626] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.626] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.626] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634")) returned 1 [0228.626] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 1 [0228.627] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.627] WriteFile (in: hFile=0xe0, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdb8*=0x1070, lpOverlapped=0x0) returned 1 [0228.628] CloseHandle (hObject=0xe0) returned 1 [0228.628] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0228.628] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0228.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0228.629] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0228.629] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa12338ef, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0228.630] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa12338ef, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0228.630] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0xa12338ef, dwReserved1=0x1cbf8eb, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0228.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x255c98 [0228.630] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.631] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xab3 [0228.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xabb) returned 0x25f580 [0228.631] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xab3, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xab3, lpOverlapped=0x0) returned 1 [0228.632] CloseHandle (hObject=0xe0) returned 1 [0228.632] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png")) returned 0 [0228.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0228.632] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.633] GetTickCount () returned 0x48aa2 [0228.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0228.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.633] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634\\...."), lpSecurityAttributes=0x256228) returned 1 [0228.634] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634\\....\\temporaryfile")) returned 0 [0228.634] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634\\temporaryfile")) returned 1 [0228.635] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.635] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.635] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.635] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.635] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.635] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.635] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.635] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634\\temporaryfile")) returned 1 [0228.636] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d381a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d381a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d381a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.636] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.636] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297634" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297634")) returned 1 [0228.636] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png") returned 1 [0228.636] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.637] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xab8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xab8, lpOverlapped=0x0) returned 1 [0228.637] CloseHandle (hObject=0xe0) returned 1 [0228.638] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.639] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8a3 [0228.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8ab) returned 0x25f580 [0228.639] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x8a3, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x8a3, lpOverlapped=0x0) returned 1 [0228.640] CloseHandle (hObject=0xe0) returned 1 [0228.640] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png")) returned 0 [0228.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0228.640] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.640] GetTickCount () returned 0x48ab1 [0228.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0228.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.641] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649\\...."), lpSecurityAttributes=0x256228) returned 1 [0228.641] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649\\....\\temporaryfile")) returned 0 [0228.641] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649\\temporaryfile")) returned 1 [0228.642] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.642] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.643] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.643] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.643] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.643] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.643] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.643] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649\\temporaryfile")) returned 1 [0228.643] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.643] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.643] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649")) returned 1 [0228.643] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png") returned 1 [0228.644] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.644] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x8a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x8a8, lpOverlapped=0x0) returned 1 [0228.645] CloseHandle (hObject=0xe0) returned 1 [0228.645] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.646] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x60f [0228.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x617) returned 0x259e70 [0228.646] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x60f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x60f, lpOverlapped=0x0) returned 1 [0228.647] CloseHandle (hObject=0xe0) returned 1 [0228.647] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png")) returned 0 [0228.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0228.647] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.647] GetTickCount () returned 0x48ab1 [0228.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0228.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.648] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649\\...."), lpSecurityAttributes=0x256228) returned 1 [0228.648] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649\\....\\temporaryfile")) returned 0 [0228.648] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649\\temporaryfile")) returned 1 [0228.649] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.650] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.650] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.650] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.650] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.650] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.650] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.650] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649\\temporaryfile")) returned 1 [0228.650] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3a7b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3a7b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3a7b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.650] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.650] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297649" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297649")) returned 1 [0228.650] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 1 [0228.651] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.653] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x618, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x618, lpOverlapped=0x0) returned 1 [0228.654] CloseHandle (hObject=0xe0) returned 1 [0228.654] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.655] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4c15 [0228.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c1d) returned 0x2b4a70 [0228.655] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4c15, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4c15, lpOverlapped=0x0) returned 1 [0228.656] CloseHandle (hObject=0xe0) returned 1 [0228.656] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png")) returned 0 [0228.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.656] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.656] GetTickCount () returned 0x48ac1 [0228.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0228.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.657] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.657] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665\\....\\temporaryfile")) returned 0 [0228.658] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665\\temporaryfile")) returned 1 [0228.659] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.659] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.659] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.659] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.659] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.659] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.659] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.659] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665\\temporaryfile")) returned 1 [0228.659] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.659] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.659] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665")) returned 1 [0228.660] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 1 [0228.660] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.661] WriteFile (in: hFile=0xe0, lpBuffer=0x2b96a0*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b96a0*, lpNumberOfBytesWritten=0x18fdb8*=0x4c20, lpOverlapped=0x0) returned 1 [0228.662] CloseHandle (hObject=0xe0) returned 1 [0228.662] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.662] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xcc1b [0228.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcc23) returned 0x2b4a70 [0228.662] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xcc1b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xcc1b, lpOverlapped=0x0) returned 1 [0228.664] CloseHandle (hObject=0xe0) returned 1 [0228.664] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0 [0228.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0228.664] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.664] GetTickCount () returned 0x48ac1 [0228.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0228.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.665] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665\\...."), lpSecurityAttributes=0x256228) returned 1 [0228.666] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665\\....\\temporaryfile")) returned 0 [0228.666] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665\\temporaryfile")) returned 1 [0228.667] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.667] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.667] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.667] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.667] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.667] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.667] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.667] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665\\temporaryfile")) returned 1 [0228.667] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3cdce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3cdce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3cdce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.667] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.668] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297665" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297665")) returned 1 [0228.668] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 1 [0228.669] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.669] WriteFile (in: hFile=0xe0, lpBuffer=0x2c16a8*, nNumberOfBytesToWrite=0xcc20, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c16a8*, lpNumberOfBytesWritten=0x18fdb8*=0xcc20, lpOverlapped=0x0) returned 1 [0228.671] CloseHandle (hObject=0xe0) returned 1 [0228.671] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.672] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2c432 [0228.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c43a) returned 0x2b4a70 [0228.672] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2c432, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2c432, lpOverlapped=0x0) returned 1 [0228.675] CloseHandle (hObject=0xe0) returned 1 [0228.675] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv")) returned 0 [0228.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.675] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.675] GetTickCount () returned 0x48ad1 [0228.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.675] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297681\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297681\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.676] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297681\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297681\\....\\temporaryfile")) returned 0 [0228.676] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297681\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297681\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297681\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297681\\temporaryfile")) returned 1 [0228.677] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297681\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3f3e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3f3e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3f3e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.677] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3f3e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3f3e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3f3e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.677] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3f3e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3f3e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3f3e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.677] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297681\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3f3e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3f3e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3f3e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.677] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3f3e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3f3e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3f3e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.677] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3f3e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3f3e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3f3e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.677] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.678] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297681\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297681\\temporaryfile")) returned 1 [0228.678] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d3f3e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d3f3e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d3f3e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.678] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.678] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297681" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297681")) returned 1 [0228.678] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 1 [0228.681] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.681] WriteFile (in: hFile=0xe0, lpBuffer=0x2e0ec0*, nNumberOfBytesToWrite=0x2c438, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2e0ec0*, lpNumberOfBytesWritten=0x18fdb8*=0x2c438, lpOverlapped=0x0) returned 1 [0228.685] CloseHandle (hObject=0xe0) returned 1 [0228.685] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.685] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2c44a [0228.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c452) returned 0x2b4a70 [0228.685] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2c44a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2c44a, lpOverlapped=0x0) returned 1 [0228.687] CloseHandle (hObject=0xe0) returned 1 [0228.687] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv")) returned 0 [0228.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.688] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.688] GetTickCount () returned 0x48ae0 [0228.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.688] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297696\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297696\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.689] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297696\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297696\\....\\temporaryfile")) returned 0 [0228.689] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297696\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297696\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297696\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297696\\temporaryfile")) returned 1 [0228.690] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297696\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d419fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d419fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d419fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.690] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d419fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d419fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d419fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.690] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d419fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d419fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d419fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.690] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297696\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d419fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d419fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d419fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.690] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d419fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d419fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d419fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.690] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d419fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d419fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d419fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.690] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.690] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297696\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297696\\temporaryfile")) returned 1 [0228.691] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d419fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d419fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d419fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.691] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.691] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297696" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297696")) returned 1 [0228.691] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 1 [0228.694] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.694] WriteFile (in: hFile=0xe0, lpBuffer=0x2e0ed8*, nNumberOfBytesToWrite=0x2c450, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2e0ed8*, lpNumberOfBytesWritten=0x18fdb8*=0x2c450, lpOverlapped=0x0) returned 1 [0228.697] CloseHandle (hObject=0xe0) returned 1 [0228.697] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.698] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x39ef2 [0228.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x39efa) returned 0x2b4a70 [0228.698] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x39ef2, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x39ef2, lpOverlapped=0x0) returned 1 [0228.700] CloseHandle (hObject=0xe0) returned 1 [0228.700] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv")) returned 0 [0228.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.700] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.700] GetTickCount () returned 0x48af0 [0228.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.701] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297712\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.701] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297712\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297712\\....\\temporaryfile")) returned 0 [0228.702] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297712\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297712\\temporaryfile")) returned 1 [0228.703] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297712\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d440100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d440100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d440100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.703] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d440100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d440100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d440100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.703] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d440100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d440100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d440100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.703] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297712\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d440100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d440100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d440100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.703] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d440100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d440100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d440100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.703] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d440100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d440100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d440100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.703] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.703] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297712\\temporaryfile")) returned 1 [0228.703] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d440100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d440100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d440100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.703] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297712" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297712")) returned 1 [0228.704] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 1 [0228.707] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.708] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x39ef8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x39ef8, lpOverlapped=0x0) returned 1 [0228.711] CloseHandle (hObject=0xe0) returned 1 [0228.712] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.712] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x41c0a [0228.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x41c12) returned 0x2b4a70 [0228.712] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x41c0a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x41c0a, lpOverlapped=0x0) returned 1 [0228.715] CloseHandle (hObject=0xe0) returned 1 [0228.716] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv")) returned 0 [0228.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.716] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.716] GetTickCount () returned 0x48aff [0228.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.717] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297727\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297727\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.725] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297727\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297727\\....\\temporaryfile")) returned 0 [0228.725] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297727\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297727\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297727\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297727\\temporaryfile")) returned 1 [0228.727] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297727\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d466260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d466260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d466260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.727] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d466260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d466260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d466260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.727] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d466260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d466260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d466260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.727] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297727\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d466260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d466260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d466260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.727] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d466260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d466260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d466260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.727] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d466260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d466260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d466260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.727] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.727] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297727\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297727\\temporaryfile")) returned 1 [0228.728] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d466260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d466260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d466260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.728] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.728] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297727" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297727")) returned 1 [0228.728] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 1 [0228.732] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.733] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x41c10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x41c10, lpOverlapped=0x0) returned 1 [0228.738] CloseHandle (hObject=0xe0) returned 1 [0228.739] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.740] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xdc5 [0228.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdcd) returned 0x25f580 [0228.740] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xdc5, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xdc5, lpOverlapped=0x0) returned 1 [0228.741] CloseHandle (hObject=0xe0) returned 1 [0228.741] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0 [0228.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.741] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.741] GetTickCount () returned 0x48b0f [0228.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.742] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297743\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297743\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.742] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297743\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297743\\....\\temporaryfile")) returned 0 [0228.742] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297743\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297743\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297743\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297743\\temporaryfile")) returned 1 [0228.743] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297743\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d48c3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d48c3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d48c3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.744] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d48c3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d48c3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d48c3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.744] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d48c3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d48c3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d48c3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297743\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d48c3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d48c3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d48c3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.744] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d48c3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d48c3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d48c3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.744] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d48c3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d48c3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d48c3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.744] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.744] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297743\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297743\\temporaryfile")) returned 1 [0228.744] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d48c3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d48c3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d48c3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.744] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.744] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297743" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297743")) returned 1 [0228.744] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 1 [0228.745] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.745] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xdd0, lpOverlapped=0x0) returned 1 [0228.746] CloseHandle (hObject=0xe0) returned 1 [0228.746] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.747] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xdfc [0228.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe04) returned 0x25f580 [0228.747] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xdfc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xdfc, lpOverlapped=0x0) returned 1 [0228.748] CloseHandle (hObject=0xe0) returned 1 [0228.748] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0 [0228.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.749] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.749] GetTickCount () returned 0x48b1f [0228.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.750] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297759\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297759\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.750] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297759\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297759\\....\\temporaryfile")) returned 0 [0228.750] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297759\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297759\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297759\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297759\\temporaryfile")) returned 1 [0228.752] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297759\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4b2520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4b2520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4b2520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.752] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4b2520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4b2520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4b2520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.752] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4b2520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4b2520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4b2520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.752] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297759\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4b2520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4b2520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4b2520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.752] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4b2520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4b2520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4b2520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.752] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4b2520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4b2520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4b2520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.752] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.753] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297759\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297759\\temporaryfile")) returned 1 [0228.753] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4b2520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4b2520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4b2520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.753] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.753] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297759" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297759")) returned 1 [0228.753] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 1 [0228.754] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.758] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xe00, lpOverlapped=0x0) returned 1 [0228.759] CloseHandle (hObject=0xe0) returned 1 [0228.760] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.760] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe0b [0228.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe13) returned 0x25f580 [0228.760] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xe0b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xe0b, lpOverlapped=0x0) returned 1 [0228.762] CloseHandle (hObject=0xe0) returned 1 [0228.762] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0 [0228.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.762] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.762] GetTickCount () returned 0x48b2e [0228.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.762] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.763] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\....\\temporaryfile")) returned 0 [0228.763] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\temporaryfile")) returned 1 [0228.764] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.764] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.764] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.764] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.764] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.764] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.764] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.764] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\temporaryfile")) returned 1 [0228.765] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.765] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.765] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774")) returned 1 [0228.765] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 1 [0228.765] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.766] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xe10, lpOverlapped=0x0) returned 1 [0228.766] CloseHandle (hObject=0xe0) returned 1 [0228.767] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.767] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x75d [0228.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x765) returned 0x25f580 [0228.767] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x75d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x75d, lpOverlapped=0x0) returned 1 [0228.769] CloseHandle (hObject=0xe0) returned 1 [0228.769] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0 [0228.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.769] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.769] GetTickCount () returned 0x48b2e [0228.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.769] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.770] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\....\\temporaryfile")) returned 0 [0228.770] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\temporaryfile")) returned 1 [0228.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.771] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.771] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.772] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.772] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.772] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\temporaryfile")) returned 1 [0228.772] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4d8680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4d8680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.772] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774")) returned 1 [0228.772] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 1 [0228.772] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.773] WriteFile (in: hFile=0xe0, lpBuffer=0x25fcf8*, nNumberOfBytesToWrite=0x768, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25fcf8*, lpNumberOfBytesWritten=0x18fdb8*=0x768, lpOverlapped=0x0) returned 1 [0228.774] CloseHandle (hObject=0xe0) returned 1 [0228.774] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.775] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x55f [0228.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x567) returned 0x259e70 [0228.775] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x55f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x55f, lpOverlapped=0x0) returned 1 [0228.776] CloseHandle (hObject=0xe0) returned 1 [0228.776] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0 [0228.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.776] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.777] GetTickCount () returned 0x48b2e [0228.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.777] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.778] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\....\\temporaryfile")) returned 0 [0228.778] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\temporaryfile")) returned 1 [0228.779] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4fe7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4fe7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.779] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4d8680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4fe7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4fe7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.779] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4fe7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4fe7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4fe7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.779] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4fe7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4fe7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4fe7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.779] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4fe7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4fe7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4fe7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.780] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4fe7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4fe7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4fe7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.780] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.780] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774\\temporaryfile")) returned 1 [0228.780] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d4fe7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d4fe7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d4fe7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.780] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.780] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297774" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297774")) returned 1 [0228.780] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned 1 [0228.780] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.781] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x568, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x568, lpOverlapped=0x0) returned 1 [0228.782] CloseHandle (hObject=0xe0) returned 1 [0228.782] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.783] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8df12 [0228.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8df1a) returned 0x1d70020 [0228.783] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x8df12, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0x8df12, lpOverlapped=0x0) returned 1 [0228.796] CloseHandle (hObject=0xe0) returned 1 [0228.796] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0 [0228.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.796] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.796] GetTickCount () returned 0x48b4d [0228.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.797] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297805\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297805\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.797] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297805\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297805\\....\\temporaryfile")) returned 0 [0228.797] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297805\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297805\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297805\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297805\\temporaryfile")) returned 1 [0228.798] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297805\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d524940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d524940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d524940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.799] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d524940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d524940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d524940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.799] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d524940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d524940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d524940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.799] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297805\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d524940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d524940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d524940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.799] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d524940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d524940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d524940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.799] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d524940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d524940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d524940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.799] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.799] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297805\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297805\\temporaryfile")) returned 1 [0228.799] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d524940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d524940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d524940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.799] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.799] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297805" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297805")) returned 1 [0228.799] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 1 [0228.829] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.830] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x8df18, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0x8df18, lpOverlapped=0x0) returned 1 [0228.839] CloseHandle (hObject=0xe0) returned 1 [0228.845] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.845] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2f0 [0228.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc2f8) returned 0x2b4a70 [0228.845] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xc2f0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xc2f0, lpOverlapped=0x0) returned 1 [0228.849] CloseHandle (hObject=0xe0) returned 1 [0228.849] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0 [0228.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.849] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.849] GetTickCount () returned 0x48b7c [0228.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.850] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297852\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297852\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.851] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297852\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297852\\....\\temporaryfile")) returned 0 [0228.851] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297852\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297852\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297852\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297852\\temporaryfile")) returned 1 [0228.852] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297852\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d596d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d596d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d596d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.853] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d596d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d596d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d596d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.853] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d596d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d596d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d596d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.853] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297852\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d596d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d596d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d596d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.853] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d596d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d596d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d596d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.853] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d596d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d596d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d596d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.853] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.853] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297852\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297852\\temporaryfile")) returned 1 [0228.853] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d596d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d596d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d596d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.853] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.853] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297852" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297852")) returned 1 [0228.854] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 1 [0228.855] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.855] WriteFile (in: hFile=0xe0, lpBuffer=0x2c0d78*, nNumberOfBytesToWrite=0xc2f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c0d78*, lpNumberOfBytesWritten=0x18fdb8*=0xc2f8, lpOverlapped=0x0) returned 1 [0228.857] CloseHandle (hObject=0xe0) returned 1 [0228.857] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.858] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb8c4 [0228.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb8cc) returned 0x2b4a70 [0228.858] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xb8c4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xb8c4, lpOverlapped=0x0) returned 1 [0228.860] CloseHandle (hObject=0xe0) returned 1 [0228.860] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0 [0228.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0228.860] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.860] GetTickCount () returned 0x48b8c [0228.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0228.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.861] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868\\...."), lpSecurityAttributes=0x256228) returned 1 [0228.861] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868\\....\\temporaryfile")) returned 0 [0228.861] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868\\temporaryfile")) returned 1 [0228.862] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.862] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.862] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.862] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.862] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.862] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.862] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.863] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868\\temporaryfile")) returned 1 [0228.863] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.863] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.863] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868")) returned 1 [0228.863] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 1 [0228.864] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.864] WriteFile (in: hFile=0xe0, lpBuffer=0x2c0350*, nNumberOfBytesToWrite=0xb8c8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c0350*, lpNumberOfBytesWritten=0x18fdb8*=0xb8c8, lpOverlapped=0x0) returned 1 [0228.866] CloseHandle (hObject=0xe0) returned 1 [0228.866] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.867] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x12d98 [0228.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12da0) returned 0x2b4a70 [0228.867] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x12d98, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x12d98, lpOverlapped=0x0) returned 1 [0228.869] CloseHandle (hObject=0xe0) returned 1 [0228.869] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv")) returned 0 [0228.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.869] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.869] GetTickCount () returned 0x48b8c [0228.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.870] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.870] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868\\....\\temporaryfile")) returned 0 [0228.871] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868\\temporaryfile")) returned 1 [0228.872] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5e3020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5e3020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.872] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5e3020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5e3020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.872] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.872] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.872] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.872] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.872] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.872] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868\\temporaryfile")) returned 1 [0228.872] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5bcec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5bcec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5bcec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.872] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.872] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297868" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297868")) returned 1 [0228.873] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 1 [0228.874] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.874] WriteFile (in: hFile=0xe0, lpBuffer=0x2c7820*, nNumberOfBytesToWrite=0x12da0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c7820*, lpNumberOfBytesWritten=0x18fdb8*=0x12da0, lpOverlapped=0x0) returned 1 [0228.876] CloseHandle (hObject=0xe0) returned 1 [0228.876] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.877] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x14cd8 [0228.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14ce0) returned 0x2b4a70 [0228.877] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x14cd8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x14cd8, lpOverlapped=0x0) returned 1 [0228.878] CloseHandle (hObject=0xe0) returned 1 [0228.878] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv")) returned 0 [0228.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.878] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.879] GetTickCount () returned 0x48b9b [0228.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.879] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297883\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297883\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.880] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297883\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297883\\....\\temporaryfile")) returned 0 [0228.880] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297883\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297883\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297883\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297883\\temporaryfile")) returned 1 [0228.881] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297883\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5e3020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5e3020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5e3020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.881] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5e3020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5e3020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5e3020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.881] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5e3020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5e3020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5e3020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.881] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297883\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5e3020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5e3020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5e3020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.881] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5e3020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5e3020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5e3020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.881] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5e3020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5e3020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5e3020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.881] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.882] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297883\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297883\\temporaryfile")) returned 1 [0228.882] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d5e3020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d5e3020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d5e3020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.882] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.882] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297883" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297883")) returned 1 [0228.882] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 1 [0228.884] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.884] WriteFile (in: hFile=0xe0, lpBuffer=0x2c9760*, nNumberOfBytesToWrite=0x14ce0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c9760*, lpNumberOfBytesWritten=0x18fdb8*=0x14ce0, lpOverlapped=0x0) returned 1 [0228.886] CloseHandle (hObject=0xe0) returned 1 [0228.886] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.887] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x26618 [0228.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26620) returned 0x2b4a70 [0228.887] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x26618, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x26618, lpOverlapped=0x0) returned 1 [0228.888] CloseHandle (hObject=0xe0) returned 1 [0228.889] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv")) returned 0 [0228.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.889] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.889] GetTickCount () returned 0x48bab [0228.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.889] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297899\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297899\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.890] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297899\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297899\\....\\temporaryfile")) returned 0 [0228.890] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297899\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297899\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297899\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297899\\temporaryfile")) returned 1 [0228.891] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297899\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d609180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d609180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d609180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.891] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d609180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d609180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d609180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.891] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d609180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d609180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d609180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.891] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297899\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d609180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d609180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d609180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.891] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d609180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d609180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d609180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.891] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d609180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d609180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d609180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.891] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.891] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297899\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297899\\temporaryfile")) returned 1 [0228.892] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d609180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d609180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d609180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.892] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.892] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297899" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297899")) returned 1 [0228.892] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 1 [0228.894] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.903] WriteFile (in: hFile=0xe0, lpBuffer=0x2db0a0*, nNumberOfBytesToWrite=0x26620, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2db0a0*, lpNumberOfBytesWritten=0x18fdb8*=0x26620, lpOverlapped=0x0) returned 1 [0228.905] CloseHandle (hObject=0xe0) returned 1 [0228.916] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.916] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x28558 [0228.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28560) returned 0x2b4a70 [0228.917] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x28558, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x28558, lpOverlapped=0x0) returned 1 [0228.919] CloseHandle (hObject=0xe0) returned 1 [0228.919] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv")) returned 0 [0228.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.919] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.919] GetTickCount () returned 0x48bca [0228.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.920] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297930\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297930\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.920] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297930\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297930\\....\\temporaryfile")) returned 0 [0228.920] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297930\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297930\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297930\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297930\\temporaryfile")) returned 1 [0228.921] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297930\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d655440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d655440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d655440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.921] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d655440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d655440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d655440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.921] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d655440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d655440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d655440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.921] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297930\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d655440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d655440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d655440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.922] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d655440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d655440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d655440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.922] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d655440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d655440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d655440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.922] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297930\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297930\\temporaryfile")) returned 1 [0228.922] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d655440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d655440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d655440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.922] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297930" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297930")) returned 1 [0228.922] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 1 [0228.925] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.925] WriteFile (in: hFile=0xe0, lpBuffer=0x2dcfe0*, nNumberOfBytesToWrite=0x28560, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2dcfe0*, lpNumberOfBytesWritten=0x18fdb8*=0x28560, lpOverlapped=0x0) returned 1 [0228.928] CloseHandle (hObject=0xe0) returned 1 [0228.928] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.929] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2e31e [0228.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e326) returned 0x2b4a70 [0228.929] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2e31e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2e31e, lpOverlapped=0x0) returned 1 [0228.933] CloseHandle (hObject=0xe0) returned 1 [0228.933] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv")) returned 0 [0228.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.933] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.933] GetTickCount () returned 0x48bda [0228.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.934] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297946\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297946\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.934] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297946\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297946\\....\\temporaryfile")) returned 0 [0228.934] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297946\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297946\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297946\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297946\\temporaryfile")) returned 1 [0228.936] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297946\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d67b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d67b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d67b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.936] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d67b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d67b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d67b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.936] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d67b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d67b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d67b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.936] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297946\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d67b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d67b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d67b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.936] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d67b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d67b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d67b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.936] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d67b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d67b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d67b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.936] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.936] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297946\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297946\\temporaryfile")) returned 1 [0228.936] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d67b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d67b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d67b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.936] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.936] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297946" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297946")) returned 1 [0228.936] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned 1 [0228.939] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.940] WriteFile (in: hFile=0xe0, lpBuffer=0x2e2da8*, nNumberOfBytesToWrite=0x2e328, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2e2da8*, lpNumberOfBytesWritten=0x18fdb8*=0x2e328, lpOverlapped=0x0) returned 1 [0228.944] CloseHandle (hObject=0xe0) returned 1 [0228.944] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.945] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x39e98 [0228.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x39ea0) returned 0x2b4a70 [0228.945] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x39e98, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x39e98, lpOverlapped=0x0) returned 1 [0228.948] CloseHandle (hObject=0xe0) returned 1 [0228.948] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv")) returned 0 [0228.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.948] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.948] GetTickCount () returned 0x48be9 [0228.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.949] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.949] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961\\....\\temporaryfile")) returned 0 [0228.950] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961\\temporaryfile")) returned 1 [0228.951] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6a1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6a1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6a1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.951] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6a1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6a1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6a1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.951] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6a1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6a1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6a1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.951] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6a1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6a1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6a1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.951] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6a1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6a1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6a1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.951] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6a1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6a1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6a1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.951] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.951] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961\\temporaryfile")) returned 1 [0228.951] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6a1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6a1700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6a1700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.951] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.952] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961")) returned 1 [0228.952] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned 1 [0228.955] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.956] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x39ea0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x39ea0, lpOverlapped=0x0) returned 1 [0228.961] CloseHandle (hObject=0xe0) returned 1 [0228.961] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.961] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x609 [0228.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x611) returned 0x259e70 [0228.961] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x609, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x609, lpOverlapped=0x0) returned 1 [0228.963] CloseHandle (hObject=0xe0) returned 1 [0228.963] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0 [0228.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0228.963] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.963] GetTickCount () returned 0x48be9 [0228.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0228.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.964] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961\\...."), lpSecurityAttributes=0x256228) returned 1 [0228.965] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961\\....\\temporaryfile")) returned 0 [0228.965] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961\\temporaryfile")) returned 1 [0228.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6a1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.967] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6a1700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.967] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.967] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.967] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.967] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.967] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961\\temporaryfile")) returned 1 [0228.968] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.968] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.968] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297961" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297961")) returned 1 [0228.968] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 1 [0228.968] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.969] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x610, lpOverlapped=0x0) returned 1 [0228.970] CloseHandle (hObject=0xe0) returned 1 [0228.970] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.971] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x239b [0228.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23a3) returned 0x299460 [0228.971] ReadFile (in: hFile=0xe0, lpBuffer=0x299468, nNumberOfBytesToRead=0x239b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesRead=0x18fdd0*=0x239b, lpOverlapped=0x0) returned 1 [0228.974] CloseHandle (hObject=0xe0) returned 1 [0228.974] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0 [0228.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.975] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.975] GetTickCount () returned 0x48bf9 [0228.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.975] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297977\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297977\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.976] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297977\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297977\\....\\temporaryfile")) returned 0 [0228.976] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297977\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297977\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297977\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297977\\temporaryfile")) returned 1 [0228.977] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297977\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.977] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.977] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.977] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297977\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.977] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.977] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.978] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.978] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297977\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297977\\temporaryfile")) returned 1 [0228.978] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6c7860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6c7860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6c7860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.978] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.978] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297977" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297977")) returned 1 [0228.978] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned 1 [0228.978] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.979] WriteFile (in: hFile=0xe0, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdb8*=0x23a0, lpOverlapped=0x0) returned 1 [0228.980] CloseHandle (hObject=0xe0) returned 1 [0228.980] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.981] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x559 [0228.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x561) returned 0x259e70 [0228.981] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x559, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x559, lpOverlapped=0x0) returned 1 [0228.983] CloseHandle (hObject=0xe0) returned 1 [0228.983] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0 [0228.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0228.983] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.983] GetTickCount () returned 0x48c09 [0228.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0228.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.983] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993\\...."), lpSecurityAttributes=0x256198) returned 1 [0228.984] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993\\....\\temporaryfile")) returned 0 [0228.984] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993\\temporaryfile")) returned 1 [0228.985] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.985] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.985] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.985] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.985] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.985] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.986] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.986] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993\\temporaryfile")) returned 1 [0228.986] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.986] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.986] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993")) returned 1 [0228.986] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 1 [0228.986] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.991] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x560, lpOverlapped=0x0) returned 1 [0228.992] CloseHandle (hObject=0xe0) returned 1 [0228.992] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.993] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x505 [0228.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x50d) returned 0x259e70 [0228.993] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x505, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x505, lpOverlapped=0x0) returned 1 [0228.994] CloseHandle (hObject=0xe0) returned 1 [0228.994] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0 [0228.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0228.994] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0228.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0228.994] GetTickCount () returned 0x48c09 [0228.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0228.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0228.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0228.995] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993\\...."), lpSecurityAttributes=0x256228) returned 1 [0228.996] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993\\....\\temporaryfile")) returned 0 [0228.996] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993\\temporaryfile")) returned 1 [0228.997] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d713b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d713b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0228.997] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d713b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d713b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.997] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0228.997] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0228.997] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.997] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0228.997] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0228.997] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993\\temporaryfile")) returned 1 [0228.998] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d6ed9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d6ed9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d6ed9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0228.998] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0228.998] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18297993" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18297993")) returned 1 [0228.998] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png") returned 1 [0228.998] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0228.999] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x510, lpOverlapped=0x0) returned 1 [0229.000] CloseHandle (hObject=0xe0) returned 1 [0229.000] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.000] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8d713b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d713b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.000] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0229.000] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.000] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f43efc8, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.002] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f43efc8, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0229.002] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x9f43efc8, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0229.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdb0 [0229.002] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.003] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0229.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0229.003] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0229.005] CloseHandle (hObject=0xe0) returned 1 [0229.005] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png")) returned 0 [0229.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.005] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.005] GetTickCount () returned 0x48c18 [0229.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.006] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298008\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298008\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.006] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298008\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298008\\....\\temporaryfile")) returned 0 [0229.006] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298008\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298008\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298008\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298008\\temporaryfile")) returned 1 [0229.007] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298008\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d713b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d713b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d713b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.007] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d713b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d713b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d713b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.007] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d713b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d713b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d713b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.008] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298008\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d713b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d713b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d713b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.008] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d713b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d713b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d713b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.008] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d713b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d713b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d713b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.008] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.008] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298008\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298008\\temporaryfile")) returned 1 [0229.008] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d713b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d713b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d713b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.008] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.008] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298008" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298008")) returned 1 [0229.008] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png") returned 1 [0229.009] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.009] WriteFile (in: hFile=0xe0, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0229.010] CloseHandle (hObject=0xe0) returned 1 [0229.010] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.011] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb04 [0229.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0c) returned 0x25f580 [0229.011] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb04, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb04, lpOverlapped=0x0) returned 1 [0229.013] CloseHandle (hObject=0xe0) returned 1 [0229.013] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png")) returned 0 [0229.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.013] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.013] GetTickCount () returned 0x48c28 [0229.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.014] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.014] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024\\....\\temporaryfile")) returned 0 [0229.014] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024\\temporaryfile")) returned 1 [0229.015] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.015] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.015] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.015] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.016] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.016] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.016] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.016] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024\\temporaryfile")) returned 1 [0229.016] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.016] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.016] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024")) returned 1 [0229.016] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 1 [0229.016] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.017] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb08, lpOverlapped=0x0) returned 1 [0229.018] CloseHandle (hObject=0xe0) returned 1 [0229.018] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.018] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0229.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0229.018] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0229.020] CloseHandle (hObject=0xe0) returned 1 [0229.020] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png")) returned 0 [0229.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.020] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.020] GetTickCount () returned 0x48c28 [0229.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.021] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.021] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024\\....\\temporaryfile")) returned 0 [0229.022] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024\\temporaryfile")) returned 1 [0229.023] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.023] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.023] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.023] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.023] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.023] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.023] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024\\temporaryfile")) returned 1 [0229.023] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d739c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d739c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d739c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.023] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298024" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298024")) returned 1 [0229.024] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 1 [0229.024] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.024] WriteFile (in: hFile=0xe0, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0229.025] CloseHandle (hObject=0xe0) returned 1 [0229.026] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.026] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0229.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0229.026] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0229.027] CloseHandle (hObject=0xe0) returned 1 [0229.028] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png")) returned 0 [0229.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.028] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.028] GetTickCount () returned 0x48c37 [0229.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.028] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.029] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039\\....\\temporaryfile")) returned 0 [0229.029] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039\\temporaryfile")) returned 1 [0229.030] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.030] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.030] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.030] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.030] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.030] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.030] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.030] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039\\temporaryfile")) returned 1 [0229.031] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.031] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.031] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039")) returned 1 [0229.031] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 1 [0229.031] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.032] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0229.032] CloseHandle (hObject=0xe0) returned 1 [0229.033] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.033] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0229.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0229.033] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0229.035] CloseHandle (hObject=0xe0) returned 1 [0229.035] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png")) returned 0 [0229.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.035] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.035] GetTickCount () returned 0x48c37 [0229.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.036] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.036] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039\\....\\temporaryfile")) returned 0 [0229.036] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039\\temporaryfile")) returned 1 [0229.037] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.037] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.037] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.038] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.038] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.038] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.038] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039\\temporaryfile")) returned 1 [0229.038] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d75fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d75fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d75fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.038] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298039" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298039")) returned 1 [0229.038] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 1 [0229.039] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.039] WriteFile (in: hFile=0xe0, lpBuffer=0x299468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x299468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0229.040] CloseHandle (hObject=0xe0) returned 1 [0229.040] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.041] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0229.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0229.041] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0229.043] CloseHandle (hObject=0xe0) returned 1 [0229.043] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png")) returned 0 [0229.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.043] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.043] GetTickCount () returned 0x48c47 [0229.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.044] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.044] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055\\....\\temporaryfile")) returned 0 [0229.044] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055\\temporaryfile")) returned 1 [0229.045] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.046] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.046] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.046] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.046] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.046] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.046] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055\\temporaryfile")) returned 1 [0229.046] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.046] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.046] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055")) returned 1 [0229.046] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 1 [0229.047] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.047] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0229.048] CloseHandle (hObject=0xe0) returned 1 [0229.048] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.049] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0229.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0229.049] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0229.050] CloseHandle (hObject=0xe0) returned 1 [0229.050] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png")) returned 0 [0229.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.050] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.051] GetTickCount () returned 0x48c47 [0229.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.051] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.052] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055\\....\\temporaryfile")) returned 0 [0229.052] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055\\temporaryfile")) returned 1 [0229.053] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.053] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.053] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.053] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.053] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.053] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.053] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.053] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055\\temporaryfile")) returned 1 [0229.054] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d785f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d785f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d785f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.054] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.054] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298055" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298055")) returned 1 [0229.054] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 1 [0229.054] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.055] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0229.056] CloseHandle (hObject=0xe0) returned 1 [0229.056] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.056] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0229.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0229.056] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0229.058] CloseHandle (hObject=0xe0) returned 1 [0229.058] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png")) returned 0 [0229.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.058] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.058] GetTickCount () returned 0x48c57 [0229.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.059] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.059] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071\\....\\temporaryfile")) returned 0 [0229.059] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071\\temporaryfile")) returned 1 [0229.060] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.060] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.060] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.060] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.060] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.061] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.061] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.061] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071\\temporaryfile")) returned 1 [0229.061] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.061] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.061] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071")) returned 1 [0229.061] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png") returned 1 [0229.061] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.062] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0229.063] CloseHandle (hObject=0xe0) returned 1 [0229.063] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.063] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5fc8 [0229.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5fd0) returned 0x2b4a70 [0229.063] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5fc8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x5fc8, lpOverlapped=0x0) returned 1 [0229.065] CloseHandle (hObject=0xe0) returned 1 [0229.065] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png")) returned 0 [0229.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.065] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.065] GetTickCount () returned 0x48c57 [0229.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0229.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.066] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.066] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071\\....\\temporaryfile")) returned 0 [0229.067] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071\\temporaryfile")) returned 1 [0229.068] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.068] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.068] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.068] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.068] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.068] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.068] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.068] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071\\temporaryfile")) returned 1 [0229.068] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7ac0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.068] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.068] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298071" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298071")) returned 1 [0229.068] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png") returned 1 [0229.069] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.070] WriteFile (in: hFile=0xe0, lpBuffer=0x2baa50*, nNumberOfBytesToWrite=0x5fd0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2baa50*, lpNumberOfBytesWritten=0x18fdb8*=0x5fd0, lpOverlapped=0x0) returned 1 [0229.071] CloseHandle (hObject=0xe0) returned 1 [0229.071] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.071] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8d7ac0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7ac0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0229.071] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.071] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1a3fc59, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.073] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1a3fc59, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0229.073] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa1a3fc59, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0229.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdf0 [0229.073] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.074] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0229.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0229.074] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0229.076] CloseHandle (hObject=0xe0) returned 1 [0229.076] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png")) returned 0 [0229.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.076] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.076] GetTickCount () returned 0x48c66 [0229.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.077] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.078] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086\\....\\temporaryfile")) returned 0 [0229.078] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086\\temporaryfile")) returned 1 [0229.080] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.080] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.080] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.080] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.080] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086\\temporaryfile")) returned 1 [0229.081] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.081] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.081] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086")) returned 1 [0229.081] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png") returned 1 [0229.081] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.082] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0229.083] CloseHandle (hObject=0xe0) returned 1 [0229.083] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.084] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb05 [0229.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0d) returned 0x25f580 [0229.084] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb05, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb05, lpOverlapped=0x0) returned 1 [0229.086] CloseHandle (hObject=0xe0) returned 1 [0229.086] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png")) returned 0 [0229.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.086] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.086] GetTickCount () returned 0x48c66 [0229.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.087] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.087] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086\\....\\temporaryfile")) returned 0 [0229.087] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086\\temporaryfile")) returned 1 [0229.089] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.089] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.089] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.089] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.089] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.089] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.089] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.089] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086\\temporaryfile")) returned 1 [0229.089] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7d2200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7d2200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7d2200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.089] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.089] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298086" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298086")) returned 1 [0229.090] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 1 [0229.090] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.090] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb10, lpOverlapped=0x0) returned 1 [0229.091] CloseHandle (hObject=0xe0) returned 1 [0229.091] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.092] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11d3 [0229.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11db) returned 0x25b528 [0229.093] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11d3, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11d3, lpOverlapped=0x0) returned 1 [0229.094] CloseHandle (hObject=0xe0) returned 1 [0229.094] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png")) returned 0 [0229.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.094] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.094] GetTickCount () returned 0x48c76 [0229.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.095] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.095] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102\\....\\temporaryfile")) returned 0 [0229.095] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102\\temporaryfile")) returned 1 [0229.096] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7f8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7f8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7f8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.097] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7f8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7f8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7f8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.097] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7f8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7f8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7f8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.097] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7f8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7f8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7f8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.097] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7f8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7f8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7f8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.097] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7f8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7f8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7f8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.097] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.097] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102\\temporaryfile")) returned 1 [0229.097] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d7f8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d7f8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d7f8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.097] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.097] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102")) returned 1 [0229.097] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 1 [0229.098] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.098] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11d8, lpOverlapped=0x0) returned 1 [0229.099] CloseHandle (hObject=0xe0) returned 1 [0229.099] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.100] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x123d [0229.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1245) returned 0x25b528 [0229.100] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x123d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x123d, lpOverlapped=0x0) returned 1 [0229.104] CloseHandle (hObject=0xe0) returned 1 [0229.104] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png")) returned 0 [0229.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.104] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.104] GetTickCount () returned 0x48c76 [0229.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.106] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.106] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102\\....\\temporaryfile")) returned 0 [0229.106] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102\\temporaryfile")) returned 1 [0229.107] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.108] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.108] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.108] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.108] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.108] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.108] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.108] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102\\temporaryfile")) returned 1 [0229.108] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.108] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.108] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298102" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298102")) returned 1 [0229.108] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 1 [0229.109] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.109] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1248, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1248, lpOverlapped=0x0) returned 1 [0229.110] CloseHandle (hObject=0xe0) returned 1 [0229.110] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.111] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6794 [0229.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x679c) returned 0x2b4a70 [0229.112] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6794, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x6794, lpOverlapped=0x0) returned 1 [0229.113] CloseHandle (hObject=0xe0) returned 1 [0229.113] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png")) returned 0 [0229.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.113] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.113] GetTickCount () returned 0x48c85 [0229.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.115] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298117\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298117\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.116] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298117\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298117\\....\\temporaryfile")) returned 0 [0229.116] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298117\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298117\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298117\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298117\\temporaryfile")) returned 1 [0229.117] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298117\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.117] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.118] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.118] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298117\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.118] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.118] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.118] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.118] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298117\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298117\\temporaryfile")) returned 1 [0229.118] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d81e4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d81e4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d81e4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.118] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.118] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298117" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298117")) returned 1 [0229.119] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 1 [0229.119] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.120] WriteFile (in: hFile=0xe0, lpBuffer=0x2bb220*, nNumberOfBytesToWrite=0x6798, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bb220*, lpNumberOfBytesWritten=0x18fdb8*=0x6798, lpOverlapped=0x0) returned 1 [0229.121] CloseHandle (hObject=0xe0) returned 1 [0229.122] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.123] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0229.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0229.123] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0229.168] CloseHandle (hObject=0xe0) returned 1 [0229.168] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png")) returned 0 [0229.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.168] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.169] GetTickCount () returned 0x48cc4 [0229.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.169] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.173] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180\\....\\temporaryfile")) returned 0 [0229.173] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180\\temporaryfile")) returned 1 [0229.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.174] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.174] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.175] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.175] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.175] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.175] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180\\temporaryfile")) returned 1 [0229.175] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.175] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.175] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180")) returned 1 [0229.175] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 1 [0229.176] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.176] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0229.177] CloseHandle (hObject=0xe0) returned 1 [0229.177] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.178] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0229.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0229.178] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0229.180] CloseHandle (hObject=0xe0) returned 1 [0229.180] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png")) returned 0 [0229.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.180] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.180] GetTickCount () returned 0x48cc4 [0229.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.180] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.181] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180\\....\\temporaryfile")) returned 0 [0229.181] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180\\temporaryfile")) returned 1 [0229.182] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.183] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.183] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.183] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.183] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180\\temporaryfile")) returned 1 [0229.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8b6a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8b6a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8b6a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.183] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.183] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298180" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298180")) returned 1 [0229.183] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 1 [0229.184] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.184] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0229.185] CloseHandle (hObject=0xe0) returned 1 [0229.185] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.186] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0229.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0229.186] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0229.188] CloseHandle (hObject=0xe0) returned 1 [0229.188] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png")) returned 0 [0229.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.188] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.188] GetTickCount () returned 0x48cd3 [0229.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.189] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.189] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195\\....\\temporaryfile")) returned 0 [0229.189] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195\\temporaryfile")) returned 1 [0229.190] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.190] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.191] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.191] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.191] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.191] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.191] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.191] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195\\temporaryfile")) returned 1 [0229.191] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.191] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.191] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195")) returned 1 [0229.191] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 1 [0229.192] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.192] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0229.193] CloseHandle (hObject=0xe0) returned 1 [0229.193] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.194] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0229.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0229.194] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0229.196] CloseHandle (hObject=0xe0) returned 1 [0229.196] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0 [0229.196] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.196] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.196] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.196] GetTickCount () returned 0x48cd3 [0229.196] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.196] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.197] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.197] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195\\....\\temporaryfile")) returned 0 [0229.197] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195\\temporaryfile")) returned 1 [0229.199] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.199] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.199] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.199] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.199] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.199] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.199] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.199] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195\\temporaryfile")) returned 1 [0229.199] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d8dcba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d8dcba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d8dcba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.199] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.199] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298195" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298195")) returned 1 [0229.200] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 1 [0229.200] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.200] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0229.201] CloseHandle (hObject=0xe0) returned 1 [0229.201] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.202] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0229.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0229.203] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0229.204] CloseHandle (hObject=0xe0) returned 1 [0229.204] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0 [0229.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.204] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.204] GetTickCount () returned 0x48ce3 [0229.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.205] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.205] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211\\....\\temporaryfile")) returned 0 [0229.205] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211\\temporaryfile")) returned 1 [0229.207] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.207] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.207] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.207] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.207] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.207] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.207] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.207] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211\\temporaryfile")) returned 1 [0229.207] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.207] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.207] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211")) returned 1 [0229.208] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 1 [0229.208] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.209] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0229.210] CloseHandle (hObject=0xe0) returned 1 [0229.210] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.211] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0229.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0229.211] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0229.213] CloseHandle (hObject=0xe0) returned 1 [0229.213] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png")) returned 0 [0229.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.213] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.213] GetTickCount () returned 0x48ce3 [0229.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.213] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.214] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211\\....\\temporaryfile")) returned 0 [0229.214] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211\\temporaryfile")) returned 1 [0229.215] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d928e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d928e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.216] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d928e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d928e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.216] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.216] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.216] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.216] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.216] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.216] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211\\temporaryfile")) returned 1 [0229.216] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d902d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d902d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d902d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.216] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.216] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298211" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298211")) returned 1 [0229.216] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 1 [0229.217] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.217] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0229.218] CloseHandle (hObject=0xe0) returned 1 [0229.218] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.219] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb92 [0229.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb9a) returned 0x25f580 [0229.219] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb92, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb92, lpOverlapped=0x0) returned 1 [0229.220] CloseHandle (hObject=0xe0) returned 1 [0229.220] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png")) returned 0 [0229.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.220] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.220] GetTickCount () returned 0x48cf3 [0229.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.221] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298227\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298227\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.222] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298227\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298227\\....\\temporaryfile")) returned 0 [0229.222] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298227\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298227\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298227\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298227\\temporaryfile")) returned 1 [0229.223] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298227\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d928e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d928e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d928e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.223] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d928e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d928e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d928e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.223] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d928e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d928e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d928e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.223] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298227\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d928e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d928e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d928e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.223] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d928e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d928e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d928e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.223] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d928e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d928e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d928e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.223] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.224] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298227\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298227\\temporaryfile")) returned 1 [0229.224] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d928e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d928e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d928e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.224] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.224] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298227" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298227")) returned 1 [0229.224] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 1 [0229.224] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.225] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb98, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb98, lpOverlapped=0x0) returned 1 [0229.226] CloseHandle (hObject=0xe0) returned 1 [0229.226] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.226] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8d928e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d928e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0229.226] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.226] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0fd11ff, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.228] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0fd11ff, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0229.228] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa0fd11ff, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0229.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdb0 [0229.229] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.229] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0229.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0229.229] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0229.231] CloseHandle (hObject=0xe0) returned 1 [0229.231] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png")) returned 0 [0229.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.231] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.231] GetTickCount () returned 0x48d02 [0229.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.231] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.232] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242\\....\\temporaryfile")) returned 0 [0229.232] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242\\temporaryfile")) returned 1 [0229.233] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.233] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.233] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.233] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.233] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.233] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.233] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.234] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242\\temporaryfile")) returned 1 [0229.234] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.234] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.234] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242")) returned 1 [0229.234] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 1 [0229.234] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.235] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0229.236] CloseHandle (hObject=0xe0) returned 1 [0229.236] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.237] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb05 [0229.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0d) returned 0x25f580 [0229.237] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb05, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb05, lpOverlapped=0x0) returned 1 [0229.238] CloseHandle (hObject=0xe0) returned 1 [0229.238] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png")) returned 0 [0229.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.238] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.239] GetTickCount () returned 0x48d02 [0229.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0229.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.239] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.240] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242\\....\\temporaryfile")) returned 0 [0229.240] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242\\temporaryfile")) returned 1 [0229.241] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.241] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.241] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.241] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.241] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.241] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.241] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.242] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242\\temporaryfile")) returned 1 [0229.242] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d94efc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d94efc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d94efc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.242] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.242] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298242" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298242")) returned 1 [0229.242] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 1 [0229.242] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.243] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb10, lpOverlapped=0x0) returned 1 [0229.244] CloseHandle (hObject=0xe0) returned 1 [0229.244] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.244] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x43e2 [0229.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x43ea) returned 0x2b4a70 [0229.244] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x43e2, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x43e2, lpOverlapped=0x0) returned 1 [0229.246] CloseHandle (hObject=0xe0) returned 1 [0229.246] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png")) returned 0 [0229.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.246] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.246] GetTickCount () returned 0x48d12 [0229.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0229.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.247] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.247] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258\\....\\temporaryfile")) returned 0 [0229.247] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258\\temporaryfile")) returned 1 [0229.248] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.249] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.249] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.249] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.249] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258\\temporaryfile")) returned 1 [0229.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.249] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258")) returned 1 [0229.249] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 1 [0229.250] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.250] WriteFile (in: hFile=0xe0, lpBuffer=0x2b8e70*, nNumberOfBytesToWrite=0x43e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b8e70*, lpNumberOfBytesWritten=0x18fdb8*=0x43e8, lpOverlapped=0x0) returned 1 [0229.252] CloseHandle (hObject=0xe0) returned 1 [0229.252] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.252] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb57 [0229.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb5f) returned 0x25f580 [0229.252] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb57, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb57, lpOverlapped=0x0) returned 1 [0229.254] CloseHandle (hObject=0xe0) returned 1 [0229.254] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png")) returned 0 [0229.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.254] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.254] GetTickCount () returned 0x48d12 [0229.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.255] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.255] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258\\....\\temporaryfile")) returned 0 [0229.255] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258\\temporaryfile")) returned 1 [0229.257] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.257] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.257] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.257] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.257] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.257] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.257] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.257] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258\\temporaryfile")) returned 1 [0229.257] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d975120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d975120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d975120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.257] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.257] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298258" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298258")) returned 1 [0229.257] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 1 [0229.258] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.258] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb60, lpOverlapped=0x0) returned 1 [0229.259] CloseHandle (hObject=0xe0) returned 1 [0229.259] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.260] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0229.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0229.260] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0229.261] CloseHandle (hObject=0xe0) returned 1 [0229.261] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0 [0229.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.262] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.262] GetTickCount () returned 0x48d21 [0229.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.262] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.263] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273\\....\\temporaryfile")) returned 0 [0229.263] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273\\temporaryfile")) returned 1 [0229.264] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.264] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.264] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.264] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.264] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.264] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.264] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.264] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273\\temporaryfile")) returned 1 [0229.265] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.265] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.265] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273")) returned 1 [0229.265] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 1 [0229.265] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.266] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0229.267] CloseHandle (hObject=0xe0) returned 1 [0229.267] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.267] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0229.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0229.267] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0229.269] CloseHandle (hObject=0xe0) returned 1 [0229.269] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0 [0229.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.269] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.269] GetTickCount () returned 0x48d21 [0229.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.269] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.270] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273\\....\\temporaryfile")) returned 0 [0229.270] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273\\temporaryfile")) returned 1 [0229.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.271] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.271] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.272] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.272] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.272] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.272] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273\\temporaryfile")) returned 1 [0229.272] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d99b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d99b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d99b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.272] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298273" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298273")) returned 1 [0229.272] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png") returned 1 [0229.273] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.273] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0229.274] CloseHandle (hObject=0xe0) returned 1 [0229.274] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.275] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0229.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0229.275] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0229.276] CloseHandle (hObject=0xe0) returned 1 [0229.276] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0 [0229.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.276] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.276] GetTickCount () returned 0x48d31 [0229.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.277] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.277] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\....\\temporaryfile")) returned 0 [0229.277] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\temporaryfile")) returned 1 [0229.279] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.279] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.279] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.279] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.279] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.279] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.279] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.279] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\temporaryfile")) returned 1 [0229.279] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.279] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.279] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289")) returned 1 [0229.279] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png") returned 1 [0229.280] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.280] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0229.282] CloseHandle (hObject=0xe0) returned 1 [0229.282] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.282] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0229.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0229.282] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0229.284] CloseHandle (hObject=0xe0) returned 1 [0229.284] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png")) returned 0 [0229.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.284] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.284] GetTickCount () returned 0x48d31 [0229.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.284] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.285] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\....\\temporaryfile")) returned 0 [0229.285] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\temporaryfile")) returned 1 [0229.286] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.286] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.286] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.287] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.287] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.287] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.287] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.287] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\temporaryfile")) returned 1 [0229.287] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9c13e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9c13e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.287] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.287] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289")) returned 1 [0229.287] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png") returned 1 [0229.288] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.288] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0229.289] CloseHandle (hObject=0xe0) returned 1 [0229.289] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.290] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0229.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0229.290] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0229.291] CloseHandle (hObject=0xe0) returned 1 [0229.291] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0 [0229.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.291] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.291] GetTickCount () returned 0x48d31 [0229.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.292] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.292] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\....\\temporaryfile")) returned 0 [0229.293] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\temporaryfile")) returned 1 [0229.297] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.297] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9c13e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.297] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.297] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.297] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.297] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.297] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.297] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289\\temporaryfile")) returned 1 [0229.298] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.298] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.298] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298289" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298289")) returned 1 [0229.298] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png") returned 1 [0229.298] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.299] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0229.300] CloseHandle (hObject=0xe0) returned 1 [0229.300] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.300] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0229.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0229.300] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0229.302] CloseHandle (hObject=0xe0) returned 1 [0229.302] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0 [0229.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.302] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.302] GetTickCount () returned 0x48d41 [0229.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.303] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298305\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298305\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.303] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298305\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298305\\....\\temporaryfile")) returned 0 [0229.303] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298305\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298305\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298305\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298305\\temporaryfile")) returned 1 [0229.304] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298305\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.305] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.305] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.305] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298305\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.305] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.305] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.305] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.305] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298305\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298305\\temporaryfile")) returned 1 [0229.305] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d9e7540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8d9e7540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8d9e7540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.305] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.305] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298305" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298305")) returned 1 [0229.305] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png") returned 1 [0229.306] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.307] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0229.308] CloseHandle (hObject=0xe0) returned 1 [0229.308] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.309] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xf2f [0229.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf37) returned 0x25f580 [0229.309] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xf2f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xf2f, lpOverlapped=0x0) returned 1 [0229.310] CloseHandle (hObject=0xe0) returned 1 [0229.310] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0 [0229.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.310] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.311] GetTickCount () returned 0x48d50 [0229.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.311] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.312] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320\\....\\temporaryfile")) returned 0 [0229.312] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320\\temporaryfile")) returned 1 [0229.313] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da0d6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da0d6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da0d6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.313] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da0d6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da0d6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da0d6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.313] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da0d6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da0d6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da0d6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.313] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da0d6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da0d6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da0d6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.313] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da0d6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da0d6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da0d6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.313] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da0d6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da0d6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da0d6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.313] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.313] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320\\temporaryfile")) returned 1 [0229.314] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da0d6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da0d6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da0d6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.314] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.314] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320")) returned 1 [0229.314] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png") returned 1 [0229.314] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.315] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xf38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xf38, lpOverlapped=0x0) returned 1 [0229.316] CloseHandle (hObject=0xe0) returned 1 [0229.316] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.316] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8da0d6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da0d6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0229.316] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.316] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa19a729d, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0229.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa19a729d, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0229.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa19a729d, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0229.318] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdb0 [0229.318] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.319] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0229.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0229.319] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0229.320] CloseHandle (hObject=0xe0) returned 1 [0229.320] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0 [0229.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.321] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.321] GetTickCount () returned 0x48d50 [0229.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.321] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.326] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320\\....\\temporaryfile")) returned 0 [0229.326] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320\\temporaryfile")) returned 1 [0229.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da0d6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.327] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da0d6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0229.327] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.327] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.328] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320\\temporaryfile")) returned 1 [0229.328] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.328] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.328] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298320" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298320")) returned 1 [0229.328] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png") returned 1 [0229.328] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.329] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0229.330] CloseHandle (hObject=0xe0) returned 1 [0229.330] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.331] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb04 [0229.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0c) returned 0x25f580 [0229.331] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb04, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb04, lpOverlapped=0x0) returned 1 [0229.332] CloseHandle (hObject=0xe0) returned 1 [0229.332] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png")) returned 0 [0229.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.332] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.332] GetTickCount () returned 0x48d60 [0229.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0229.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.333] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298336\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298336\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.334] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298336\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298336\\....\\temporaryfile")) returned 0 [0229.334] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298336\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298336\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298336\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298336\\temporaryfile")) returned 1 [0229.335] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298336\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.335] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.335] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.335] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298336\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.335] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.335] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.335] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298336\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298336\\temporaryfile")) returned 1 [0229.336] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da33800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da33800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da33800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.336] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298336" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298336")) returned 1 [0229.336] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 1 [0229.336] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.337] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb08, lpOverlapped=0x0) returned 1 [0229.338] CloseHandle (hObject=0xe0) returned 1 [0229.338] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.338] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x191f [0229.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1927) returned 0x2b4a70 [0229.338] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x191f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x191f, lpOverlapped=0x0) returned 1 [0229.340] CloseHandle (hObject=0xe0) returned 1 [0229.340] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png")) returned 0 [0229.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.340] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.340] GetTickCount () returned 0x48d6f [0229.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0229.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.341] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.341] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351\\....\\temporaryfile")) returned 0 [0229.342] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351\\temporaryfile")) returned 1 [0229.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.343] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.343] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.343] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.343] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.343] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.343] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351\\temporaryfile")) returned 1 [0229.343] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.343] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.343] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351")) returned 1 [0229.344] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 1 [0229.344] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.344] WriteFile (in: hFile=0xe0, lpBuffer=0x2b63a8*, nNumberOfBytesToWrite=0x1928, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b63a8*, lpNumberOfBytesWritten=0x18fdb8*=0x1928, lpOverlapped=0x0) returned 1 [0229.345] CloseHandle (hObject=0xe0) returned 1 [0229.345] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.346] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5fed [0229.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5ff5) returned 0x2b4a70 [0229.346] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5fed, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x5fed, lpOverlapped=0x0) returned 1 [0229.348] CloseHandle (hObject=0xe0) returned 1 [0229.348] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png")) returned 0 [0229.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.348] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.348] GetTickCount () returned 0x48d6f [0229.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0229.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.348] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.349] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351\\....\\temporaryfile")) returned 0 [0229.349] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351\\temporaryfile")) returned 1 [0229.350] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.350] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.350] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.350] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.351] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.351] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.351] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.351] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351\\temporaryfile")) returned 1 [0229.351] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da59960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da59960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da59960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.351] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.351] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298351" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298351")) returned 1 [0229.351] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 1 [0229.352] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.352] WriteFile (in: hFile=0xe0, lpBuffer=0x2baa78*, nNumberOfBytesToWrite=0x5ff8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2baa78*, lpNumberOfBytesWritten=0x18fdb8*=0x5ff8, lpOverlapped=0x0) returned 1 [0229.353] CloseHandle (hObject=0xe0) returned 1 [0229.354] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.355] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0229.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0229.355] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0229.356] CloseHandle (hObject=0xe0) returned 1 [0229.356] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png")) returned 0 [0229.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.357] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.357] GetTickCount () returned 0x48d7f [0229.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.357] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.357] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367\\....\\temporaryfile")) returned 0 [0229.358] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367\\temporaryfile")) returned 1 [0229.359] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.359] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.359] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.359] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.359] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.359] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.359] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.359] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367\\temporaryfile")) returned 1 [0229.359] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.360] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.360] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367")) returned 1 [0229.360] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 1 [0229.360] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.361] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0229.361] CloseHandle (hObject=0xe0) returned 1 [0229.362] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.364] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0229.364] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0229.364] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0229.365] CloseHandle (hObject=0xe0) returned 1 [0229.365] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png")) returned 0 [0229.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.365] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.365] GetTickCount () returned 0x48d7f [0229.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.366] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.367] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367\\....\\temporaryfile")) returned 0 [0229.367] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367\\temporaryfile")) returned 1 [0229.368] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.368] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.368] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.368] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.368] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.368] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.368] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.368] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367\\temporaryfile")) returned 1 [0229.369] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8da7fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8da7fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8da7fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.369] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.369] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298367" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298367")) returned 1 [0229.369] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 1 [0229.369] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.370] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0229.371] CloseHandle (hObject=0xe0) returned 1 [0229.371] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.372] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0229.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0229.372] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0229.373] CloseHandle (hObject=0xe0) returned 1 [0229.373] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png")) returned 0 [0229.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.373] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.373] GetTickCount () returned 0x48d8f [0229.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.374] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.374] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383\\....\\temporaryfile")) returned 0 [0229.375] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383\\temporaryfile")) returned 1 [0229.376] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.376] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.376] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.376] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.376] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.376] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.376] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.376] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383\\temporaryfile")) returned 1 [0229.377] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.377] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.377] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383")) returned 1 [0229.377] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 1 [0229.377] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.378] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0229.379] CloseHandle (hObject=0xe0) returned 1 [0229.379] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.380] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0229.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0229.380] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0229.381] CloseHandle (hObject=0xe0) returned 1 [0229.381] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png")) returned 0 [0229.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.381] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.381] GetTickCount () returned 0x48d8f [0229.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.382] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.383] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383\\....\\temporaryfile")) returned 0 [0229.383] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383\\temporaryfile")) returned 1 [0229.384] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.384] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.384] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.384] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.384] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.385] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.385] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.385] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383\\temporaryfile")) returned 1 [0229.385] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daa5c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daa5c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daa5c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.385] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.385] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298383" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298383")) returned 1 [0229.385] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 1 [0229.385] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.386] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0229.387] CloseHandle (hObject=0xe0) returned 1 [0229.387] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.388] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0229.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0229.388] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0229.389] CloseHandle (hObject=0xe0) returned 1 [0229.390] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png")) returned 0 [0229.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.390] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.390] GetTickCount () returned 0x48d9e [0229.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.390] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.390] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.391] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398\\....\\temporaryfile")) returned 0 [0229.391] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398\\temporaryfile")) returned 1 [0229.392] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.392] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.392] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.392] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.392] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.392] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.392] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.393] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398\\temporaryfile")) returned 1 [0229.393] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.393] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.393] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398")) returned 1 [0229.393] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 1 [0229.393] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.394] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0229.395] CloseHandle (hObject=0xe0) returned 1 [0229.395] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.396] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0229.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0229.396] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0229.397] CloseHandle (hObject=0xe0) returned 1 [0229.397] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png")) returned 0 [0229.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.397] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.398] GetTickCount () returned 0x48d9e [0229.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.398] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.399] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398\\....\\temporaryfile")) returned 0 [0229.399] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398\\temporaryfile")) returned 1 [0229.400] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.400] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.400] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.400] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.400] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.400] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.400] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.401] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398\\temporaryfile")) returned 1 [0229.401] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dacbd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dacbd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dacbd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.401] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.401] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298398" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298398")) returned 1 [0229.401] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 1 [0229.401] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.406] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0229.407] CloseHandle (hObject=0xe0) returned 1 [0229.407] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0229.407] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8daf1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daf1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0229.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0229.407] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0229.408] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9fbd8be5, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.409] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9fbd8be5, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0229.409] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x9fbd8be5, dwReserved1=0x1cbf8eb, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0229.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x255c98 [0229.409] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.410] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb08f [0229.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb097) returned 0x2b4a70 [0229.410] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xb08f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xb08f, lpOverlapped=0x0) returned 1 [0229.412] CloseHandle (hObject=0xe0) returned 1 [0229.412] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png")) returned 0 [0229.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.412] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.412] GetTickCount () returned 0x48dae [0229.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.413] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298414\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298414\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.413] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298414\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298414\\....\\temporaryfile")) returned 0 [0229.413] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298414\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298414\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298414\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298414\\temporaryfile")) returned 1 [0229.414] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298414\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daf1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daf1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daf1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.414] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daf1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daf1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daf1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0229.414] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daf1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daf1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daf1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.414] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298414\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daf1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daf1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daf1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.415] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daf1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daf1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daf1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.415] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daf1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daf1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daf1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.415] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298414\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298414\\temporaryfile")) returned 1 [0229.415] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8daf1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8daf1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8daf1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.415] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298414" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298414")) returned 1 [0229.415] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png") returned 1 [0229.416] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.417] WriteFile (in: hFile=0xe0, lpBuffer=0x2bfb18*, nNumberOfBytesToWrite=0xb098, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bfb18*, lpNumberOfBytesWritten=0x18fdb8*=0xb098, lpOverlapped=0x0) returned 1 [0229.418] CloseHandle (hObject=0xe0) returned 1 [0229.418] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.419] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc32 [0229.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc3a) returned 0x25f580 [0229.419] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc32, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc32, lpOverlapped=0x0) returned 1 [0229.420] CloseHandle (hObject=0xe0) returned 1 [0229.420] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png")) returned 0 [0229.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.420] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.420] GetTickCount () returned 0x48dbd [0229.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.421] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.421] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429\\....\\temporaryfile")) returned 0 [0229.422] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429\\temporaryfile")) returned 1 [0229.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.423] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.423] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.423] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429\\temporaryfile")) returned 1 [0229.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.423] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429")) returned 1 [0229.424] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 1 [0229.424] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.424] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0229.425] CloseHandle (hObject=0xe0) returned 1 [0229.425] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.426] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x578 [0229.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x580) returned 0x259e70 [0229.426] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x578, lpOverlapped=0x0) returned 1 [0229.429] CloseHandle (hObject=0xe0) returned 1 [0229.429] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png")) returned 0 [0229.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.429] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.429] GetTickCount () returned 0x48dbd [0229.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.430] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.430] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429\\....\\temporaryfile")) returned 0 [0229.430] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429\\temporaryfile")) returned 1 [0229.431] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.431] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.431] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.432] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.432] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.432] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.432] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.432] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429\\temporaryfile")) returned 1 [0229.432] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db18040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db18040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db18040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.432] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.432] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298429" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298429")) returned 1 [0229.432] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png") returned 1 [0229.433] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.433] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x580, lpOverlapped=0x0) returned 1 [0229.434] CloseHandle (hObject=0xe0) returned 1 [0229.434] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.435] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8c12 [0229.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8c1a) returned 0x2b4a70 [0229.435] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x8c12, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x8c12, lpOverlapped=0x0) returned 1 [0229.436] CloseHandle (hObject=0xe0) returned 1 [0229.436] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png")) returned 0 [0229.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.437] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.437] GetTickCount () returned 0x48dcd [0229.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.437] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.438] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445\\....\\temporaryfile")) returned 0 [0229.438] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445\\temporaryfile")) returned 1 [0229.439] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.439] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.439] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.439] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.439] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.439] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.439] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.439] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445\\temporaryfile")) returned 1 [0229.440] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.440] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.440] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445")) returned 1 [0229.440] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png") returned 1 [0229.441] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.441] WriteFile (in: hFile=0xe0, lpBuffer=0x2bd6a0*, nNumberOfBytesToWrite=0x8c18, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bd6a0*, lpNumberOfBytesWritten=0x18fdb8*=0x8c18, lpOverlapped=0x0) returned 1 [0229.442] CloseHandle (hObject=0xe0) returned 1 [0229.443] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.444] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2f993 [0229.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2f99b) returned 0x2b4a70 [0229.444] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2f993, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2f993, lpOverlapped=0x0) returned 1 [0229.446] CloseHandle (hObject=0xe0) returned 1 [0229.446] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png")) returned 0 [0229.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.446] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.446] GetTickCount () returned 0x48dcd [0229.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0229.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.447] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.447] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445\\....\\temporaryfile")) returned 0 [0229.448] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445\\temporaryfile")) returned 1 [0229.449] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db64300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db64300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.449] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db64300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db64300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.449] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.449] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.449] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.449] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.449] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.449] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445\\temporaryfile")) returned 1 [0229.449] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db3e1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db3e1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db3e1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.450] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.450] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298445" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298445")) returned 1 [0229.450] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png") returned 1 [0229.453] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.453] WriteFile (in: hFile=0xe0, lpBuffer=0x2e4420*, nNumberOfBytesToWrite=0x2f998, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2e4420*, lpNumberOfBytesWritten=0x18fdb8*=0x2f998, lpOverlapped=0x0) returned 1 [0229.456] CloseHandle (hObject=0xe0) returned 1 [0229.457] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.457] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2a88 [0229.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a90) returned 0x2b4a70 [0229.457] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2a88, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2a88, lpOverlapped=0x0) returned 1 [0229.459] CloseHandle (hObject=0xe0) returned 1 [0229.459] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png")) returned 0 [0229.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.459] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.459] GetTickCount () returned 0x48ddd [0229.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.460] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298461\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298461\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.460] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298461\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298461\\....\\temporaryfile")) returned 0 [0229.460] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298461\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298461\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298461\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298461\\temporaryfile")) returned 1 [0229.461] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298461\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db64300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db64300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db64300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.461] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db64300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db64300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db64300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.462] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db64300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db64300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db64300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.462] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298461\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db64300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db64300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db64300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.462] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db64300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db64300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db64300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.462] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db64300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db64300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db64300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.462] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.462] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298461\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298461\\temporaryfile")) returned 1 [0229.462] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db64300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db64300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db64300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.462] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.462] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298461" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298461")) returned 1 [0229.462] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 1 [0229.463] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.463] WriteFile (in: hFile=0xe0, lpBuffer=0x2b7510*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b7510*, lpNumberOfBytesWritten=0x18fdb8*=0x2a90, lpOverlapped=0x0) returned 1 [0229.464] CloseHandle (hObject=0xe0) returned 1 [0229.464] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.465] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x280e [0229.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2816) returned 0x2b4a70 [0229.465] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x280e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x280e, lpOverlapped=0x0) returned 1 [0229.466] CloseHandle (hObject=0xe0) returned 1 [0229.466] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png")) returned 0 [0229.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.466] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.466] GetTickCount () returned 0x48dec [0229.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.467] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.467] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476\\....\\temporaryfile")) returned 0 [0229.468] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476\\temporaryfile")) returned 1 [0229.469] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.469] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.469] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.469] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.469] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.469] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.469] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.469] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476\\temporaryfile")) returned 1 [0229.469] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.469] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.469] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476")) returned 1 [0229.470] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png") returned 1 [0229.470] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.470] WriteFile (in: hFile=0xe0, lpBuffer=0x2b7298*, nNumberOfBytesToWrite=0x2818, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b7298*, lpNumberOfBytesWritten=0x18fdb8*=0x2818, lpOverlapped=0x0) returned 1 [0229.471] CloseHandle (hObject=0xe0) returned 1 [0229.472] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.473] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2808 [0229.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2810) returned 0x2b4a70 [0229.473] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2808, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2808, lpOverlapped=0x0) returned 1 [0229.474] CloseHandle (hObject=0xe0) returned 1 [0229.474] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png")) returned 0 [0229.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.474] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.474] GetTickCount () returned 0x48dec [0229.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.475] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.476] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476\\....\\temporaryfile")) returned 0 [0229.476] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476\\temporaryfile")) returned 1 [0229.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbb05c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbb05c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.486] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbb05c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbb05c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.486] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.486] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.486] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.486] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.486] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476\\temporaryfile")) returned 1 [0229.486] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8db8a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8db8a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8db8a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.486] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298476" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298476")) returned 1 [0229.486] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned 1 [0229.487] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.488] WriteFile (in: hFile=0xe0, lpBuffer=0x2b7290*, nNumberOfBytesToWrite=0x2810, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b7290*, lpNumberOfBytesWritten=0x18fdb8*=0x2810, lpOverlapped=0x0) returned 1 [0229.489] CloseHandle (hObject=0xe0) returned 1 [0229.490] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.490] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x946 [0229.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x94e) returned 0x25f580 [0229.490] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x946, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x946, lpOverlapped=0x0) returned 1 [0229.494] CloseHandle (hObject=0xe0) returned 1 [0229.494] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png")) returned 0 [0229.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.494] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.494] GetTickCount () returned 0x48dfc [0229.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.495] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298492\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298492\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.495] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298492\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298492\\....\\temporaryfile")) returned 0 [0229.496] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298492\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298492\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298492\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298492\\temporaryfile")) returned 1 [0229.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298492\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbb05c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbb05c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298492\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.497] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.497] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.497] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298492\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298492\\temporaryfile")) returned 1 [0229.498] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.498] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.498] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298492" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298492")) returned 1 [0229.498] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png") returned 1 [0229.498] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.499] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x950, lpOverlapped=0x0) returned 1 [0229.499] CloseHandle (hObject=0xe0) returned 1 [0229.500] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.500] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6bbd [0229.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6bc5) returned 0x2b4a70 [0229.500] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6bbd, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x6bbd, lpOverlapped=0x0) returned 1 [0229.502] CloseHandle (hObject=0xe0) returned 1 [0229.502] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png")) returned 0 [0229.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.502] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.502] GetTickCount () returned 0x48e0b [0229.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.503] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.503] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507\\....\\temporaryfile")) returned 0 [0229.503] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507\\temporaryfile")) returned 1 [0229.504] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.504] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.505] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.505] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.505] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.505] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.505] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507\\temporaryfile")) returned 1 [0229.505] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbd6720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbd6720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbd6720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.505] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.505] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507")) returned 1 [0229.505] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png") returned 1 [0229.506] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.506] WriteFile (in: hFile=0xe0, lpBuffer=0x2bb648*, nNumberOfBytesToWrite=0x6bc8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bb648*, lpNumberOfBytesWritten=0x18fdb8*=0x6bc8, lpOverlapped=0x0) returned 1 [0229.508] CloseHandle (hObject=0xe0) returned 1 [0229.508] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.508] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb53 [0229.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb5b) returned 0x25f580 [0229.508] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb53, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb53, lpOverlapped=0x0) returned 1 [0229.510] CloseHandle (hObject=0xe0) returned 1 [0229.510] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png")) returned 0 [0229.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.510] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.510] GetTickCount () returned 0x48e0b [0229.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.511] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.511] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507\\....\\temporaryfile")) returned 0 [0229.511] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507\\temporaryfile")) returned 1 [0229.512] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.512] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.512] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.512] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.513] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.513] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.513] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.513] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507\\temporaryfile")) returned 1 [0229.513] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.513] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.513] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298507" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298507")) returned 1 [0229.513] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png") returned 1 [0229.513] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.514] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb58, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb58, lpOverlapped=0x0) returned 1 [0229.515] CloseHandle (hObject=0xe0) returned 1 [0229.515] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.515] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2a88 [0229.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a90) returned 0x2b4a70 [0229.515] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2a88, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2a88, lpOverlapped=0x0) returned 1 [0229.517] CloseHandle (hObject=0xe0) returned 1 [0229.517] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png")) returned 0 [0229.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.517] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.517] GetTickCount () returned 0x48e1b [0229.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.518] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298523\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298523\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.518] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298523\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298523\\....\\temporaryfile")) returned 0 [0229.518] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298523\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298523\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298523\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298523\\temporaryfile")) returned 1 [0229.520] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298523\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.520] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.520] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.520] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298523\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.520] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.520] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.520] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.520] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298523\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298523\\temporaryfile")) returned 1 [0229.520] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dbfc880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dbfc880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dbfc880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.520] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.520] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298523" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298523")) returned 1 [0229.520] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png") returned 1 [0229.521] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.521] WriteFile (in: hFile=0xe0, lpBuffer=0x2b7510*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b7510*, lpNumberOfBytesWritten=0x18fdb8*=0x2a90, lpOverlapped=0x0) returned 1 [0229.529] CloseHandle (hObject=0xe0) returned 1 [0229.529] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.530] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1a7ed [0229.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a7f5) returned 0x2b4a70 [0229.530] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1a7ed, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1a7ed, lpOverlapped=0x0) returned 1 [0229.532] CloseHandle (hObject=0xe0) returned 1 [0229.532] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png")) returned 0 [0229.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.532] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.533] GetTickCount () returned 0x48e2b [0229.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.533] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298539\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298539\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.533] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298539\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298539\\....\\temporaryfile")) returned 0 [0229.534] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298539\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298539\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298539\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298539\\temporaryfile")) returned 1 [0229.535] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298539\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc229e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc229e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc229e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.535] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc229e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc229e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc229e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.535] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc229e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc229e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc229e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.535] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298539\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc229e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc229e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc229e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.535] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc229e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc229e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc229e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.535] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc229e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc229e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc229e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.535] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.535] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298539\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298539\\temporaryfile")) returned 1 [0229.535] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc229e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc229e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc229e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.536] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.536] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298539" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298539")) returned 1 [0229.536] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png") returned 1 [0229.538] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.538] WriteFile (in: hFile=0xe0, lpBuffer=0x2cf278*, nNumberOfBytesToWrite=0x1a7f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2cf278*, lpNumberOfBytesWritten=0x18fdb8*=0x1a7f8, lpOverlapped=0x0) returned 1 [0229.541] CloseHandle (hObject=0xe0) returned 1 [0229.541] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.541] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4f7a [0229.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f82) returned 0x2b4a70 [0229.541] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4f7a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4f7a, lpOverlapped=0x0) returned 1 [0229.543] CloseHandle (hObject=0xe0) returned 1 [0229.543] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png")) returned 0 [0229.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.543] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.543] GetTickCount () returned 0x48e3a [0229.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0229.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.544] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.544] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554\\....\\temporaryfile")) returned 0 [0229.544] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554\\temporaryfile")) returned 1 [0229.545] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.546] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.546] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.546] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.546] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.546] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.546] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.546] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554\\temporaryfile")) returned 1 [0229.546] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.546] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.546] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554")) returned 1 [0229.546] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 1 [0229.547] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.547] WriteFile (in: hFile=0xe0, lpBuffer=0x2b9a08*, nNumberOfBytesToWrite=0x4f80, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b9a08*, lpNumberOfBytesWritten=0x18fdb8*=0x4f80, lpOverlapped=0x0) returned 1 [0229.549] CloseHandle (hObject=0xe0) returned 1 [0229.549] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.549] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x390c4 [0229.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x390cc) returned 0x2b4a70 [0229.549] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x390c4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x390c4, lpOverlapped=0x0) returned 1 [0229.553] CloseHandle (hObject=0xe0) returned 1 [0229.553] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png")) returned 0 [0229.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.553] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.553] GetTickCount () returned 0x48e3a [0229.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.554] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.554] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554\\....\\temporaryfile")) returned 0 [0229.554] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554\\temporaryfile")) returned 1 [0229.555] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.556] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.556] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.556] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.556] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.556] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.556] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.556] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554\\temporaryfile")) returned 1 [0229.556] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc48b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc48b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc48b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.556] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.556] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298554" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298554")) returned 1 [0229.556] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 1 [0229.560] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.566] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x390c8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x390c8, lpOverlapped=0x0) returned 1 [0229.571] CloseHandle (hObject=0xe0) returned 1 [0229.571] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.571] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1368 [0229.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1370) returned 0x25b528 [0229.572] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1368, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x1368, lpOverlapped=0x0) returned 1 [0229.573] CloseHandle (hObject=0xe0) returned 1 [0229.573] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png")) returned 0 [0229.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.573] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.573] GetTickCount () returned 0x48e59 [0229.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.574] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.574] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585\\....\\temporaryfile")) returned 0 [0229.574] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585\\temporaryfile")) returned 1 [0229.575] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.575] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.576] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.576] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.576] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.576] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.576] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.576] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585\\temporaryfile")) returned 1 [0229.576] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.576] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.576] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585")) returned 1 [0229.576] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 1 [0229.577] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.577] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1370, lpOverlapped=0x0) returned 1 [0229.578] CloseHandle (hObject=0xe0) returned 1 [0229.578] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.580] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc47 [0229.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc4f) returned 0x25f580 [0229.580] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc47, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc47, lpOverlapped=0x0) returned 1 [0229.581] CloseHandle (hObject=0xe0) returned 1 [0229.581] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png")) returned 0 [0229.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.581] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.582] GetTickCount () returned 0x48e59 [0229.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0229.582] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.583] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585\\....\\temporaryfile")) returned 0 [0229.583] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585\\temporaryfile")) returned 1 [0229.584] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.584] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.584] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.584] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.584] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.584] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.584] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.585] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585\\temporaryfile")) returned 1 [0229.585] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8dc94e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.585] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.585] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298585" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298585")) returned 1 [0229.585] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 1 [0229.585] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.586] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc50, lpOverlapped=0x0) returned 1 [0229.587] CloseHandle (hObject=0xe0) returned 1 [0229.588] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.588] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8dc94e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8dc94e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0229.588] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.714] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f465237, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.715] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f465237, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0229.715] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x9f465237, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0229.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdf0 [0229.716] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.716] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0229.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0229.716] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0229.718] CloseHandle (hObject=0xe0) returned 1 [0229.718] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0 [0229.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.718] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.718] GetTickCount () returned 0x48ee6 [0229.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.719] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.719] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726\\....\\temporaryfile")) returned 0 [0229.719] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726\\temporaryfile")) returned 1 [0229.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.721] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.721] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.721] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.721] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.721] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.721] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726\\temporaryfile")) returned 1 [0229.721] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.721] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.721] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726")) returned 1 [0229.722] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png") returned 1 [0229.722] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.723] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0229.724] CloseHandle (hObject=0xe0) returned 1 [0229.724] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.724] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb05 [0229.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0d) returned 0x25f580 [0229.724] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb05, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb05, lpOverlapped=0x0) returned 1 [0229.726] CloseHandle (hObject=0xe0) returned 1 [0229.726] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0 [0229.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.726] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.726] GetTickCount () returned 0x48ee6 [0229.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.726] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.727] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726\\....\\temporaryfile")) returned 0 [0229.727] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726\\temporaryfile")) returned 1 [0229.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.729] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.729] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.729] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726\\temporaryfile")) returned 1 [0229.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ddeba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ddeba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ddeba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.729] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.730] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298726" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298726")) returned 1 [0229.730] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png") returned 1 [0229.730] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.730] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb10, lpOverlapped=0x0) returned 1 [0229.731] CloseHandle (hObject=0xe0) returned 1 [0229.731] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.732] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x183b [0229.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1843) returned 0x2b4a70 [0229.733] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x183b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x183b, lpOverlapped=0x0) returned 1 [0229.734] CloseHandle (hObject=0xe0) returned 1 [0229.734] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png")) returned 0 [0229.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.734] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.734] GetTickCount () returned 0x48ef5 [0229.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.735] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.735] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741\\....\\temporaryfile")) returned 0 [0229.735] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741\\temporaryfile")) returned 1 [0229.736] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.737] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.737] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.737] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.737] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.737] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.737] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741\\temporaryfile")) returned 1 [0229.737] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.737] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741")) returned 1 [0229.737] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 1 [0229.738] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.738] WriteFile (in: hFile=0xe0, lpBuffer=0x2b62c8*, nNumberOfBytesToWrite=0x1840, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b62c8*, lpNumberOfBytesWritten=0x18fdb8*=0x1840, lpOverlapped=0x0) returned 1 [0229.739] CloseHandle (hObject=0xe0) returned 1 [0229.739] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.740] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0229.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0229.740] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0229.741] CloseHandle (hObject=0xe0) returned 1 [0229.741] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png")) returned 0 [0229.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.741] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.742] GetTickCount () returned 0x48ef5 [0229.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.742] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.743] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741\\....\\temporaryfile")) returned 0 [0229.744] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741\\temporaryfile")) returned 1 [0229.745] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.745] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.745] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.745] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.746] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.746] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.746] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.746] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741\\temporaryfile")) returned 1 [0229.746] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de11bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de11bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de11bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.746] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.746] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298741" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298741")) returned 1 [0229.746] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 1 [0229.747] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.747] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0229.749] CloseHandle (hObject=0xe0) returned 1 [0229.749] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.749] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0229.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0229.749] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0229.751] CloseHandle (hObject=0xe0) returned 1 [0229.751] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png")) returned 0 [0229.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.751] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.751] GetTickCount () returned 0x48f05 [0229.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.752] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.752] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757\\....\\temporaryfile")) returned 0 [0229.752] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757\\temporaryfile")) returned 1 [0229.754] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.754] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.754] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.754] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.754] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.754] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.754] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.754] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757\\temporaryfile")) returned 1 [0229.754] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.754] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.754] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757")) returned 1 [0229.754] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 1 [0229.755] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.755] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0229.756] CloseHandle (hObject=0xe0) returned 1 [0229.756] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.757] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0229.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0229.757] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0229.758] CloseHandle (hObject=0xe0) returned 1 [0229.758] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png")) returned 0 [0229.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.758] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.758] GetTickCount () returned 0x48f05 [0229.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.759] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.760] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757\\....\\temporaryfile")) returned 0 [0229.760] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757\\temporaryfile")) returned 1 [0229.761] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.761] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.761] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.761] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.761] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.761] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.762] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.762] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757\\temporaryfile")) returned 1 [0229.762] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de37d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de37d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de37d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.762] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.762] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298757" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298757")) returned 1 [0229.762] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 1 [0229.762] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.763] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0229.764] CloseHandle (hObject=0xe0) returned 1 [0229.764] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.764] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0229.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0229.764] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0229.766] CloseHandle (hObject=0xe0) returned 1 [0229.766] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png")) returned 0 [0229.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.766] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.766] GetTickCount () returned 0x48f15 [0229.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.767] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.768] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773\\....\\temporaryfile")) returned 0 [0229.768] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773\\temporaryfile")) returned 1 [0229.769] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.769] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.769] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.769] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.769] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.769] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.769] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.769] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773\\temporaryfile")) returned 1 [0229.769] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.770] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.770] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773")) returned 1 [0229.770] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 1 [0229.770] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.771] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0229.772] CloseHandle (hObject=0xe0) returned 1 [0229.772] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.772] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0229.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0229.772] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0229.774] CloseHandle (hObject=0xe0) returned 1 [0229.774] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png")) returned 0 [0229.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.774] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.774] GetTickCount () returned 0x48f15 [0229.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.775] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.776] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773\\....\\temporaryfile")) returned 0 [0229.776] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773\\temporaryfile")) returned 1 [0229.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de83fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de83fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.777] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de83fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de83fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.777] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.777] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.777] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.777] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773\\temporaryfile")) returned 1 [0229.778] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de5de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de5de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de5de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.778] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.778] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298773" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298773")) returned 1 [0229.778] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 1 [0229.778] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.779] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0229.780] CloseHandle (hObject=0xe0) returned 1 [0229.780] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.780] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0229.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0229.780] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0229.782] CloseHandle (hObject=0xe0) returned 1 [0229.782] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png")) returned 0 [0229.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0229.782] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0229.782] GetTickCount () returned 0x48f24 [0229.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0229.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.783] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298788\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298788\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0229.784] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298788\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298788\\....\\temporaryfile")) returned 0 [0229.784] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298788\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298788\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298788\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298788\\temporaryfile")) returned 1 [0229.786] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298788\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de83fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de83fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de83fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.786] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de83fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de83fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de83fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.786] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de83fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de83fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de83fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.786] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298788\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de83fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de83fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de83fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.786] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de83fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de83fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de83fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.786] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de83fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de83fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de83fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.786] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.786] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298788\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298788\\temporaryfile")) returned 1 [0229.787] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8de83fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8de83fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8de83fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.787] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.787] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298788" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298788")) returned 1 [0229.787] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 1 [0229.787] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.788] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0229.789] CloseHandle (hObject=0xe0) returned 1 [0229.790] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.790] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6c8d [0229.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6c95) returned 0x2b4a70 [0229.790] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6c8d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x6c8d, lpOverlapped=0x0) returned 1 [0229.792] CloseHandle (hObject=0xe0) returned 1 [0229.792] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png")) returned 0 [0229.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.792] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.792] GetTickCount () returned 0x48f34 [0229.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.793] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.793] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804\\....\\temporaryfile")) returned 0 [0229.793] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804\\temporaryfile")) returned 1 [0229.794] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.794] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.794] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.794] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.794] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.795] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.795] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.795] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804\\temporaryfile")) returned 1 [0229.795] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.795] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.795] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804")) returned 1 [0229.795] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 1 [0229.796] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.797] WriteFile (in: hFile=0xe0, lpBuffer=0x2bb718*, nNumberOfBytesToWrite=0x6c98, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bb718*, lpNumberOfBytesWritten=0x18fdb8*=0x6c98, lpOverlapped=0x0) returned 1 [0229.798] CloseHandle (hObject=0xe0) returned 1 [0229.798] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.798] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0229.799] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0229.799] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f4fdbf3, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0229.801] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f4fdbf3, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0229.801] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x9f4fdbf3, dwReserved1=0x1cbf8eb, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0229.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17) returned 0x25cdf0 [0229.801] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.802] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xeef [0229.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xef7) returned 0x25f580 [0229.802] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xeef, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xeef, lpOverlapped=0x0) returned 1 [0229.804] CloseHandle (hObject=0xe0) returned 1 [0229.804] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png")) returned 0 [0229.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.804] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.804] GetTickCount () returned 0x48f34 [0229.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.805] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.805] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804\\....\\temporaryfile")) returned 0 [0229.805] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804\\temporaryfile")) returned 1 [0229.807] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.807] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.807] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.807] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.807] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.807] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.807] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.807] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804\\temporaryfile")) returned 1 [0229.807] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8deaa140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8deaa140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8deaa140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.807] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.807] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298804" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298804")) returned 1 [0229.807] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 1 [0229.808] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.808] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xef8, lpOverlapped=0x0) returned 1 [0229.809] CloseHandle (hObject=0xe0) returned 1 [0229.809] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.810] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1168 [0229.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1170) returned 0x25b528 [0229.810] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1168, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x1168, lpOverlapped=0x0) returned 1 [0229.811] CloseHandle (hObject=0xe0) returned 1 [0229.811] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png")) returned 0 [0229.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.811] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.812] GetTickCount () returned 0x48f43 [0229.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.812] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.812] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819\\....\\temporaryfile")) returned 0 [0229.813] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819\\temporaryfile")) returned 1 [0229.814] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.814] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.814] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.814] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.814] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.814] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.814] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.814] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819\\temporaryfile")) returned 1 [0229.814] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.814] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.815] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819")) returned 1 [0229.815] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png") returned 1 [0229.815] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.815] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1170, lpOverlapped=0x0) returned 1 [0229.816] CloseHandle (hObject=0xe0) returned 1 [0229.817] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.817] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc04 [0229.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc0c) returned 0x25f580 [0229.817] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc04, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc04, lpOverlapped=0x0) returned 1 [0229.818] CloseHandle (hObject=0xe0) returned 1 [0229.819] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png")) returned 0 [0229.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.819] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.819] GetTickCount () returned 0x48f43 [0229.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.820] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.821] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819\\....\\temporaryfile")) returned 0 [0229.821] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819\\temporaryfile")) returned 1 [0229.822] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.823] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.823] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.823] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.823] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.823] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.823] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.823] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819\\temporaryfile")) returned 1 [0229.823] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ded02a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ded02a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ded02a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.823] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.823] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298819" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298819")) returned 1 [0229.828] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned 1 [0229.828] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.829] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc08, lpOverlapped=0x0) returned 1 [0229.830] CloseHandle (hObject=0xe0) returned 1 [0229.830] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.831] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa942c [0229.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa9434) returned 0x1d70020 [0229.832] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xa942c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0xa942c, lpOverlapped=0x0) returned 1 [0229.853] CloseHandle (hObject=0xe0) returned 1 [0229.853] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv")) returned 0 [0229.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0229.853] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.853] GetTickCount () returned 0x48f72 [0229.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0229.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.854] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298866\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298866\\...."), lpSecurityAttributes=0x256198) returned 1 [0229.854] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298866\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298866\\....\\temporaryfile")) returned 0 [0229.855] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298866\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298866\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298866\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298866\\temporaryfile")) returned 1 [0229.856] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298866\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8df426c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8df426c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8df426c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.856] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8df426c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8df426c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8df426c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.856] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8df426c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8df426c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8df426c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.856] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298866\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8df426c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8df426c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8df426c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.856] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8df426c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8df426c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8df426c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.856] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8df426c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8df426c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8df426c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.856] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.856] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298866\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298866\\temporaryfile")) returned 1 [0229.856] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8df426c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8df426c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8df426c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.856] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.856] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298866" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298866")) returned 1 [0229.857] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 1 [0229.900] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.908] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xa9430, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0xa9430, lpOverlapped=0x0) returned 1 [0229.919] CloseHandle (hObject=0xe0) returned 1 [0229.925] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0229.926] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbebec [0229.926] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbebf4) returned 0x1d70020 [0229.926] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xbebec, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0xbebec, lpOverlapped=0x0) returned 1 [0229.943] CloseHandle (hObject=0xe0) returned 1 [0229.943] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv")) returned 0 [0229.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0229.943] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0229.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0229.943] GetTickCount () returned 0x48fc0 [0229.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0229.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0229.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0229.944] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298944\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298944\\...."), lpSecurityAttributes=0x256228) returned 1 [0229.945] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298944\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298944\\....\\temporaryfile")) returned 0 [0229.945] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298944\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298944\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298944\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298944\\temporaryfile")) returned 1 [0229.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298944\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e000da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e000da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e000da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0229.946] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e000da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e000da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e000da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.946] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e000da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e000da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e000da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0229.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298944\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e000da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e000da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e000da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0229.946] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e000da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e000da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e000da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.947] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e000da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e000da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e000da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0229.947] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0229.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298944\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298944\\temporaryfile")) returned 1 [0229.947] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e000da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e000da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e000da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0229.947] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0229.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18298944" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18298944")) returned 1 [0229.947] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv") returned 1 [0230.011] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.012] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xbebf0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0xbebf0, lpOverlapped=0x0) returned 1 [0230.024] CloseHandle (hObject=0xe0) returned 1 [0230.481] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.481] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11ad [0230.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11b5) returned 0x25b528 [0230.481] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11ad, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11ad, lpOverlapped=0x0) returned 1 [0230.483] CloseHandle (hObject=0xe0) returned 1 [0230.483] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png")) returned 0 [0230.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0230.483] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.483] GetTickCount () returned 0x491e2 [0230.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0230.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.484] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490\\...."), lpSecurityAttributes=0x256228) returned 1 [0230.485] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490\\....\\temporaryfile")) returned 0 [0230.485] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490\\temporaryfile")) returned 1 [0230.486] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.487] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.487] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.487] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.487] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.487] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.487] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.487] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490\\temporaryfile")) returned 1 [0230.487] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.487] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.487] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490")) returned 1 [0230.487] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 1 [0230.488] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.488] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11b8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11b8, lpOverlapped=0x0) returned 1 [0230.489] CloseHandle (hObject=0xe0) returned 1 [0230.490] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.490] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbef [0230.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbf7) returned 0x25f580 [0230.490] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xbef, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xbef, lpOverlapped=0x0) returned 1 [0230.491] CloseHandle (hObject=0xe0) returned 1 [0230.492] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png")) returned 0 [0230.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0230.492] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.492] GetTickCount () returned 0x491e2 [0230.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0230.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.492] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490\\...."), lpSecurityAttributes=0x256228) returned 1 [0230.493] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490\\....\\temporaryfile")) returned 0 [0230.493] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490\\temporaryfile")) returned 1 [0230.495] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e55bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e55bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.495] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e55bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e55bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.495] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.495] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.495] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.495] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.495] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.495] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490\\temporaryfile")) returned 1 [0230.495] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e535dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e535dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e535dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.495] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.495] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299490" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299490")) returned 1 [0230.496] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 1 [0230.496] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.496] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xbf8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xbf8, lpOverlapped=0x0) returned 1 [0230.497] CloseHandle (hObject=0xe0) returned 1 [0230.497] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.498] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x629b [0230.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x62a3) returned 0x2b4a70 [0230.498] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x629b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x629b, lpOverlapped=0x0) returned 1 [0230.500] CloseHandle (hObject=0xe0) returned 1 [0230.500] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png")) returned 0 [0230.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0230.500] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.500] GetTickCount () returned 0x491f2 [0230.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0230.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.501] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299506\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299506\\...."), lpSecurityAttributes=0x256198) returned 1 [0230.501] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299506\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299506\\....\\temporaryfile")) returned 0 [0230.502] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299506\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299506\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299506\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299506\\temporaryfile")) returned 1 [0230.503] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299506\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e55bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e55bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e55bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.503] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e55bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e55bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e55bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.503] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e55bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e55bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e55bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.503] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299506\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e55bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e55bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e55bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.503] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e55bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e55bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e55bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.503] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e55bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e55bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e55bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.503] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.503] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299506\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299506\\temporaryfile")) returned 1 [0230.503] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e55bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e55bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e55bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.504] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.504] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299506" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299506")) returned 1 [0230.504] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 1 [0230.504] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.505] WriteFile (in: hFile=0xe0, lpBuffer=0x2bad28*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bad28*, lpNumberOfBytesWritten=0x18fdb8*=0x62a0, lpOverlapped=0x0) returned 1 [0230.506] CloseHandle (hObject=0xe0) returned 1 [0230.506] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.507] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1b0a [0230.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b12) returned 0x2b4a70 [0230.507] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1b0a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1b0a, lpOverlapped=0x0) returned 1 [0230.520] CloseHandle (hObject=0xe0) returned 1 [0230.520] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0 [0230.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0230.520] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.520] GetTickCount () returned 0x49201 [0230.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0230.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.521] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299521\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299521\\...."), lpSecurityAttributes=0x256228) returned 1 [0230.521] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299521\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299521\\....\\temporaryfile")) returned 0 [0230.521] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299521\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299521\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299521\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299521\\temporaryfile")) returned 1 [0230.523] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299521\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e582080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e582080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e582080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.523] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e582080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e582080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e582080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.523] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e582080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e582080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e582080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.523] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299521\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e582080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e582080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e582080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.523] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e582080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e582080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e582080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.523] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e582080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e582080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e582080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.523] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.523] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299521\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299521\\temporaryfile")) returned 1 [0230.523] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e582080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e582080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e582080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.524] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.524] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299521" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299521")) returned 1 [0230.524] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 1 [0230.524] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.525] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6598*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6598*, lpNumberOfBytesWritten=0x18fdb8*=0x1b10, lpOverlapped=0x0) returned 1 [0230.526] CloseHandle (hObject=0xe0) returned 1 [0230.526] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.526] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135f [0230.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1367) returned 0x25b528 [0230.526] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135f, lpOverlapped=0x0) returned 1 [0230.528] CloseHandle (hObject=0xe0) returned 1 [0230.528] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png")) returned 0 [0230.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0230.528] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.528] GetTickCount () returned 0x49211 [0230.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0230.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.529] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537\\...."), lpSecurityAttributes=0x256228) returned 1 [0230.529] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537\\....\\temporaryfile")) returned 0 [0230.529] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537\\temporaryfile")) returned 1 [0230.530] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.530] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.530] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.530] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.531] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.531] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.531] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.531] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537\\temporaryfile")) returned 1 [0230.531] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.531] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.531] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537")) returned 1 [0230.531] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 1 [0230.532] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.532] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1368, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1368, lpOverlapped=0x0) returned 1 [0230.533] CloseHandle (hObject=0xe0) returned 1 [0230.533] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.534] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1197 [0230.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x119f) returned 0x25b528 [0230.534] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1197, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x1197, lpOverlapped=0x0) returned 1 [0230.535] CloseHandle (hObject=0xe0) returned 1 [0230.535] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png")) returned 0 [0230.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0230.535] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.535] GetTickCount () returned 0x49211 [0230.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0230.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.536] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537\\...."), lpSecurityAttributes=0x256228) returned 1 [0230.537] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537\\....\\temporaryfile")) returned 0 [0230.537] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537\\temporaryfile")) returned 1 [0230.538] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.538] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.538] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.538] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.538] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.538] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.538] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.539] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537\\temporaryfile")) returned 1 [0230.539] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5a81e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5a81e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5a81e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.539] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.539] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299537" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299537")) returned 1 [0230.539] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 1 [0230.539] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.540] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11a0, lpOverlapped=0x0) returned 1 [0230.541] CloseHandle (hObject=0xe0) returned 1 [0230.541] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.542] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc0a [0230.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc12) returned 0x25f580 [0230.542] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc0a, lpOverlapped=0x0) returned 1 [0230.545] CloseHandle (hObject=0xe0) returned 1 [0230.545] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0 [0230.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0230.545] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.545] GetTickCount () returned 0x49221 [0230.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0230.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.546] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553\\...."), lpSecurityAttributes=0x256228) returned 1 [0230.546] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553\\....\\temporaryfile")) returned 0 [0230.546] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553\\temporaryfile")) returned 1 [0230.547] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.547] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.547] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.547] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.548] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.548] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.548] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.548] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553\\temporaryfile")) returned 1 [0230.548] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.548] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.548] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553")) returned 1 [0230.548] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 1 [0230.548] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.549] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0230.550] CloseHandle (hObject=0xe0) returned 1 [0230.550] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.550] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc24 [0230.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc2c) returned 0x25f580 [0230.550] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc24, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc24, lpOverlapped=0x0) returned 1 [0230.552] CloseHandle (hObject=0xe0) returned 1 [0230.552] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png")) returned 0 [0230.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0230.552] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.552] GetTickCount () returned 0x49221 [0230.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0230.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.553] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553\\...."), lpSecurityAttributes=0x256198) returned 1 [0230.553] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553\\....\\temporaryfile")) returned 0 [0230.554] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553\\temporaryfile")) returned 1 [0230.555] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.555] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.555] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.555] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.555] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.555] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.555] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.555] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553\\temporaryfile")) returned 1 [0230.555] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e5ce340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e5ce340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e5ce340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.556] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.556] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299553" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299553")) returned 1 [0230.556] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned 1 [0230.556] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.557] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc28, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc28, lpOverlapped=0x0) returned 1 [0230.557] CloseHandle (hObject=0xe0) returned 1 [0230.558] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.558] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x8232c [0230.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x82334) returned 0x1d70020 [0230.558] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x8232c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0x8232c, lpOverlapped=0x0) returned 1 [0230.571] CloseHandle (hObject=0xe0) returned 1 [0230.572] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv")) returned 0 [0230.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0230.572] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.572] GetTickCount () returned 0x49240 [0230.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0230.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.572] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299584\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299584\\...."), lpSecurityAttributes=0x256228) returned 1 [0230.573] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299584\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299584\\....\\temporaryfile")) returned 0 [0230.573] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299584\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299584\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299584\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299584\\temporaryfile")) returned 1 [0230.574] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299584\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e61a600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e61a600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e61a600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.574] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e61a600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e61a600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e61a600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.574] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e61a600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e61a600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e61a600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.574] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299584\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e61a600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e61a600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e61a600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.574] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e61a600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e61a600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e61a600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.575] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e61a600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e61a600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e61a600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.575] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.575] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299584\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299584\\temporaryfile")) returned 1 [0230.575] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e61a600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e61a600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e61a600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.575] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.575] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299584" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299584")) returned 1 [0230.575] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv") returned 1 [0230.607] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.608] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x82330, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0x82330, lpOverlapped=0x0) returned 1 [0230.617] CloseHandle (hObject=0xe0) returned 1 [0230.622] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.622] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x95bac [0230.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x95bb4) returned 0x1d70020 [0230.623] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x95bac, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0x95bac, lpOverlapped=0x0) returned 1 [0230.653] CloseHandle (hObject=0xe0) returned 1 [0230.653] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv")) returned 0 [0230.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0230.654] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.654] GetTickCount () returned 0x4928e [0230.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0230.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.654] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299662\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299662\\...."), lpSecurityAttributes=0x256198) returned 1 [0230.655] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299662\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299662\\....\\temporaryfile")) returned 0 [0230.655] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299662\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299662\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299662\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299662\\temporaryfile")) returned 1 [0230.656] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299662\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e6d8ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e6d8ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e6d8ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.657] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e6d8ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e6d8ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e6d8ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.657] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e6d8ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e6d8ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e6d8ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.657] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299662\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e6d8ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e6d8ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e6d8ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.657] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e6d8ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e6d8ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e6d8ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.657] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e6d8ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e6d8ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e6d8ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.657] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.657] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299662\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299662\\temporaryfile")) returned 1 [0230.657] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e6d8ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e6d8ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e6d8ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.657] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.657] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299662" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299662")) returned 1 [0230.657] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv") returned 1 [0230.696] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.697] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x95bb0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0x95bb0, lpOverlapped=0x0) returned 1 [0230.707] CloseHandle (hObject=0xe0) returned 1 [0230.717] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.718] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x99 [0230.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa1) returned 0x259580 [0230.718] ReadFile (in: hFile=0xe0, lpBuffer=0x259588, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259588*, lpNumberOfBytesRead=0x18fdd0*=0x99, lpOverlapped=0x0) returned 1 [0230.719] CloseHandle (hObject=0xe0) returned 1 [0230.719] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png")) returned 0 [0230.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0230.719] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.719] GetTickCount () returned 0x492cc [0230.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0230.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.720] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724\\...."), lpSecurityAttributes=0x256198) returned 1 [0230.720] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724\\....\\temporaryfile")) returned 0 [0230.720] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724\\temporaryfile")) returned 1 [0230.722] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e771260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e771260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e771260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.722] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e771260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e771260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e771260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.722] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e771260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e771260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e771260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.722] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e771260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e771260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e771260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.722] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e771260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e771260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e771260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.722] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e771260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e771260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e771260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.722] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.722] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724\\temporaryfile")) returned 1 [0230.722] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e771260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e771260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e771260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.722] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724")) returned 1 [0230.723] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png") returned 1 [0230.723] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.724] WriteFile (in: hFile=0xe0, lpBuffer=0x28f200*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesWritten=0x18fdb8*=0xa0, lpOverlapped=0x0) returned 1 [0230.724] CloseHandle (hObject=0xe0) returned 1 [0230.724] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.725] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x84 [0230.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8c) returned 0x262a08 [0230.725] ReadFile (in: hFile=0xe0, lpBuffer=0x262a10, nNumberOfBytesToRead=0x84, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x262a10*, lpNumberOfBytesRead=0x18fdd0*=0x84, lpOverlapped=0x0) returned 1 [0230.726] CloseHandle (hObject=0xe0) returned 1 [0230.726] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png")) returned 0 [0230.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0230.726] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.726] GetTickCount () returned 0x492cc [0230.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0230.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.727] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724\\...."), lpSecurityAttributes=0x256198) returned 1 [0230.727] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724\\....\\temporaryfile")) returned 0 [0230.728] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724\\temporaryfile")) returned 1 [0230.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e771260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e7973c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e7973c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e771260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e7973c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e7973c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e7973c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e7973c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e7973c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e7973c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e7973c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e7973c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.729] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e7973c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e7973c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e7973c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.729] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e7973c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e7973c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e7973c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.729] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724\\temporaryfile")) returned 1 [0230.730] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e7973c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e7973c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e7973c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.730] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.730] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299724" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299724")) returned 1 [0230.730] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 1 [0230.730] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.731] WriteFile (in: hFile=0xe0, lpBuffer=0x262aa8*, nNumberOfBytesToWrite=0x88, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x262aa8*, lpNumberOfBytesWritten=0x18fdb8*=0x88, lpOverlapped=0x0) returned 1 [0230.732] CloseHandle (hObject=0xe0) returned 1 [0230.732] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.733] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1a9204 [0230.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a920c) returned 0x2650020 [0230.733] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1a9204, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x1a9204, lpOverlapped=0x0) returned 1 [0230.799] CloseHandle (hObject=0xe0) returned 1 [0230.799] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv")) returned 0 [0230.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0230.799] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0230.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0230.800] GetTickCount () returned 0x4931a [0230.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0230.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0230.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0230.801] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299802\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299802\\...."), lpSecurityAttributes=0x256228) returned 1 [0230.801] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299802\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299802\\....\\temporaryfile")) returned 0 [0230.801] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299802\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299802\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299802\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299802\\temporaryfile")) returned 1 [0230.803] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299802\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e82f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e82f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e82f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0230.803] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e82f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e82f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e82f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.803] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e82f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e82f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e82f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0230.803] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299802\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e82f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e82f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e82f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0230.803] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e82f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e82f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e82f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.803] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e82f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e82f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e82f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0230.803] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0230.803] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299802\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299802\\temporaryfile")) returned 1 [0230.803] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8e82f940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8e82f940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8e82f940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0230.803] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0230.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18299802" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18299802")) returned 1 [0230.804] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 1 [0230.903] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.922] WriteFile (in: hFile=0xe0, lpBuffer=0x29b0028*, nNumberOfBytesToWrite=0x1a9208, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b0028*, lpNumberOfBytesWritten=0x18fdb8*=0x1a9208, lpOverlapped=0x0) returned 1 [0230.950] CloseHandle (hObject=0xe0) returned 1 [0230.965] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0230.966] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1d0304 [0230.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d030c) returned 0x2650020 [0230.967] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1d0304, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x1d0304, lpOverlapped=0x0) returned 1 [0231.020] CloseHandle (hObject=0xe0) returned 1 [0231.020] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv")) returned 0 [0231.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0231.020] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.020] GetTickCount () returned 0x493f5 [0231.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0231.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0231.021] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300021\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300021\\...."), lpSecurityAttributes=0x256198) returned 1 [0231.021] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300021\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300021\\....\\temporaryfile")) returned 0 [0231.021] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300021\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300021\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300021\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300021\\temporaryfile")) returned 1 [0231.023] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300021\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ea44c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ea44c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ea44c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0231.023] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ea44c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ea44c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ea44c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.023] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ea44c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ea44c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ea44c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.023] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300021\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ea44c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ea44c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ea44c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.024] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ea44c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ea44c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ea44c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.024] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ea44c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ea44c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ea44c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.024] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.024] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300021\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300021\\temporaryfile")) returned 1 [0231.024] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ea44c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ea44c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ea44c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.024] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0231.024] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300021" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300021")) returned 1 [0231.024] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 1 [0231.138] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.139] WriteFile (in: hFile=0xe0, lpBuffer=0x2a10028*, nNumberOfBytesToWrite=0x1d0308, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2a10028*, lpNumberOfBytesWritten=0x18fdb8*=0x1d0308, lpOverlapped=0x0) returned 1 [0231.169] CloseHandle (hObject=0xe0) returned 1 [0231.186] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.188] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xad264 [0231.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xad26c) returned 0x1d70020 [0231.188] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xad264, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0xad264, lpOverlapped=0x0) returned 1 [0231.213] CloseHandle (hObject=0xe0) returned 1 [0231.213] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv")) returned 0 [0231.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0231.213] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.213] GetTickCount () returned 0x494bf [0231.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0231.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0231.214] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300223\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300223\\...."), lpSecurityAttributes=0x256198) returned 1 [0231.214] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300223\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300223\\....\\temporaryfile")) returned 0 [0231.214] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300223\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300223\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300223\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300223\\temporaryfile")) returned 1 [0231.216] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300223\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ec33e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ec33e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ec33e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0231.216] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ec33e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ec33e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ec33e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.216] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ec33e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ec33e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ec33e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.216] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300223\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ec33e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ec33e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ec33e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.216] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ec33e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ec33e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ec33e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.216] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ec33e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ec33e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ec33e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.216] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.216] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300223\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300223\\temporaryfile")) returned 1 [0231.216] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ec33e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ec33e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ec33e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.216] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0231.216] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300223" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300223")) returned 1 [0231.217] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 1 [0231.247] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.247] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xad268, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0xad268, lpOverlapped=0x0) returned 1 [0231.258] CloseHandle (hObject=0xe0) returned 1 [0231.264] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.264] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb4f64 [0231.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb4f6c) returned 0x1d70020 [0231.265] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xb4f64, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0xb4f64, lpOverlapped=0x0) returned 1 [0231.279] CloseHandle (hObject=0xe0) returned 1 [0231.279] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv")) returned 0 [0231.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0231.279] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.280] GetTickCount () returned 0x494fe [0231.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0231.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0231.280] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300286\\...."), lpSecurityAttributes=0x256198) returned 1 [0231.280] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300286\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300286\\....\\temporaryfile")) returned 0 [0231.281] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300286\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300286\\temporaryfile")) returned 1 [0231.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300286\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eccc3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eccc3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eccc3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0231.282] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eccc3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eccc3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eccc3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.282] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eccc3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eccc3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eccc3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300286\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eccc3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eccc3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eccc3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.282] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eccc3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eccc3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eccc3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.282] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eccc3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eccc3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eccc3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.282] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300286\\temporaryfile")) returned 1 [0231.283] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eccc3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eccc3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eccc3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.283] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0231.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300286" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300286")) returned 1 [0231.283] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 1 [0231.318] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.318] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xb4f68, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0xb4f68, lpOverlapped=0x0) returned 1 [0231.340] CloseHandle (hObject=0xe0) returned 1 [0231.346] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.347] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x999e4 [0231.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x999ec) returned 0x1d70020 [0231.347] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x999e4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0x999e4, lpOverlapped=0x0) returned 1 [0231.362] CloseHandle (hObject=0xe0) returned 1 [0231.362] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv")) returned 0 [0231.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0231.362] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.362] GetTickCount () returned 0x4954c [0231.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0231.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0231.363] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300364\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300364\\...."), lpSecurityAttributes=0x256198) returned 1 [0231.363] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300364\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300364\\....\\temporaryfile")) returned 0 [0231.363] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300364\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300364\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300364\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300364\\temporaryfile")) returned 1 [0231.365] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300364\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ed8aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ed8aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ed8aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0231.365] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ed8aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ed8aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ed8aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.365] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ed8aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ed8aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ed8aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.365] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300364\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ed8aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ed8aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ed8aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.365] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ed8aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ed8aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ed8aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.365] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ed8aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ed8aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ed8aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.365] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.365] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300364\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300364\\temporaryfile")) returned 1 [0231.365] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ed8aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ed8aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ed8aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.365] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0231.365] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300364" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300364")) returned 1 [0231.365] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 1 [0231.399] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.400] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x999e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0x999e8, lpOverlapped=0x0) returned 1 [0231.409] CloseHandle (hObject=0xe0) returned 1 [0231.414] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.414] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xa16e4 [0231.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa16ec) returned 0x1d70020 [0231.415] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xa16e4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0xa16e4, lpOverlapped=0x0) returned 1 [0231.428] CloseHandle (hObject=0xe0) returned 1 [0231.428] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv")) returned 0 [0231.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0231.428] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.428] GetTickCount () returned 0x4958a [0231.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0231.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0231.429] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300426\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300426\\...."), lpSecurityAttributes=0x256198) returned 1 [0231.429] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300426\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300426\\....\\temporaryfile")) returned 0 [0231.429] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300426\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300426\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300426\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300426\\temporaryfile")) returned 1 [0231.430] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300426\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ee23040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ee491a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ee491a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0231.431] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ee23040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ee491a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ee491a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.431] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ee23040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ee23040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ee23040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.431] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300426\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ee23040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ee23040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ee23040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.431] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ee23040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ee23040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ee23040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.431] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ee23040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ee23040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ee23040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.431] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.431] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300426\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300426\\temporaryfile")) returned 1 [0231.431] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ee23040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ee23040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ee23040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.431] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0231.431] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300426" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300426")) returned 1 [0231.431] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned 1 [0231.478] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.478] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xa16e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0xa16e8, lpOverlapped=0x0) returned 1 [0231.487] CloseHandle (hObject=0xe0) returned 1 [0231.493] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.494] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1a3c [0231.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a44) returned 0x2b4a70 [0231.494] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1a3c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1a3c, lpOverlapped=0x0) returned 1 [0231.495] CloseHandle (hObject=0xe0) returned 1 [0231.495] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png")) returned 0 [0231.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0231.495] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.495] GetTickCount () returned 0x495d8 [0231.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0231.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0231.496] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504\\...."), lpSecurityAttributes=0x256198) returned 1 [0231.497] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504\\....\\temporaryfile")) returned 0 [0231.497] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504\\temporaryfile")) returned 1 [0231.498] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0231.498] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.498] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.498] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.498] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.498] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.498] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.499] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504\\temporaryfile")) returned 1 [0231.499] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.499] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0231.499] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504")) returned 1 [0231.499] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 1 [0231.499] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.500] WriteFile (in: hFile=0xe0, lpBuffer=0x2b64c8*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b64c8*, lpNumberOfBytesWritten=0x18fdb8*=0x1a40, lpOverlapped=0x0) returned 1 [0231.501] CloseHandle (hObject=0xe0) returned 1 [0231.501] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.501] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2ee8 [0231.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ef0) returned 0x2b4a70 [0231.501] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2ee8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2ee8, lpOverlapped=0x0) returned 1 [0231.503] CloseHandle (hObject=0xe0) returned 1 [0231.503] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png")) returned 0 [0231.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0231.503] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.503] GetTickCount () returned 0x495d8 [0231.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0231.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0231.503] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504\\...."), lpSecurityAttributes=0x256228) returned 1 [0231.504] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504\\....\\temporaryfile")) returned 0 [0231.504] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504\\temporaryfile")) returned 1 [0231.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0231.506] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.506] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.506] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.506] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.506] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.506] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.506] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504\\temporaryfile")) returned 1 [0231.506] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8eee1720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8eee1720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8eee1720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.506] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0231.506] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300504" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300504")) returned 1 [0231.506] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 1 [0231.507] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.508] WriteFile (in: hFile=0xe0, lpBuffer=0x2b7970*, nNumberOfBytesToWrite=0x2ef0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b7970*, lpNumberOfBytesWritten=0x18fdb8*=0x2ef0, lpOverlapped=0x0) returned 1 [0231.509] CloseHandle (hObject=0xe0) returned 1 [0231.510] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.510] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8ef07880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef07880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0231.510] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.510] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa15a10e8, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0231.511] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa15a10e8, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0231.512] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0xa15a10e8, dwReserved1=0x1cbf8eb, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0231.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13) returned 0x25cdb0 [0231.512] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.512] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x39eaa [0231.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x39eb2) returned 0x2b4a70 [0231.512] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x39eaa, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x39eaa, lpOverlapped=0x0) returned 1 [0231.515] CloseHandle (hObject=0xe0) returned 1 [0231.515] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv")) returned 0 [0231.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.515] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.516] GetTickCount () returned 0x495e8 [0231.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.516] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300520\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300520\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.516] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300520\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300520\\....\\temporaryfile")) returned 0 [0231.517] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300520\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300520\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300520\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300520\\temporaryfile")) returned 1 [0231.518] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300520\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef07880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef07880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef07880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.518] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef07880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef07880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef07880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.518] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef07880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef07880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef07880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.518] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300520\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef07880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef07880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef07880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.518] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef07880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef07880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef07880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.518] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef07880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef07880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef07880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.518] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.518] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300520\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300520\\temporaryfile")) returned 1 [0231.518] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef07880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef07880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef07880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.518] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.519] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300520" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300520")) returned 1 [0231.519] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 1 [0231.522] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.523] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x39eb0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x39eb0, lpOverlapped=0x0) returned 1 [0231.526] CloseHandle (hObject=0xe0) returned 1 [0231.527] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.528] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3dd24 [0231.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3dd2c) returned 0x2b4a70 [0231.528] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3dd24, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x3dd24, lpOverlapped=0x0) returned 1 [0231.530] CloseHandle (hObject=0xe0) returned 1 [0231.530] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv")) returned 0 [0231.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.530] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.531] GetTickCount () returned 0x495f7 [0231.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.531] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300535\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300535\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.531] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300535\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300535\\....\\temporaryfile")) returned 0 [0231.532] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300535\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300535\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300535\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300535\\temporaryfile")) returned 1 [0231.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300535\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef2d9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef2d9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef2d9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef2d9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef2d9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef2d9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef2d9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef2d9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef2d9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300535\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef2d9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef2d9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef2d9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.533] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef2d9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef2d9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef2d9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.533] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef2d9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef2d9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef2d9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.533] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300535\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300535\\temporaryfile")) returned 1 [0231.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef2d9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef2d9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef2d9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.533] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300535" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300535")) returned 1 [0231.534] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned 1 [0231.537] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.538] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x3dd28, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x3dd28, lpOverlapped=0x0) returned 1 [0231.542] CloseHandle (hObject=0xe0) returned 1 [0231.542] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.543] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc0b4a [0231.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc0b52) returned 0x1d70020 [0231.543] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xc0b4a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0xc0b4a, lpOverlapped=0x0) returned 1 [0231.567] CloseHandle (hObject=0xe0) returned 1 [0231.567] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv")) returned 0 [0231.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.567] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.567] GetTickCount () returned 0x49617 [0231.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.568] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300567\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300567\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.568] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300567\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300567\\....\\temporaryfile")) returned 0 [0231.569] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300567\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300567\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300567\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300567\\temporaryfile")) returned 1 [0231.570] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300567\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef79ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef79ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef79ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.570] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef79ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef79ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef79ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.570] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef79ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef79ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef79ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.570] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300567\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef79ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef79ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef79ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.570] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef79ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef79ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef79ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.570] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef79ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef79ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef79ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.570] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.570] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300567\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300567\\temporaryfile")) returned 1 [0231.571] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ef79ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ef79ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ef79ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.571] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.571] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300567" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300567")) returned 1 [0231.571] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 1 [0231.620] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.621] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xc0b50, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0xc0b50, lpOverlapped=0x0) returned 1 [0231.633] CloseHandle (hObject=0xe0) returned 1 [0231.640] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.640] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd43ca [0231.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd43d2) returned 0x2250020 [0231.641] ReadFile (in: hFile=0xe0, lpBuffer=0x2250028, nNumberOfBytesToRead=0xd43ca, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdd0*=0xd43ca, lpOverlapped=0x0) returned 1 [0231.667] CloseHandle (hObject=0xe0) returned 1 [0231.667] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv")) returned 0 [0231.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.667] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.667] GetTickCount () returned 0x49684 [0231.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.668] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300676\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300676\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.669] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300676\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300676\\....\\temporaryfile")) returned 0 [0231.669] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300676\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300676\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300676\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300676\\temporaryfile")) returned 1 [0231.670] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300676\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f084640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f084640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f084640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.670] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f084640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f084640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f084640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.670] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f084640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f084640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f084640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.670] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300676\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f084640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f084640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f084640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.670] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f084640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f084640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f084640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.670] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f084640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f084640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f084640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.670] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.671] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300676\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300676\\temporaryfile")) returned 1 [0231.671] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f084640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f084640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f084640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.671] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.671] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300676" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300676")) returned 1 [0231.671] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 1 [0231.718] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.719] WriteFile (in: hFile=0xe0, lpBuffer=0x2730028*, nNumberOfBytesToWrite=0xd43d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2730028*, lpNumberOfBytesWritten=0x18fdb8*=0xd43d0, lpOverlapped=0x0) returned 1 [0231.732] CloseHandle (hObject=0xe0) returned 1 [0231.739] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.740] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbc8 [0231.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbd0) returned 0x25f580 [0231.740] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xbc8, lpOverlapped=0x0) returned 1 [0231.761] CloseHandle (hObject=0xe0) returned 1 [0231.762] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png")) returned 0 [0231.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.763] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.763] GetTickCount () returned 0x496e1 [0231.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.763] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.764] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769\\....\\temporaryfile")) returned 0 [0231.764] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769\\temporaryfile")) returned 1 [0231.765] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.765] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.765] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.765] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.765] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.766] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.766] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.766] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769\\temporaryfile")) returned 1 [0231.766] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.766] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.766] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769")) returned 1 [0231.766] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 1 [0231.766] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.767] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xbd0, lpOverlapped=0x0) returned 1 [0231.768] CloseHandle (hObject=0xe0) returned 1 [0231.768] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.769] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x739 [0231.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x741) returned 0x25f580 [0231.769] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x739, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x739, lpOverlapped=0x0) returned 1 [0231.770] CloseHandle (hObject=0xe0) returned 1 [0231.770] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png")) returned 0 [0231.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.770] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.770] GetTickCount () returned 0x496e1 [0231.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.771] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.771] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769\\....\\temporaryfile")) returned 0 [0231.772] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769\\temporaryfile")) returned 1 [0231.773] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.773] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.773] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.773] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.773] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.773] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.773] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.774] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769\\temporaryfile")) returned 1 [0231.774] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f168e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f168e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f168e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.774] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.774] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300769" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300769")) returned 1 [0231.774] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 1 [0231.774] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.775] WriteFile (in: hFile=0xe0, lpBuffer=0x25fcd8*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25fcd8*, lpNumberOfBytesWritten=0x18fdb8*=0x740, lpOverlapped=0x0) returned 1 [0231.776] CloseHandle (hObject=0xe0) returned 1 [0231.776] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.776] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbc8 [0231.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbd0) returned 0x25f580 [0231.777] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xbc8, lpOverlapped=0x0) returned 1 [0231.778] CloseHandle (hObject=0xe0) returned 1 [0231.778] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png")) returned 0 [0231.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.778] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.778] GetTickCount () returned 0x496f1 [0231.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.779] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.779] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785\\....\\temporaryfile")) returned 0 [0231.779] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785\\temporaryfile")) returned 1 [0231.780] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f18efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f18efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f18efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.781] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f18efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f18efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f18efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.781] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f18efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f18efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f18efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.781] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f18efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f18efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f18efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.781] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f18efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f18efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f18efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.781] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f18efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f18efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f18efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.781] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.781] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785\\temporaryfile")) returned 1 [0231.781] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f18efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f18efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f18efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.781] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.781] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785")) returned 1 [0231.781] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 1 [0231.782] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.782] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xbd0, lpOverlapped=0x0) returned 1 [0231.783] CloseHandle (hObject=0xe0) returned 1 [0231.785] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.785] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7f9 [0231.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x801) returned 0x25f580 [0231.786] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x7f9, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x7f9, lpOverlapped=0x0) returned 1 [0231.787] CloseHandle (hObject=0xe0) returned 1 [0231.787] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png")) returned 0 [0231.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.787] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.787] GetTickCount () returned 0x496f1 [0231.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.788] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.788] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785\\....\\temporaryfile")) returned 0 [0231.789] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785\\temporaryfile")) returned 1 [0231.790] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f18efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.790] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f18efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.790] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.790] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.790] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.790] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.790] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.790] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785\\temporaryfile")) returned 1 [0231.790] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.790] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.790] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300785" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300785")) returned 1 [0231.791] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 1 [0231.791] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.791] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0x800, lpOverlapped=0x0) returned 1 [0231.792] CloseHandle (hObject=0xe0) returned 1 [0231.793] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.794] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb4b [0231.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb53) returned 0x25f580 [0231.794] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb4b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb4b, lpOverlapped=0x0) returned 1 [0231.795] CloseHandle (hObject=0xe0) returned 1 [0231.795] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png")) returned 0 [0231.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.795] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.795] GetTickCount () returned 0x49701 [0231.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.796] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.796] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801\\....\\temporaryfile")) returned 0 [0231.797] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801\\temporaryfile")) returned 1 [0231.798] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.798] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.798] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.798] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.798] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.798] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.798] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801\\temporaryfile")) returned 1 [0231.799] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1b5140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1b5140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.799] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.799] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801")) returned 1 [0231.799] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned 1 [0231.799] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.800] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb50, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb50, lpOverlapped=0x0) returned 1 [0231.800] CloseHandle (hObject=0xe0) returned 1 [0231.801] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.801] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbc8 [0231.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbd0) returned 0x25f580 [0231.801] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xbc8, lpOverlapped=0x0) returned 1 [0231.802] CloseHandle (hObject=0xe0) returned 1 [0231.802] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png")) returned 0 [0231.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.803] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0231.803] GetTickCount () returned 0x49701 [0231.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.803] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.804] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801\\....\\temporaryfile")) returned 0 [0231.804] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801\\temporaryfile")) returned 1 [0231.805] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.805] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1b5140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.805] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.805] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.806] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.806] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.806] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.806] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801\\temporaryfile")) returned 1 [0231.806] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.806] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.806] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300801" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300801")) returned 1 [0231.806] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 1 [0231.806] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.808] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xbd0, lpOverlapped=0x0) returned 1 [0231.808] CloseHandle (hObject=0xe0) returned 1 [0231.809] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.809] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7e3 [0231.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7eb) returned 0x25f580 [0231.809] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0x7e3, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0x7e3, lpOverlapped=0x0) returned 1 [0231.810] CloseHandle (hObject=0xe0) returned 1 [0231.810] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png")) returned 0 [0231.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.811] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.811] GetTickCount () returned 0x49710 [0231.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.811] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.812] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816\\....\\temporaryfile")) returned 0 [0231.812] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816\\temporaryfile")) returned 1 [0231.813] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.814] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.814] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.814] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.814] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.814] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.814] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.814] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816\\temporaryfile")) returned 1 [0231.814] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f1db2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f1db2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.814] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.814] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816")) returned 1 [0231.814] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 1 [0231.815] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.815] WriteFile (in: hFile=0xe0, lpBuffer=0x25fd80*, nNumberOfBytesToWrite=0x7e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25fd80*, lpNumberOfBytesWritten=0x18fdb8*=0x7e8, lpOverlapped=0x0) returned 1 [0231.816] CloseHandle (hObject=0xe0) returned 1 [0231.816] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.817] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x33b7 [0231.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x33bf) returned 0x2b4a70 [0231.817] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x33b7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x33b7, lpOverlapped=0x0) returned 1 [0231.818] CloseHandle (hObject=0xe0) returned 1 [0231.818] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png")) returned 0 [0231.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.818] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.818] GetTickCount () returned 0x49710 [0231.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.819] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.819] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816\\....\\temporaryfile")) returned 0 [0231.820] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816\\temporaryfile")) returned 1 [0231.821] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.821] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f1db2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.821] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.821] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.821] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.821] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.821] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.821] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816\\temporaryfile")) returned 1 [0231.821] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.821] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.821] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300816" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300816")) returned 1 [0231.822] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 1 [0231.822] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.822] WriteFile (in: hFile=0xe0, lpBuffer=0x2b7e40*, nNumberOfBytesToWrite=0x33c0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b7e40*, lpNumberOfBytesWritten=0x18fdb8*=0x33c0, lpOverlapped=0x0) returned 1 [0231.823] CloseHandle (hObject=0xe0) returned 1 [0231.824] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.824] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1681 [0231.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1689) returned 0x2b4a70 [0231.824] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1681, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1681, lpOverlapped=0x0) returned 1 [0231.825] CloseHandle (hObject=0xe0) returned 1 [0231.826] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png")) returned 0 [0231.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.826] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.826] GetTickCount () returned 0x49720 [0231.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.826] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.827] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832\\....\\temporaryfile")) returned 0 [0231.827] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832\\temporaryfile")) returned 1 [0231.828] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.828] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.828] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.828] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.829] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.829] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.829] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.829] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832\\temporaryfile")) returned 1 [0231.829] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.829] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.829] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832")) returned 1 [0231.829] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 1 [0231.829] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.830] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6110*, nNumberOfBytesToWrite=0x1688, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6110*, lpNumberOfBytesWritten=0x18fdb8*=0x1688, lpOverlapped=0x0) returned 1 [0231.831] CloseHandle (hObject=0xe0) returned 1 [0231.831] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.832] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1fe9 [0231.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ff1) returned 0x2b4a70 [0231.832] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1fe9, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1fe9, lpOverlapped=0x0) returned 1 [0231.833] CloseHandle (hObject=0xe0) returned 1 [0231.833] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png")) returned 0 [0231.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.834] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.834] GetTickCount () returned 0x49720 [0231.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.834] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.835] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832\\....\\temporaryfile")) returned 0 [0231.835] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832\\temporaryfile")) returned 1 [0231.836] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f227560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f227560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.836] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f227560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f227560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.836] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.836] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.836] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.837] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.837] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.837] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832\\temporaryfile")) returned 1 [0231.837] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f201400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f201400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f201400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.837] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.837] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300832" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300832")) returned 1 [0231.837] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 1 [0231.837] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.838] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6a78*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6a78*, lpNumberOfBytesWritten=0x18fdb8*=0x1ff0, lpOverlapped=0x0) returned 1 [0231.839] CloseHandle (hObject=0xe0) returned 1 [0231.839] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.840] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x643e [0231.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6446) returned 0x2b4a70 [0231.840] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x643e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x643e, lpOverlapped=0x0) returned 1 [0231.841] CloseHandle (hObject=0xe0) returned 1 [0231.841] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0 [0231.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.841] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.841] GetTickCount () returned 0x4972f [0231.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.842] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300847\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300847\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.843] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300847\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300847\\....\\temporaryfile")) returned 0 [0231.843] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300847\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300847\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300847\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300847\\temporaryfile")) returned 1 [0231.844] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300847\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f227560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f227560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f227560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.844] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f227560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f227560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f227560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.844] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f227560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f227560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f227560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.844] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300847\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f227560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f227560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f227560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.844] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f227560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f227560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f227560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.844] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f227560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f227560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f227560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.844] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.844] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300847\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300847\\temporaryfile")) returned 1 [0231.845] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f227560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f227560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f227560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.845] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.845] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300847" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300847")) returned 1 [0231.845] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned 1 [0231.846] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.846] WriteFile (in: hFile=0xe0, lpBuffer=0x2baec8*, nNumberOfBytesToWrite=0x6448, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2baec8*, lpNumberOfBytesWritten=0x18fdb8*=0x6448, lpOverlapped=0x0) returned 1 [0231.847] CloseHandle (hObject=0xe0) returned 1 [0231.848] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.848] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1816 [0231.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x181e) returned 0x2b4a70 [0231.848] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1816, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1816, lpOverlapped=0x0) returned 1 [0231.851] CloseHandle (hObject=0xe0) returned 1 [0231.851] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0 [0231.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.851] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.851] GetTickCount () returned 0x4973f [0231.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.851] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.852] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863\\....\\temporaryfile")) returned 0 [0231.852] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863\\temporaryfile")) returned 1 [0231.853] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.853] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.853] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.853] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.853] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.853] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.853] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.853] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863\\temporaryfile")) returned 1 [0231.854] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.854] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.854] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863")) returned 1 [0231.854] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png") returned 1 [0231.854] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.855] WriteFile (in: hFile=0xe0, lpBuffer=0x2b62a0*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b62a0*, lpNumberOfBytesWritten=0x18fdb8*=0x1820, lpOverlapped=0x0) returned 1 [0231.856] CloseHandle (hObject=0xe0) returned 1 [0231.856] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.856] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1f0a [0231.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f12) returned 0x2b4a70 [0231.856] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1f0a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1f0a, lpOverlapped=0x0) returned 1 [0231.858] CloseHandle (hObject=0xe0) returned 1 [0231.858] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0 [0231.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.858] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.858] GetTickCount () returned 0x4973f [0231.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.858] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.859] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863\\....\\temporaryfile")) returned 0 [0231.859] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863\\temporaryfile")) returned 1 [0231.860] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.860] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.860] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.860] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.861] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.861] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.861] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.861] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863\\temporaryfile")) returned 1 [0231.871] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f24d6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f24d6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f24d6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.871] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.871] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300863" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300863")) returned 1 [0231.872] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 1 [0231.872] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.873] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6998*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6998*, lpNumberOfBytesWritten=0x18fdb8*=0x1f10, lpOverlapped=0x0) returned 1 [0231.874] CloseHandle (hObject=0xe0) returned 1 [0231.874] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.876] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1146 [0231.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x114e) returned 0x25b528 [0231.876] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1146, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x1146, lpOverlapped=0x0) returned 1 [0231.877] CloseHandle (hObject=0xe0) returned 1 [0231.877] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0 [0231.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.877] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.877] GetTickCount () returned 0x4974f [0231.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.878] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300879\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300879\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.878] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300879\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300879\\....\\temporaryfile")) returned 0 [0231.878] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300879\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300879\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300879\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300879\\temporaryfile")) returned 1 [0231.879] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300879\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f273820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f273820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f273820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.880] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f273820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f273820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f273820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.880] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f273820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f273820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f273820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300879\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f273820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f273820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f273820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.880] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f273820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f273820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f273820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.880] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f273820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f273820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f273820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.880] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.880] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300879\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300879\\temporaryfile")) returned 1 [0231.880] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f273820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f273820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f273820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.880] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.880] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300879" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300879")) returned 1 [0231.880] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 1 [0231.881] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.881] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1150, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1150, lpOverlapped=0x0) returned 1 [0231.882] CloseHandle (hObject=0xe0) returned 1 [0231.882] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.883] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1ed0 [0231.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ed8) returned 0x2b4a70 [0231.883] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1ed0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1ed0, lpOverlapped=0x0) returned 1 [0231.884] CloseHandle (hObject=0xe0) returned 1 [0231.884] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0 [0231.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.884] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.884] GetTickCount () returned 0x4975e [0231.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.885] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.885] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894\\....\\temporaryfile")) returned 0 [0231.886] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894\\temporaryfile")) returned 1 [0231.887] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.887] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.887] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.887] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.887] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.887] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.887] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.887] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894\\temporaryfile")) returned 1 [0231.887] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.887] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.887] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894")) returned 1 [0231.888] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 1 [0231.888] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.888] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6958*, nNumberOfBytesToWrite=0x1ed8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6958*, lpNumberOfBytesWritten=0x18fdb8*=0x1ed8, lpOverlapped=0x0) returned 1 [0231.889] CloseHandle (hObject=0xe0) returned 1 [0231.889] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.890] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x41ca [0231.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x41d2) returned 0x2b4a70 [0231.890] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x41ca, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x41ca, lpOverlapped=0x0) returned 1 [0231.891] CloseHandle (hObject=0xe0) returned 1 [0231.891] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0 [0231.891] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.891] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.892] GetTickCount () returned 0x4975e [0231.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.892] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.893] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894\\....\\temporaryfile")) returned 0 [0231.893] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894\\temporaryfile")) returned 1 [0231.894] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.894] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.894] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.894] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.894] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.894] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.894] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.894] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894\\temporaryfile")) returned 1 [0231.895] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f299980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f299980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f299980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.895] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.895] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300894" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300894")) returned 1 [0231.895] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 1 [0231.895] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.897] WriteFile (in: hFile=0xe0, lpBuffer=0x2b8c58*, nNumberOfBytesToWrite=0x41d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b8c58*, lpNumberOfBytesWritten=0x18fdb8*=0x41d0, lpOverlapped=0x0) returned 1 [0231.898] CloseHandle (hObject=0xe0) returned 1 [0231.898] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.898] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3dd2a [0231.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3dd32) returned 0x2b4a70 [0231.899] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3dd2a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x3dd2a, lpOverlapped=0x0) returned 1 [0231.901] CloseHandle (hObject=0xe0) returned 1 [0231.901] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv")) returned 0 [0231.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.901] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.901] GetTickCount () returned 0x4976e [0231.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.902] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300910\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.902] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300910\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300910\\....\\temporaryfile")) returned 0 [0231.902] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300910\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300910\\temporaryfile")) returned 1 [0231.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300910\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2bfae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2bfae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2bfae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2bfae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2bfae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2bfae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2bfae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2bfae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2bfae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.904] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300910\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2bfae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2bfae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2bfae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.904] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2bfae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2bfae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2bfae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.904] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2bfae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2bfae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2bfae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.904] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300910\\temporaryfile")) returned 1 [0231.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2bfae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2bfae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2bfae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.904] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300910" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300910")) returned 1 [0231.904] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 1 [0231.908] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.909] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x3dd30, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x3dd30, lpOverlapped=0x0) returned 1 [0231.912] CloseHandle (hObject=0xe0) returned 1 [0231.913] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.923] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3fc64 [0231.923] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3fc6c) returned 0x2b4a70 [0231.923] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3fc64, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x3fc64, lpOverlapped=0x0) returned 1 [0231.926] CloseHandle (hObject=0xe0) returned 1 [0231.926] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv")) returned 0 [0231.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.927] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.927] GetTickCount () returned 0x4977d [0231.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.927] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300925\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300925\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.928] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300925\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300925\\....\\temporaryfile")) returned 0 [0231.928] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300925\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300925\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300925\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300925\\temporaryfile")) returned 1 [0231.929] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300925\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2e5c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f30bda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f30bda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.930] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2e5c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f30bda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f30bda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.930] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2e5c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2e5c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2e5c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.930] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300925\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2e5c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2e5c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2e5c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.930] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2e5c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2e5c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2e5c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.930] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2e5c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2e5c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2e5c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.930] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300925\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300925\\temporaryfile")) returned 1 [0231.930] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f2e5c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f2e5c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f2e5c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.930] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300925" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300925")) returned 1 [0231.930] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 1 [0231.934] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.935] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x3fc68, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x3fc68, lpOverlapped=0x0) returned 1 [0231.941] CloseHandle (hObject=0xe0) returned 1 [0231.941] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0231.941] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2a8a [0231.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc2a92) returned 0x1d70020 [0231.942] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xc2a8a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0xc2a8a, lpOverlapped=0x0) returned 1 [0231.969] CloseHandle (hObject=0xe0) returned 1 [0231.969] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv")) returned 0 [0231.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0231.969] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0231.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0231.969] GetTickCount () returned 0x497ac [0231.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0231.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0231.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0231.970] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300972\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300972\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0231.970] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300972\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300972\\....\\temporaryfile")) returned 0 [0231.970] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300972\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300972\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300972\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300972\\temporaryfile")) returned 1 [0231.972] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300972\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f358060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f358060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f358060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0231.972] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f358060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f358060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f358060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.972] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f358060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f358060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f358060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0231.972] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300972\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f358060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f358060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f358060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0231.972] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f358060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f358060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f358060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0231.972] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f358060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f358060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f358060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0231.972] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0231.972] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300972\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300972\\temporaryfile")) returned 1 [0231.972] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f358060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f358060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f358060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0231.972] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0231.972] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18300972" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18300972")) returned 1 [0231.973] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 1 [0232.173] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.177] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xc2a90, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0xc2a90, lpOverlapped=0x0) returned 1 [0232.199] CloseHandle (hObject=0xe0) returned 1 [0232.206] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.207] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xd43ca [0232.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd43d2) returned 0x2250020 [0232.207] ReadFile (in: hFile=0xe0, lpBuffer=0x2250028, nNumberOfBytesToRead=0xd43ca, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdd0*=0xd43ca, lpOverlapped=0x0) returned 1 [0232.227] CloseHandle (hObject=0xe0) returned 1 [0232.227] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv")) returned 0 [0232.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.227] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.227] GetTickCount () returned 0x498b5 [0232.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.228] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301237\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301237\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.228] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301237\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301237\\....\\temporaryfile")) returned 0 [0232.229] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301237\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301237\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301237\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301237\\temporaryfile")) returned 1 [0232.230] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301237\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f5df7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f5df7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f5df7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.230] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f5df7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f5df7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f5df7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.230] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f5df7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f5df7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f5df7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.230] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301237\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f5df7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f5df7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f5df7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.230] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f5df7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f5df7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f5df7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.230] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f5df7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f5df7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f5df7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.231] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.231] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301237\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301237\\temporaryfile")) returned 1 [0232.231] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f5df7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f5df7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f5df7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.231] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.231] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301237" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301237")) returned 1 [0232.231] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 1 [0232.277] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.278] WriteFile (in: hFile=0xe0, lpBuffer=0x2730028*, nNumberOfBytesToWrite=0xd43d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2730028*, lpNumberOfBytesWritten=0x18fdb8*=0xd43d0, lpOverlapped=0x0) returned 1 [0232.291] CloseHandle (hObject=0xe0) returned 1 [0232.299] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.299] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe3dca [0232.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe3dd2) returned 0x2250020 [0232.300] ReadFile (in: hFile=0xe0, lpBuffer=0x2250028, nNumberOfBytesToRead=0xe3dca, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdd0*=0xe3dca, lpOverlapped=0x0) returned 1 [0232.318] CloseHandle (hObject=0xe0) returned 1 [0232.318] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv")) returned 0 [0232.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.319] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.319] GetTickCount () returned 0x49913 [0232.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.319] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301331\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301331\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.320] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301331\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301331\\....\\temporaryfile")) returned 0 [0232.320] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301331\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301331\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301331\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301331\\temporaryfile")) returned 1 [0232.322] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301331\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f6c4000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f6c4000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f6c4000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.322] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f6c4000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f6c4000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f6c4000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.322] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f6c4000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f6c4000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f6c4000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.322] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301331\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f6c4000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f6c4000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f6c4000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.322] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f6c4000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f6c4000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f6c4000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.322] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f6c4000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f6c4000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f6c4000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.322] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.322] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301331\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301331\\temporaryfile")) returned 1 [0232.322] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f6c4000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f6c4000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f6c4000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.322] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.322] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301331" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301331")) returned 1 [0232.323] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 1 [0232.382] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.383] WriteFile (in: hFile=0xe0, lpBuffer=0x2740028*, nNumberOfBytesToWrite=0xe3dd0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2740028*, lpNumberOfBytesWritten=0x18fdb8*=0xe3dd0, lpOverlapped=0x0) returned 1 [0232.396] CloseHandle (hObject=0xe0) returned 1 [0232.404] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.406] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xf188a [0232.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf1892) returned 0x2250020 [0232.406] ReadFile (in: hFile=0xe0, lpBuffer=0x2250028, nNumberOfBytesToRead=0xf188a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fdd0*=0xf188a, lpOverlapped=0x0) returned 1 [0232.425] CloseHandle (hObject=0xe0) returned 1 [0232.425] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv")) returned 0 [0232.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.425] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.426] GetTickCount () returned 0x49971 [0232.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.426] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301425\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301425\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.427] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301425\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301425\\....\\temporaryfile")) returned 0 [0232.427] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301425\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301425\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301425\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301425\\temporaryfile")) returned 1 [0232.428] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301425\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f7a8840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f7a8840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f7a8840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.429] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f7a8840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f7a8840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f7a8840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.429] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f7a8840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f7a8840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f7a8840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.429] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301425\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f7a8840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f7a8840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f7a8840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.429] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f7a8840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f7a8840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f7a8840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.429] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f7a8840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f7a8840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f7a8840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.429] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301425\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301425\\temporaryfile")) returned 1 [0232.429] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f7a8840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f7a8840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f7a8840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.429] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301425" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301425")) returned 1 [0232.429] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv") returned 1 [0232.490] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.491] WriteFile (in: hFile=0xe0, lpBuffer=0x2750028*, nNumberOfBytesToWrite=0xf1890, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2750028*, lpNumberOfBytesWritten=0x18fdb8*=0xf1890, lpOverlapped=0x0) returned 1 [0232.506] CloseHandle (hObject=0xe0) returned 1 [0232.514] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.514] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8f866f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f866f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0232.514] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.515] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa11287e6, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.516] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa11287e6, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0232.516] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa11287e6, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0232.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdf0 [0232.517] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.517] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0232.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0232.517] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0232.519] CloseHandle (hObject=0xe0) returned 1 [0232.519] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png")) returned 0 [0232.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.519] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.519] GetTickCount () returned 0x499ce [0232.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.520] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301518\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301518\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.520] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301518\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301518\\....\\temporaryfile")) returned 0 [0232.520] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301518\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301518\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301518\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301518\\temporaryfile")) returned 1 [0232.522] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301518\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f88d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f88d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f88d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.522] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f88d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f88d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f88d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.522] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f88d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f88d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f88d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.522] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301518\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f88d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f88d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f88d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.522] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f88d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f88d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f88d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.522] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f88d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f88d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f88d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.522] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.522] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301518\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301518\\temporaryfile")) returned 1 [0232.522] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f88d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f88d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f88d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.522] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.523] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301518" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301518")) returned 1 [0232.523] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png") returned 1 [0232.523] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.524] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0232.525] CloseHandle (hObject=0xe0) returned 1 [0232.525] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.525] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0232.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0232.525] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0232.527] CloseHandle (hObject=0xe0) returned 1 [0232.527] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png")) returned 0 [0232.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.527] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.527] GetTickCount () returned 0x499de [0232.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.528] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.528] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534\\....\\temporaryfile")) returned 0 [0232.528] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534\\temporaryfile")) returned 1 [0232.530] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.530] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.530] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.530] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.530] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.530] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.530] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.530] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534\\temporaryfile")) returned 1 [0232.530] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.530] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.530] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534")) returned 1 [0232.530] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 1 [0232.531] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.531] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0232.532] CloseHandle (hObject=0xe0) returned 1 [0232.532] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.533] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0232.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0232.533] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0232.534] CloseHandle (hObject=0xe0) returned 1 [0232.534] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png")) returned 0 [0232.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.534] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.534] GetTickCount () returned 0x499de [0232.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.535] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.536] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534\\....\\temporaryfile")) returned 0 [0232.536] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534\\temporaryfile")) returned 1 [0232.537] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.537] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.537] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.537] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.537] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.538] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.538] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.538] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534\\temporaryfile")) returned 1 [0232.538] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8b31e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8b31e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8b31e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.538] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.538] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301534" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301534")) returned 1 [0232.538] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png") returned 1 [0232.538] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.539] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0232.540] CloseHandle (hObject=0xe0) returned 1 [0232.540] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.540] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0232.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0232.541] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0232.542] CloseHandle (hObject=0xe0) returned 1 [0232.542] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png")) returned 0 [0232.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.542] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.542] GetTickCount () returned 0x499ed [0232.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.543] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.543] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549\\....\\temporaryfile")) returned 0 [0232.543] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549\\temporaryfile")) returned 1 [0232.545] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.545] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.545] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.545] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.545] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.545] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.545] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.545] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549\\temporaryfile")) returned 1 [0232.545] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.545] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.545] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549")) returned 1 [0232.546] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png") returned 1 [0232.546] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.546] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0232.547] CloseHandle (hObject=0xe0) returned 1 [0232.547] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.548] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0232.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0232.548] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0232.549] CloseHandle (hObject=0xe0) returned 1 [0232.549] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png")) returned 0 [0232.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.549] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.549] GetTickCount () returned 0x499ed [0232.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.550] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.551] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549\\....\\temporaryfile")) returned 0 [0232.551] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549\\temporaryfile")) returned 1 [0232.552] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.552] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.552] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.552] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.552] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.553] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.553] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.553] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549\\temporaryfile")) returned 1 [0232.553] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8d9340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8d9340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8d9340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.553] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.553] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301549" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301549")) returned 1 [0232.553] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png") returned 1 [0232.553] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.554] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0232.555] CloseHandle (hObject=0xe0) returned 1 [0232.555] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.555] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0232.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0232.556] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0232.557] CloseHandle (hObject=0xe0) returned 1 [0232.557] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png")) returned 0 [0232.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.557] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.557] GetTickCount () returned 0x499fd [0232.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.561] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.561] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565\\....\\temporaryfile")) returned 0 [0232.561] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565\\temporaryfile")) returned 1 [0232.562] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8ff4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8ff4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8ff4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.562] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8ff4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8ff4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8ff4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.563] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8ff4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8ff4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8ff4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.563] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8ff4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8ff4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8ff4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.563] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8ff4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8ff4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8ff4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.563] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8ff4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8ff4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8ff4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.563] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.563] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565\\temporaryfile")) returned 1 [0232.563] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8ff4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f8ff4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f8ff4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.563] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.563] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565")) returned 1 [0232.563] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png") returned 1 [0232.564] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.564] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0232.565] CloseHandle (hObject=0xe0) returned 1 [0232.565] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.566] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0232.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0232.566] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0232.567] CloseHandle (hObject=0xe0) returned 1 [0232.567] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png")) returned 0 [0232.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.567] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.567] GetTickCount () returned 0x499fd [0232.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.568] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.568] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565\\....\\temporaryfile")) returned 0 [0232.569] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565\\temporaryfile")) returned 1 [0232.570] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8ff4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.570] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f8ff4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.570] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.570] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.570] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.570] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.570] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.570] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565\\temporaryfile")) returned 1 [0232.570] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.570] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.571] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301565" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301565")) returned 1 [0232.571] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png") returned 1 [0232.571] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.571] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0232.572] CloseHandle (hObject=0xe0) returned 1 [0232.572] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.573] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0232.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0232.573] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0232.574] CloseHandle (hObject=0xe0) returned 1 [0232.574] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png")) returned 0 [0232.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.574] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.575] GetTickCount () returned 0x49a0d [0232.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.575] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.576] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581\\....\\temporaryfile")) returned 0 [0232.576] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581\\temporaryfile")) returned 1 [0232.577] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.577] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.577] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.577] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.577] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.577] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.577] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.577] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581\\temporaryfile")) returned 1 [0232.577] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.578] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581")) returned 1 [0232.578] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png") returned 1 [0232.578] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.578] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0232.579] CloseHandle (hObject=0xe0) returned 1 [0232.579] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.580] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5e02 [0232.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5e0a) returned 0x2b4a70 [0232.580] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5e02, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x5e02, lpOverlapped=0x0) returned 1 [0232.581] CloseHandle (hObject=0xe0) returned 1 [0232.581] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png")) returned 0 [0232.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0232.582] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.582] GetTickCount () returned 0x49a0d [0232.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.582] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581\\...."), lpSecurityAttributes=0x256198) returned 1 [0232.583] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581\\....\\temporaryfile")) returned 0 [0232.583] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581\\temporaryfile")) returned 1 [0232.584] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.584] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.584] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.584] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.584] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.584] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.584] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.585] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581\\temporaryfile")) returned 1 [0232.585] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f925600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.585] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.585] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301581" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301581")) returned 1 [0232.585] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png") returned 1 [0232.585] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.587] WriteFile (in: hFile=0xe0, lpBuffer=0x2ba890*, nNumberOfBytesToWrite=0x5e08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ba890*, lpNumberOfBytesWritten=0x18fdb8*=0x5e08, lpOverlapped=0x0) returned 1 [0232.588] CloseHandle (hObject=0xe0) returned 1 [0232.588] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.588] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb92 [0232.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb9a) returned 0x25f580 [0232.588] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb92, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb92, lpOverlapped=0x0) returned 1 [0232.590] CloseHandle (hObject=0xe0) returned 1 [0232.590] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png")) returned 0 [0232.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.590] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.590] GetTickCount () returned 0x49a1c [0232.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.591] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.591] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596\\....\\temporaryfile")) returned 0 [0232.591] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596\\temporaryfile")) returned 1 [0232.592] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.592] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.592] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.593] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.593] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.593] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.593] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.593] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596\\temporaryfile")) returned 1 [0232.593] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.593] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.593] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596")) returned 1 [0232.593] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png") returned 1 [0232.593] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.594] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb98, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb98, lpOverlapped=0x0) returned 1 [0232.595] CloseHandle (hObject=0xe0) returned 1 [0232.595] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.595] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb70 [0232.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb78) returned 0x25f580 [0232.595] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb70, lpOverlapped=0x0) returned 1 [0232.597] CloseHandle (hObject=0xe0) returned 1 [0232.597] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0 [0232.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0232.597] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.597] GetTickCount () returned 0x49a1c [0232.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.598] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596\\...."), lpSecurityAttributes=0x256198) returned 1 [0232.598] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596\\....\\temporaryfile")) returned 0 [0232.598] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596\\temporaryfile")) returned 1 [0232.604] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.604] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.604] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.604] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.605] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.605] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.605] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.605] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596\\temporaryfile")) returned 1 [0232.605] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f94b760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f94b760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f94b760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.605] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.605] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301596" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301596")) returned 1 [0232.605] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png") returned 1 [0232.605] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.606] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb78, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb78, lpOverlapped=0x0) returned 1 [0232.607] CloseHandle (hObject=0xe0) returned 1 [0232.607] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.607] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbb8 [0232.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbc0) returned 0x25f580 [0232.607] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xbb8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xbb8, lpOverlapped=0x0) returned 1 [0232.609] CloseHandle (hObject=0xe0) returned 1 [0232.609] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0 [0232.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.609] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.609] GetTickCount () returned 0x49a2c [0232.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.609] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301612\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301612\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.610] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301612\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301612\\....\\temporaryfile")) returned 0 [0232.610] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301612\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301612\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301612\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301612\\temporaryfile")) returned 1 [0232.611] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301612\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9718c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9718c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9718c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.611] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9718c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9718c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9718c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.611] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9718c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9718c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9718c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.611] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301612\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9718c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9718c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9718c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.612] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9718c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9718c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9718c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.612] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9718c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9718c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9718c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.612] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.612] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301612\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301612\\temporaryfile")) returned 1 [0232.612] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9718c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9718c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9718c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.612] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.612] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301612" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301612")) returned 1 [0232.612] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png") returned 1 [0232.612] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.613] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xbc0, lpOverlapped=0x0) returned 1 [0232.614] CloseHandle (hObject=0xe0) returned 1 [0232.614] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.614] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8f9718c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9718c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0232.614] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.614] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f38039d, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.616] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f38039d, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0232.616] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x9f38039d, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0232.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdb0 [0232.616] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.617] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0232.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0232.617] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0232.618] CloseHandle (hObject=0xe0) returned 1 [0232.618] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0 [0232.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.618] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.618] GetTickCount () returned 0x49a3b [0232.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.619] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.619] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627\\....\\temporaryfile")) returned 0 [0232.619] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627\\temporaryfile")) returned 1 [0232.620] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.620] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.621] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.621] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.621] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.621] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.621] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.621] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627\\temporaryfile")) returned 1 [0232.621] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.621] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.621] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627")) returned 1 [0232.621] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png") returned 1 [0232.622] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.622] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0232.623] CloseHandle (hObject=0xe0) returned 1 [0232.623] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.623] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1928 [0232.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1930) returned 0x2b4a70 [0232.624] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1928, lpOverlapped=0x0) returned 1 [0232.625] CloseHandle (hObject=0xe0) returned 1 [0232.625] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0 [0232.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.625] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.625] GetTickCount () returned 0x49a3b [0232.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.626] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.626] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627\\....\\temporaryfile")) returned 0 [0232.626] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627\\temporaryfile")) returned 1 [0232.627] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.628] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.628] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.628] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.628] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.628] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.628] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.628] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627\\temporaryfile")) returned 1 [0232.628] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f997a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f997a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f997a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.628] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.628] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301627" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301627")) returned 1 [0232.628] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png") returned 1 [0232.629] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.629] WriteFile (in: hFile=0xe0, lpBuffer=0x2b63b0*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b63b0*, lpNumberOfBytesWritten=0x18fdb8*=0x1930, lpOverlapped=0x0) returned 1 [0232.631] CloseHandle (hObject=0xe0) returned 1 [0232.631] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.632] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb05 [0232.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0d) returned 0x25f580 [0232.632] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb05, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb05, lpOverlapped=0x0) returned 1 [0232.633] CloseHandle (hObject=0xe0) returned 1 [0232.633] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0 [0232.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0232.633] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.634] GetTickCount () returned 0x49a4b [0232.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0232.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.634] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643\\...."), lpSecurityAttributes=0x256228) returned 1 [0232.634] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643\\....\\temporaryfile")) returned 0 [0232.635] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643\\temporaryfile")) returned 1 [0232.636] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.636] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.636] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.636] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.636] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.636] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.636] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.636] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643\\temporaryfile")) returned 1 [0232.636] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.636] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.636] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643")) returned 1 [0232.637] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned 1 [0232.637] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.637] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb10, lpOverlapped=0x0) returned 1 [0232.638] CloseHandle (hObject=0xe0) returned 1 [0232.638] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.639] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x15f4 [0232.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15fc) returned 0x2b4a70 [0232.639] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x15f4, lpOverlapped=0x0) returned 1 [0232.640] CloseHandle (hObject=0xe0) returned 1 [0232.640] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0 [0232.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.640] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.640] GetTickCount () returned 0x49a4b [0232.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.641] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.641] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643\\....\\temporaryfile")) returned 0 [0232.642] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643\\temporaryfile")) returned 1 [0232.643] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.643] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.643] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.643] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.643] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.643] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.643] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.643] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643\\temporaryfile")) returned 1 [0232.643] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9bdb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9bdb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9bdb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.643] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.643] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301643" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301643")) returned 1 [0232.644] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned 1 [0232.644] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.644] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6080*, nNumberOfBytesToWrite=0x15f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6080*, lpNumberOfBytesWritten=0x18fdb8*=0x15f8, lpOverlapped=0x0) returned 1 [0232.645] CloseHandle (hObject=0xe0) returned 1 [0232.645] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.646] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0232.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0232.646] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0232.647] CloseHandle (hObject=0xe0) returned 1 [0232.647] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0 [0232.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.647] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.648] GetTickCount () returned 0x49a5b [0232.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.648] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.648] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659\\....\\temporaryfile")) returned 0 [0232.649] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659\\temporaryfile")) returned 1 [0232.650] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.650] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.650] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.650] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.650] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.650] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.650] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.650] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659\\temporaryfile")) returned 1 [0232.650] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.650] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.650] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659")) returned 1 [0232.651] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 1 [0232.651] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.651] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0232.652] CloseHandle (hObject=0xe0) returned 1 [0232.652] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.653] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0232.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0232.653] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0232.654] CloseHandle (hObject=0xe0) returned 1 [0232.654] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0 [0232.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.654] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.655] GetTickCount () returned 0x49a5b [0232.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.655] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.656] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659\\....\\temporaryfile")) returned 0 [0232.656] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659\\temporaryfile")) returned 1 [0232.657] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.657] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.657] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.657] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.657] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.657] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.657] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.657] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659\\temporaryfile")) returned 1 [0232.658] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8f9e3ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8f9e3ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8f9e3ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.658] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.658] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301659" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301659")) returned 1 [0232.658] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 1 [0232.658] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.659] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0232.659] CloseHandle (hObject=0xe0) returned 1 [0232.660] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.660] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0232.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0232.660] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0232.662] CloseHandle (hObject=0xe0) returned 1 [0232.662] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0 [0232.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.662] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.662] GetTickCount () returned 0x49a6a [0232.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.662] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.663] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\....\\temporaryfile")) returned 0 [0232.663] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\temporaryfile")) returned 1 [0232.664] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.664] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.664] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.664] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.664] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.664] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.664] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.664] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\temporaryfile")) returned 1 [0232.665] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.665] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.665] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674")) returned 1 [0232.665] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 1 [0232.665] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.666] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0232.666] CloseHandle (hObject=0xe0) returned 1 [0232.667] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.667] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0232.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0232.667] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0232.668] CloseHandle (hObject=0xe0) returned 1 [0232.668] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0 [0232.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.669] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.669] GetTickCount () returned 0x49a6a [0232.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.669] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.670] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\....\\temporaryfile")) returned 0 [0232.670] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\temporaryfile")) returned 1 [0232.671] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.671] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.671] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.671] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.671] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.671] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.671] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.671] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\temporaryfile")) returned 1 [0232.672] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.672] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.672] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674")) returned 1 [0232.672] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 1 [0232.672] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.673] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0232.673] CloseHandle (hObject=0xe0) returned 1 [0232.674] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.674] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0232.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0232.674] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0232.675] CloseHandle (hObject=0xe0) returned 1 [0232.675] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0 [0232.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.676] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.676] GetTickCount () returned 0x49a6a [0232.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.676] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.680] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\....\\temporaryfile")) returned 0 [0232.680] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\temporaryfile")) returned 1 [0232.681] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa2ffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa2ffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.681] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa2ffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa2ffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.681] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.681] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.681] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.681] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.682] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.682] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674\\temporaryfile")) returned 1 [0232.682] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa09e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa09e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa09e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.682] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.682] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301674" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301674")) returned 1 [0232.682] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 1 [0232.682] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.683] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0232.684] CloseHandle (hObject=0xe0) returned 1 [0232.685] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.685] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0232.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0232.685] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0232.686] CloseHandle (hObject=0xe0) returned 1 [0232.686] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0 [0232.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.687] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.687] GetTickCount () returned 0x49a7a [0232.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0232.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.687] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301690\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301690\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.688] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301690\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301690\\....\\temporaryfile")) returned 0 [0232.688] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301690\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301690\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301690\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301690\\temporaryfile")) returned 1 [0232.689] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301690\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa2ffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa2ffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa2ffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.689] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa2ffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa2ffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa2ffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.689] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa2ffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa2ffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa2ffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.689] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301690\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa2ffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa2ffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa2ffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.689] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa2ffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa2ffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa2ffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.689] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa2ffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa2ffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa2ffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.689] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.689] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301690\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301690\\temporaryfile")) returned 1 [0232.690] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa2ffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa2ffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa2ffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.690] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.690] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301690" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301690")) returned 1 [0232.690] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 1 [0232.690] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.691] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0232.692] CloseHandle (hObject=0xe0) returned 1 [0232.692] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.693] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6114 [0232.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x611c) returned 0x2b4a70 [0232.693] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6114, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x6114, lpOverlapped=0x0) returned 1 [0232.696] CloseHandle (hObject=0xe0) returned 1 [0232.696] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png")) returned 0 [0232.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0232.696] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.696] GetTickCount () returned 0x49a89 [0232.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0232.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.697] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705\\...."), lpSecurityAttributes=0x256228) returned 1 [0232.697] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705\\....\\temporaryfile")) returned 0 [0232.698] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705\\temporaryfile")) returned 1 [0232.699] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.699] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.699] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.699] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.699] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.699] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.699] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.699] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705\\temporaryfile")) returned 1 [0232.699] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.699] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.699] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705")) returned 1 [0232.699] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 1 [0232.700] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.701] WriteFile (in: hFile=0xe0, lpBuffer=0x2baba0*, nNumberOfBytesToWrite=0x6118, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2baba0*, lpNumberOfBytesWritten=0x18fdb8*=0x6118, lpOverlapped=0x0) returned 1 [0232.702] CloseHandle (hObject=0xe0) returned 1 [0232.702] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.702] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2fcdc [0232.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2fce4) returned 0x2b4a70 [0232.702] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2fcdc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x2fcdc, lpOverlapped=0x0) returned 1 [0232.704] CloseHandle (hObject=0xe0) returned 1 [0232.704] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png")) returned 0 [0232.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.704] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.704] GetTickCount () returned 0x49a89 [0232.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0232.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0232.705] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.706] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705\\....\\temporaryfile")) returned 0 [0232.706] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705\\temporaryfile")) returned 1 [0232.707] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.707] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.707] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.707] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.707] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.707] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.707] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.707] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705\\temporaryfile")) returned 1 [0232.707] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa56100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa56100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa56100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.707] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.708] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301705" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301705")) returned 1 [0232.708] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 1 [0232.711] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.711] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x2fce0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x2fce0, lpOverlapped=0x0) returned 1 [0232.714] CloseHandle (hObject=0xe0) returned 1 [0232.714] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.715] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8fa7c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa7c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0232.715] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.715] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa119af33, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0232.717] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa119af33, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0232.717] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa119af33, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0232.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdf0 [0232.717] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.717] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0232.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0232.718] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0232.719] CloseHandle (hObject=0xe0) returned 1 [0232.719] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png")) returned 0 [0232.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0232.719] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.719] GetTickCount () returned 0x49a99 [0232.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0232.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.720] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301721\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301721\\...."), lpSecurityAttributes=0x256198) returned 1 [0232.720] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301721\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301721\\....\\temporaryfile")) returned 0 [0232.720] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301721\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301721\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301721\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301721\\temporaryfile")) returned 1 [0232.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301721\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa7c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa7c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa7c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.721] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa7c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa7c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa7c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0232.721] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa7c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa7c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa7c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301721\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa7c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa7c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa7c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.722] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa7c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa7c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa7c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.722] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa7c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa7c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa7c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.722] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.722] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301721\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301721\\temporaryfile")) returned 1 [0232.722] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fa7c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fa7c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fa7c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.722] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.722] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301721" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301721")) returned 1 [0232.722] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png") returned 1 [0232.723] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.723] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0232.724] CloseHandle (hObject=0xe0) returned 1 [0232.724] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.725] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb04 [0232.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0c) returned 0x25f580 [0232.725] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb04, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb04, lpOverlapped=0x0) returned 1 [0232.726] CloseHandle (hObject=0xe0) returned 1 [0232.726] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png")) returned 0 [0232.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0232.726] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.726] GetTickCount () returned 0x49aa9 [0232.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0232.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.727] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737\\...."), lpSecurityAttributes=0x256198) returned 1 [0232.728] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737\\....\\temporaryfile")) returned 0 [0232.728] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737\\temporaryfile")) returned 1 [0232.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.729] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.729] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.729] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737\\temporaryfile")) returned 1 [0232.729] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.730] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.730] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737")) returned 1 [0232.730] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 1 [0232.730] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.730] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb08, lpOverlapped=0x0) returned 1 [0232.731] CloseHandle (hObject=0xe0) returned 1 [0232.731] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.732] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x5aaf [0232.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5ab7) returned 0x2b4a70 [0232.733] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5aaf, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x5aaf, lpOverlapped=0x0) returned 1 [0232.734] CloseHandle (hObject=0xe0) returned 1 [0232.734] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png")) returned 0 [0232.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.734] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.734] GetTickCount () returned 0x49aa9 [0232.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0232.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.735] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.736] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737\\....\\temporaryfile")) returned 0 [0232.736] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737\\temporaryfile")) returned 1 [0232.737] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.737] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.737] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.737] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.737] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737\\temporaryfile")) returned 1 [0232.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faa23c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faa23c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faa23c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.737] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301737" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301737")) returned 1 [0232.738] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png") returned 1 [0232.738] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.739] WriteFile (in: hFile=0xe0, lpBuffer=0x2ba538*, nNumberOfBytesToWrite=0x5ab8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ba538*, lpNumberOfBytesWritten=0x18fdb8*=0x5ab8, lpOverlapped=0x0) returned 1 [0232.740] CloseHandle (hObject=0xe0) returned 1 [0232.740] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.741] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x191f [0232.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1927) returned 0x2b4a70 [0232.741] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x191f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x191f, lpOverlapped=0x0) returned 1 [0232.742] CloseHandle (hObject=0xe0) returned 1 [0232.742] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png")) returned 0 [0232.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0232.742] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.742] GetTickCount () returned 0x49ab8 [0232.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0232.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.743] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752\\...."), lpSecurityAttributes=0x256198) returned 1 [0232.743] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752\\....\\temporaryfile")) returned 0 [0232.743] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752\\temporaryfile")) returned 1 [0232.745] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.745] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.745] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.745] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.745] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.745] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.745] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752\\temporaryfile")) returned 1 [0232.745] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.745] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752")) returned 1 [0232.745] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png") returned 1 [0232.746] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.746] WriteFile (in: hFile=0xe0, lpBuffer=0x2b63a8*, nNumberOfBytesToWrite=0x1928, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b63a8*, lpNumberOfBytesWritten=0x18fdb8*=0x1928, lpOverlapped=0x0) returned 1 [0232.747] CloseHandle (hObject=0xe0) returned 1 [0232.747] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.748] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0232.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0232.748] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0232.749] CloseHandle (hObject=0xe0) returned 1 [0232.749] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png")) returned 0 [0232.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.749] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.749] GetTickCount () returned 0x49ab8 [0232.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.750] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.750] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752\\....\\temporaryfile")) returned 0 [0232.751] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752\\temporaryfile")) returned 1 [0232.752] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.752] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.752] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.752] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.752] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.752] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.752] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.752] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752\\temporaryfile")) returned 1 [0232.752] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fac8520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fac8520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fac8520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.752] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.753] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301752" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301752")) returned 1 [0232.753] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png") returned 1 [0232.753] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.753] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0232.754] CloseHandle (hObject=0xe0) returned 1 [0232.754] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.755] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0232.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0232.755] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0232.756] CloseHandle (hObject=0xe0) returned 1 [0232.757] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png")) returned 0 [0232.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.757] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.757] GetTickCount () returned 0x49ac8 [0232.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.757] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.758] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768\\....\\temporaryfile")) returned 0 [0232.758] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768\\temporaryfile")) returned 1 [0232.759] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.759] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.759] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.759] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.759] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.759] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.759] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.759] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768\\temporaryfile")) returned 1 [0232.759] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.760] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.760] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768")) returned 1 [0232.760] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png") returned 1 [0232.760] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.761] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0232.761] CloseHandle (hObject=0xe0) returned 1 [0232.762] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.762] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0232.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0232.762] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0232.763] CloseHandle (hObject=0xe0) returned 1 [0232.763] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png")) returned 0 [0232.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.764] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.764] GetTickCount () returned 0x49ac8 [0232.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.764] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.765] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768\\....\\temporaryfile")) returned 0 [0232.765] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768\\temporaryfile")) returned 1 [0232.766] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.766] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.766] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.766] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.766] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.766] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.766] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.766] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768\\temporaryfile")) returned 1 [0232.767] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8faee680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8faee680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8faee680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.767] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.767] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301768" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301768")) returned 1 [0232.767] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png") returned 1 [0232.767] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.768] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0232.769] CloseHandle (hObject=0xe0) returned 1 [0232.769] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.769] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0232.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0232.769] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0232.771] CloseHandle (hObject=0xe0) returned 1 [0232.771] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png")) returned 0 [0232.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.771] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.771] GetTickCount () returned 0x49ad7 [0232.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.771] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.772] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\....\\temporaryfile")) returned 0 [0232.772] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\temporaryfile")) returned 1 [0232.773] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.773] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.773] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.773] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.773] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.773] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.773] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.773] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\temporaryfile")) returned 1 [0232.774] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.774] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.774] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783")) returned 1 [0232.774] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png") returned 1 [0232.774] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.775] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0232.775] CloseHandle (hObject=0xe0) returned 1 [0232.776] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.776] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0232.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0232.776] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0232.778] CloseHandle (hObject=0xe0) returned 1 [0232.778] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png")) returned 0 [0232.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.778] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.778] GetTickCount () returned 0x49ad7 [0232.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.779] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.779] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\....\\temporaryfile")) returned 0 [0232.779] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\temporaryfile")) returned 1 [0232.780] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.780] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.780] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.780] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.781] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.781] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.781] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.781] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\temporaryfile")) returned 1 [0232.781] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb147e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb147e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb147e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.781] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.781] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783")) returned 1 [0232.781] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png") returned 1 [0232.781] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.783] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0232.784] CloseHandle (hObject=0xe0) returned 1 [0232.784] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.784] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0232.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0232.784] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0232.786] CloseHandle (hObject=0xe0) returned 1 [0232.786] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png")) returned 0 [0232.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.786] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.786] GetTickCount () returned 0x49ad7 [0232.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.787] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.787] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\....\\temporaryfile")) returned 0 [0232.787] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\temporaryfile")) returned 1 [0232.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb3a940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb3a940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb3a940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.788] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb3a940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb3a940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb3a940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.788] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb3a940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb3a940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb3a940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb3a940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb3a940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb3a940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.788] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb3a940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb3a940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb3a940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.788] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb3a940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb3a940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb3a940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.788] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783\\temporaryfile")) returned 1 [0232.789] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb3a940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb3a940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb3a940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.789] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301783" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301783")) returned 1 [0232.789] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png") returned 1 [0232.789] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.790] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0232.790] CloseHandle (hObject=0xe0) returned 1 [0232.791] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.791] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x84ca6 [0232.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x84cae) returned 0x1d70020 [0232.791] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x84ca6, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0x84ca6, lpOverlapped=0x0) returned 1 [0232.809] CloseHandle (hObject=0xe0) returned 1 [0232.809] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv")) returned 0 [0232.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0232.809] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.809] GetTickCount () returned 0x49af7 [0232.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0232.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.810] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301815\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301815\\...."), lpSecurityAttributes=0x256198) returned 1 [0232.810] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301815\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301815\\....\\temporaryfile")) returned 0 [0232.810] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301815\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301815\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301815\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301815\\temporaryfile")) returned 1 [0232.811] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301815\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb60aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb60aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb60aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.811] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb60aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb60aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb60aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.811] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb60aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb60aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb60aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.811] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301815\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb60aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb60aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb60aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.811] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb60aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb60aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb60aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.812] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb60aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb60aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb60aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.812] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.812] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301815\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301815\\temporaryfile")) returned 1 [0232.812] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fb60aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fb60aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fb60aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.812] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.812] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301815" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301815")) returned 1 [0232.812] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv") returned 1 [0232.841] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.844] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x84cb0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0x84cb0, lpOverlapped=0x0) returned 1 [0232.857] CloseHandle (hObject=0xe0) returned 1 [0232.862] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.862] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x84702 [0232.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8470a) returned 0x1d70020 [0232.863] ReadFile (in: hFile=0xe0, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x84702, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdd0*=0x84702, lpOverlapped=0x0) returned 1 [0232.874] CloseHandle (hObject=0xe0) returned 1 [0232.874] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv")) returned 0 [0232.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0232.874] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.874] GetTickCount () returned 0x49b35 [0232.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0232.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.875] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301877\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301877\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0232.875] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301877\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301877\\....\\temporaryfile")) returned 0 [0232.875] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301877\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301877\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301877\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301877\\temporaryfile")) returned 1 [0232.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301877\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fbf9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fbf9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fbf9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.876] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fbf9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fbf9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fbf9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.876] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fbf9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fbf9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fbf9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301877\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fbf9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fbf9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fbf9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.877] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fbf9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fbf9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fbf9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.877] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fbf9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fbf9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fbf9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.877] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0232.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301877\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301877\\temporaryfile")) returned 1 [0232.877] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fbf9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fbf9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fbf9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.877] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301877" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301877")) returned 1 [0232.877] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv") returned 1 [0232.916] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.916] WriteFile (in: hFile=0xe0, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x84708, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdb8*=0x84708, lpOverlapped=0x0) returned 1 [0232.924] CloseHandle (hObject=0xe0) returned 1 [0232.929] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0232.929] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8fc6b440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fc6b440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0232.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0232.929] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0232.930] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f4d7984, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0232.938] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9f4d7984, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0232.938] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x9f4d7984, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0232.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdb0 [0232.938] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.939] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0232.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0232.939] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0232.940] CloseHandle (hObject=0xe0) returned 1 [0232.940] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png")) returned 0 [0232.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0232.941] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.941] GetTickCount () returned 0x49b73 [0232.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0232.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.941] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301939\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301939\\...."), lpSecurityAttributes=0x256228) returned 1 [0232.942] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301939\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301939\\....\\temporaryfile")) returned 0 [0232.942] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301939\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301939\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301939\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301939\\temporaryfile")) returned 1 [0232.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301939\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fc915a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fc915a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fc915a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.943] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fc915a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fc915a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fc915a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0232.943] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fc915a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fc915a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fc915a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301939\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fc915a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fc915a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fc915a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.943] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fc915a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fc915a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fc915a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.943] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fc915a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fc915a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fc915a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.943] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301939\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301939\\temporaryfile")) returned 1 [0232.944] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fc915a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fc915a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fc915a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.944] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301939" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301939")) returned 1 [0232.944] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png") returned 1 [0232.944] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.945] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0232.946] CloseHandle (hObject=0xe0) returned 1 [0232.946] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.946] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb04 [0232.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0c) returned 0x25f580 [0232.946] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb04, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb04, lpOverlapped=0x0) returned 1 [0232.948] CloseHandle (hObject=0xe0) returned 1 [0232.948] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png")) returned 0 [0232.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0232.948] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.948] GetTickCount () returned 0x49b83 [0232.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0232.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.949] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301955\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301955\\...."), lpSecurityAttributes=0x256228) returned 1 [0232.949] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301955\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301955\\....\\temporaryfile")) returned 0 [0232.949] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301955\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301955\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301955\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301955\\temporaryfile")) returned 1 [0232.950] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301955\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcb7700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcb7700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcb7700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.951] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcb7700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcb7700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcb7700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.951] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcb7700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcb7700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcb7700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.951] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301955\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcb7700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcb7700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcb7700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.951] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcb7700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcb7700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcb7700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.951] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcb7700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcb7700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcb7700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.951] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.951] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301955\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301955\\temporaryfile")) returned 1 [0232.951] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcb7700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcb7700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcb7700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.951] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.951] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301955" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301955")) returned 1 [0232.951] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png") returned 1 [0232.952] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.952] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb08, lpOverlapped=0x0) returned 1 [0232.953] CloseHandle (hObject=0xe0) returned 1 [0232.953] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.954] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0232.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0232.954] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0232.958] CloseHandle (hObject=0xe0) returned 1 [0232.958] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png")) returned 0 [0232.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0232.958] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.958] GetTickCount () returned 0x49b93 [0232.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0232.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.959] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\...."), lpSecurityAttributes=0x256228) returned 1 [0232.959] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\....\\temporaryfile")) returned 0 [0232.959] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\temporaryfile")) returned 1 [0232.960] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.960] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.960] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.960] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.961] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.961] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.961] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.961] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\temporaryfile")) returned 1 [0232.961] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.961] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.961] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971")) returned 1 [0232.961] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png") returned 1 [0232.961] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.962] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0232.963] CloseHandle (hObject=0xe0) returned 1 [0232.963] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.963] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0232.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0232.964] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0232.965] CloseHandle (hObject=0xe0) returned 1 [0232.965] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png")) returned 0 [0232.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0232.965] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.965] GetTickCount () returned 0x49b93 [0232.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0232.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.966] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\...."), lpSecurityAttributes=0x256228) returned 1 [0232.966] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\....\\temporaryfile")) returned 0 [0232.967] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\temporaryfile")) returned 1 [0232.968] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.968] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.968] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.968] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.968] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.968] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.968] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.968] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\temporaryfile")) returned 1 [0232.968] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.968] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.968] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971")) returned 1 [0232.969] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png") returned 1 [0232.969] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.969] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0232.970] CloseHandle (hObject=0xe0) returned 1 [0232.970] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.971] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0232.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0232.971] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0232.972] CloseHandle (hObject=0xe0) returned 1 [0232.972] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png")) returned 0 [0232.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0232.972] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.972] GetTickCount () returned 0x49b93 [0232.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0232.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.973] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\...."), lpSecurityAttributes=0x256228) returned 1 [0232.974] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\....\\temporaryfile")) returned 0 [0232.974] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\temporaryfile")) returned 1 [0232.975] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.975] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.975] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.975] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.976] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.976] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.976] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.976] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971\\temporaryfile")) returned 1 [0232.976] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fcdd860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fcdd860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fcdd860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.976] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.976] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301971" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301971")) returned 1 [0232.976] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png") returned 1 [0232.976] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.977] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0232.978] CloseHandle (hObject=0xe0) returned 1 [0232.978] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.978] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0232.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0232.978] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0232.980] CloseHandle (hObject=0xe0) returned 1 [0232.980] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png")) returned 0 [0232.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0232.980] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.980] GetTickCount () returned 0x49ba2 [0232.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0232.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.981] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986\\...."), lpSecurityAttributes=0x256228) returned 1 [0232.981] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986\\....\\temporaryfile")) returned 0 [0232.981] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986\\temporaryfile")) returned 1 [0232.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.983] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.983] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.983] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.983] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.983] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986\\temporaryfile")) returned 1 [0232.983] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.983] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986")) returned 1 [0232.983] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png") returned 1 [0232.984] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.984] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0232.985] CloseHandle (hObject=0xe0) returned 1 [0232.985] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.986] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0232.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0232.986] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0232.987] CloseHandle (hObject=0xe0) returned 1 [0232.987] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png")) returned 0 [0232.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0232.987] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0232.987] GetTickCount () returned 0x49ba2 [0232.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0232.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.988] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986\\...."), lpSecurityAttributes=0x256228) returned 1 [0232.988] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986\\....\\temporaryfile")) returned 0 [0232.989] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986\\temporaryfile")) returned 1 [0232.990] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.990] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.990] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.990] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.990] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.990] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.990] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.990] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986\\temporaryfile")) returned 1 [0232.991] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd039c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd039c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd039c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.991] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.991] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18301986" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18301986")) returned 1 [0232.991] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png") returned 1 [0232.991] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.992] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0232.993] CloseHandle (hObject=0xe0) returned 1 [0232.993] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.993] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0232.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0232.993] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0232.995] CloseHandle (hObject=0xe0) returned 1 [0232.995] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png")) returned 0 [0232.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0232.995] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0232.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0232.995] GetTickCount () returned 0x49bb2 [0232.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0232.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0232.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0232.995] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002\\...."), lpSecurityAttributes=0x256228) returned 1 [0232.996] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002\\....\\temporaryfile")) returned 0 [0232.996] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002\\temporaryfile")) returned 1 [0232.997] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0232.997] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.997] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0232.997] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0232.998] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.998] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0232.998] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0232.998] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002\\temporaryfile")) returned 1 [0232.998] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0232.998] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0232.998] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002")) returned 1 [0232.998] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png") returned 1 [0232.998] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0232.999] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0233.000] CloseHandle (hObject=0xe0) returned 1 [0233.000] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.000] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x547b [0233.000] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5483) returned 0x2b4a70 [0233.000] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x547b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x547b, lpOverlapped=0x0) returned 1 [0233.002] CloseHandle (hObject=0xe0) returned 1 [0233.002] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png")) returned 0 [0233.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.002] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0233.002] GetTickCount () returned 0x49bb2 [0233.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0233.003] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.003] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002\\....\\temporaryfile")) returned 0 [0233.003] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002\\temporaryfile")) returned 1 [0233.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.004] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.005] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.005] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.005] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.005] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.005] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.005] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002\\temporaryfile")) returned 1 [0233.005] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd29b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd29b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd29b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.005] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.005] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302002" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302002")) returned 1 [0233.005] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png") returned 1 [0233.006] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.006] WriteFile (in: hFile=0xe0, lpBuffer=0x2b9f08*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b9f08*, lpNumberOfBytesWritten=0x18fdb8*=0x5480, lpOverlapped=0x0) returned 1 [0233.007] CloseHandle (hObject=0xe0) returned 1 [0233.007] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.008] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0233.008] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.008] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1a65ec8, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0233.009] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1a65ec8, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0233.009] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa1a65ec8, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0233.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdf0 [0233.010] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.010] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0233.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0233.010] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0233.011] CloseHandle (hObject=0xe0) returned 1 [0233.011] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png")) returned 0 [0233.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.012] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0233.012] GetTickCount () returned 0x49bc1 [0233.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.012] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.012] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017\\....\\temporaryfile")) returned 0 [0233.013] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017\\temporaryfile")) returned 1 [0233.014] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.014] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0233.014] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.014] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.014] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.014] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.014] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.014] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017\\temporaryfile")) returned 1 [0233.014] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.014] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.014] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017")) returned 1 [0233.015] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png") returned 1 [0233.015] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.015] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0233.016] CloseHandle (hObject=0xe0) returned 1 [0233.016] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.017] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xca59 [0233.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xca61) returned 0x2b4a70 [0233.017] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xca59, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xca59, lpOverlapped=0x0) returned 1 [0233.019] CloseHandle (hObject=0xe0) returned 1 [0233.019] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png")) returned 0 [0233.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0233.019] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0233.019] GetTickCount () returned 0x49bc1 [0233.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0233.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.020] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017\\...."), lpSecurityAttributes=0x256198) returned 1 [0233.020] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017\\....\\temporaryfile")) returned 0 [0233.021] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017\\temporaryfile")) returned 1 [0233.023] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd75de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd75de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.023] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd75de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd75de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.023] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.023] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.023] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.023] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.023] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017\\temporaryfile")) returned 1 [0233.024] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd4fc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd4fc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd4fc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.024] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.024] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302017" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302017")) returned 1 [0233.024] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png") returned 1 [0233.025] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.025] WriteFile (in: hFile=0xe0, lpBuffer=0x2c14e8*, nNumberOfBytesToWrite=0xca60, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c14e8*, lpNumberOfBytesWritten=0x18fdb8*=0xca60, lpOverlapped=0x0) returned 1 [0233.027] CloseHandle (hObject=0xe0) returned 1 [0233.027] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.027] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0233.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0233.027] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0233.029] CloseHandle (hObject=0xe0) returned 1 [0233.029] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png")) returned 0 [0233.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.029] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.029] GetTickCount () returned 0x49bd1 [0233.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.030] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302033\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302033\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.030] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302033\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302033\\....\\temporaryfile")) returned 0 [0233.030] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302033\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302033\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302033\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302033\\temporaryfile")) returned 1 [0233.031] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302033\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd75de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd75de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd75de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.031] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd75de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd75de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd75de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.031] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd75de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd75de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd75de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.031] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302033\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd75de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd75de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd75de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.031] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd75de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd75de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd75de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.032] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd75de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd75de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd75de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.032] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.032] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302033\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302033\\temporaryfile")) returned 1 [0233.032] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd75de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd75de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd75de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.032] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.032] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302033" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302033")) returned 1 [0233.032] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 1 [0233.032] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.033] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0233.034] CloseHandle (hObject=0xe0) returned 1 [0233.035] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.035] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0233.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0233.035] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0233.037] CloseHandle (hObject=0xe0) returned 1 [0233.037] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png")) returned 0 [0233.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.037] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0233.037] GetTickCount () returned 0x49be1 [0233.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.038] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.038] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049\\....\\temporaryfile")) returned 0 [0233.038] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049\\temporaryfile")) returned 1 [0233.039] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.039] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.039] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.039] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.039] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.039] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.040] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.040] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049\\temporaryfile")) returned 1 [0233.040] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.040] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.040] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049")) returned 1 [0233.040] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 1 [0233.040] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.041] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0233.042] CloseHandle (hObject=0xe0) returned 1 [0233.042] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.042] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0233.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0233.042] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0233.044] CloseHandle (hObject=0xe0) returned 1 [0233.044] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png")) returned 0 [0233.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.044] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.044] GetTickCount () returned 0x49be1 [0233.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.044] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.045] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049\\....\\temporaryfile")) returned 0 [0233.045] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049\\temporaryfile")) returned 1 [0233.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.046] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.046] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.046] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.046] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.047] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049\\temporaryfile")) returned 1 [0233.047] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fd9bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fd9bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fd9bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.047] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302049" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302049")) returned 1 [0233.047] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 1 [0233.047] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.053] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0233.053] CloseHandle (hObject=0xe0) returned 1 [0233.054] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.054] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0233.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0233.054] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0233.055] CloseHandle (hObject=0xe0) returned 1 [0233.055] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0 [0233.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.056] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0233.056] GetTickCount () returned 0x49bf0 [0233.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.056] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.057] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064\\....\\temporaryfile")) returned 0 [0233.057] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064\\temporaryfile")) returned 1 [0233.058] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.058] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.058] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.058] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.058] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.058] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.058] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.058] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064\\temporaryfile")) returned 1 [0233.058] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.058] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.059] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064")) returned 1 [0233.059] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 1 [0233.059] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.059] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0233.060] CloseHandle (hObject=0xe0) returned 1 [0233.060] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.061] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0233.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0233.061] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0233.062] CloseHandle (hObject=0xe0) returned 1 [0233.062] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0 [0233.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.062] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.062] GetTickCount () returned 0x49bf0 [0233.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.063] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.065] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064\\....\\temporaryfile")) returned 0 [0233.065] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064\\temporaryfile")) returned 1 [0233.066] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.066] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.066] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.066] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.066] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.066] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.067] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.067] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064\\temporaryfile")) returned 1 [0233.067] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fdc20a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fdc20a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fdc20a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.067] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.067] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302064" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302064")) returned 1 [0233.067] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 1 [0233.068] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.068] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0233.069] CloseHandle (hObject=0xe0) returned 1 [0233.070] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.070] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0233.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0233.070] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0233.072] CloseHandle (hObject=0xe0) returned 1 [0233.072] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0 [0233.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.072] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0233.072] GetTickCount () returned 0x49c00 [0233.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.072] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.073] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080\\....\\temporaryfile")) returned 0 [0233.073] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080\\temporaryfile")) returned 1 [0233.074] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.074] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.074] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.074] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.074] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.074] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.074] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.074] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080\\temporaryfile")) returned 1 [0233.075] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.075] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.075] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080")) returned 1 [0233.075] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 1 [0233.075] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.076] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0233.076] CloseHandle (hObject=0xe0) returned 1 [0233.077] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.077] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x17719 [0233.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17721) returned 0x2b4a70 [0233.077] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x17719, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x17719, lpOverlapped=0x0) returned 1 [0233.079] CloseHandle (hObject=0xe0) returned 1 [0233.079] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0 [0233.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.079] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.079] GetTickCount () returned 0x49c00 [0233.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.079] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.080] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080\\....\\temporaryfile")) returned 0 [0233.080] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080\\temporaryfile")) returned 1 [0233.081] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.081] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.081] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.082] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.082] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.082] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.082] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.082] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080\\temporaryfile")) returned 1 [0233.082] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fde8200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fde8200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fde8200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.082] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.082] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302080" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302080")) returned 1 [0233.082] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 1 [0233.084] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.084] WriteFile (in: hFile=0xe0, lpBuffer=0x2cc1a8*, nNumberOfBytesToWrite=0x17720, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2cc1a8*, lpNumberOfBytesWritten=0x18fdb8*=0x17720, lpOverlapped=0x0) returned 1 [0233.086] CloseHandle (hObject=0xe0) returned 1 [0233.087] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.087] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb30 [0233.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb38) returned 0x25f580 [0233.087] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb30, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb30, lpOverlapped=0x0) returned 1 [0233.088] CloseHandle (hObject=0xe0) returned 1 [0233.088] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0 [0233.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.089] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.089] GetTickCount () returned 0x49c0f [0233.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.089] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.090] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095\\....\\temporaryfile")) returned 0 [0233.090] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095\\temporaryfile")) returned 1 [0233.091] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.091] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.091] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.091] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.091] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.091] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.091] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.091] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095\\temporaryfile")) returned 1 [0233.092] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.092] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.092] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095")) returned 1 [0233.092] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png") returned 1 [0233.092] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.093] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb38, lpOverlapped=0x0) returned 1 [0233.093] CloseHandle (hObject=0xe0) returned 1 [0233.094] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.094] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x12cf [0233.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12d7) returned 0x25b528 [0233.094] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12cf, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x12cf, lpOverlapped=0x0) returned 1 [0233.096] CloseHandle (hObject=0xe0) returned 1 [0233.096] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0 [0233.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.096] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0233.096] GetTickCount () returned 0x49c0f [0233.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.096] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.097] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095\\....\\temporaryfile")) returned 0 [0233.097] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095\\temporaryfile")) returned 1 [0233.099] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.099] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.099] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.099] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.099] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.099] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.099] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.099] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095\\temporaryfile")) returned 1 [0233.100] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe0e360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe0e360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe0e360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.100] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.100] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302095" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302095")) returned 1 [0233.100] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png") returned 1 [0233.100] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.101] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x12d8, lpOverlapped=0x0) returned 1 [0233.102] CloseHandle (hObject=0xe0) returned 1 [0233.102] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.103] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbd6 [0233.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbde) returned 0x25f580 [0233.103] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xbd6, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xbd6, lpOverlapped=0x0) returned 1 [0233.105] CloseHandle (hObject=0xe0) returned 1 [0233.105] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0 [0233.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.105] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.105] GetTickCount () returned 0x49c1f [0233.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea80 [0233.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.105] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.106] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111\\....\\temporaryfile")) returned 0 [0233.106] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111\\temporaryfile")) returned 1 [0233.107] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.107] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.107] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.107] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.107] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.107] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.108] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.108] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111\\temporaryfile")) returned 1 [0233.108] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.108] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.108] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111")) returned 1 [0233.108] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png") returned 1 [0233.108] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.109] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xbe0, lpOverlapped=0x0) returned 1 [0233.110] CloseHandle (hObject=0xe0) returned 1 [0233.110] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.110] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x12cf [0233.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12d7) returned 0x25b528 [0233.111] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12cf, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x12cf, lpOverlapped=0x0) returned 1 [0233.112] CloseHandle (hObject=0xe0) returned 1 [0233.112] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0 [0233.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.112] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.112] GetTickCount () returned 0x49c1f [0233.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.113] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.113] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111\\....\\temporaryfile")) returned 0 [0233.113] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111\\temporaryfile")) returned 1 [0233.115] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.115] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.115] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.115] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.115] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.115] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.115] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111\\temporaryfile")) returned 1 [0233.115] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe344c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe344c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe344c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.115] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302111" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302111")) returned 1 [0233.116] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png") returned 1 [0233.116] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.116] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x12d8, lpOverlapped=0x0) returned 1 [0233.117] CloseHandle (hObject=0xe0) returned 1 [0233.117] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.118] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbd0 [0233.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbd8) returned 0x25f580 [0233.118] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xbd0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xbd0, lpOverlapped=0x0) returned 1 [0233.119] CloseHandle (hObject=0xe0) returned 1 [0233.119] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0 [0233.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.120] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.120] GetTickCount () returned 0x49c2f [0233.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea80 [0233.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.120] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.121] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127\\....\\temporaryfile")) returned 0 [0233.121] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127\\temporaryfile")) returned 1 [0233.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.122] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.122] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.122] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.122] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.122] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.122] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127\\temporaryfile")) returned 1 [0233.123] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.123] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.123] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127")) returned 1 [0233.123] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png") returned 1 [0233.123] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.124] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xbd8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xbd8, lpOverlapped=0x0) returned 1 [0233.125] CloseHandle (hObject=0xe0) returned 1 [0233.125] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.126] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1302 [0233.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x130a) returned 0x25b528 [0233.126] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1302, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x1302, lpOverlapped=0x0) returned 1 [0233.127] CloseHandle (hObject=0xe0) returned 1 [0233.127] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0 [0233.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.127] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0233.127] GetTickCount () returned 0x49c2f [0233.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.128] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.129] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127\\....\\temporaryfile")) returned 0 [0233.129] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127\\temporaryfile")) returned 1 [0233.130] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.130] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.130] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.130] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.130] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.130] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.130] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.130] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127\\temporaryfile")) returned 1 [0233.131] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe5a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe5a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe5a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.131] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.131] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302127" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302127")) returned 1 [0233.131] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png") returned 1 [0233.131] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.132] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1308, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1308, lpOverlapped=0x0) returned 1 [0233.132] CloseHandle (hObject=0xe0) returned 1 [0233.133] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.134] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbc3 [0233.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbcb) returned 0x25f580 [0233.134] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xbc3, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xbc3, lpOverlapped=0x0) returned 1 [0233.135] CloseHandle (hObject=0xe0) returned 1 [0233.135] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png")) returned 0 [0233.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.135] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.135] GetTickCount () returned 0x49c3e [0233.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea80 [0233.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.136] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.136] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142\\....\\temporaryfile")) returned 0 [0233.137] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142\\temporaryfile")) returned 1 [0233.138] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.138] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.138] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.138] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.138] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.138] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.138] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.138] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142\\temporaryfile")) returned 1 [0233.139] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.139] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.139] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142")) returned 1 [0233.139] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png") returned 1 [0233.139] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.140] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xbc8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xbc8, lpOverlapped=0x0) returned 1 [0233.140] CloseHandle (hObject=0xe0) returned 1 [0233.141] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.141] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4aa8 [0233.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4ab0) returned 0x2b4a70 [0233.141] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4aa8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4aa8, lpOverlapped=0x0) returned 1 [0233.143] CloseHandle (hObject=0xe0) returned 1 [0233.143] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png")) returned 0 [0233.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.143] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.143] GetTickCount () returned 0x49c3e [0233.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.143] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.144] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142\\....\\temporaryfile")) returned 0 [0233.144] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142\\temporaryfile")) returned 1 [0233.145] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.146] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.146] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.146] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.146] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.146] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.146] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.146] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142\\temporaryfile")) returned 1 [0233.146] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fe80780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fe80780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fe80780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.146] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.146] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302142" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302142")) returned 1 [0233.146] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png") returned 1 [0233.147] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.147] WriteFile (in: hFile=0xe0, lpBuffer=0x2b9530*, nNumberOfBytesToWrite=0x4ab0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b9530*, lpNumberOfBytesWritten=0x18fdb8*=0x4ab0, lpOverlapped=0x0) returned 1 [0233.148] CloseHandle (hObject=0xe0) returned 1 [0233.148] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.149] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1917 [0233.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x191f) returned 0x2b4a70 [0233.149] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1917, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1917, lpOverlapped=0x0) returned 1 [0233.152] CloseHandle (hObject=0xe0) returned 1 [0233.153] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png")) returned 0 [0233.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.153] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.153] GetTickCount () returned 0x49c4e [0233.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.153] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302158\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302158\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.154] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302158\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302158\\....\\temporaryfile")) returned 0 [0233.154] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302158\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302158\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302158\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302158\\temporaryfile")) returned 1 [0233.155] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302158\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fea68e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fea68e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fea68e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.155] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fea68e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fea68e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fea68e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.155] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fea68e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fea68e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fea68e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.155] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302158\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fea68e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fea68e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fea68e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.155] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fea68e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fea68e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fea68e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.155] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fea68e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fea68e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fea68e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.155] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.155] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302158\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302158\\temporaryfile")) returned 1 [0233.156] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fea68e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fea68e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fea68e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.156] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.156] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302158" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302158")) returned 1 [0233.156] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png") returned 1 [0233.156] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.157] WriteFile (in: hFile=0xe0, lpBuffer=0x2b63a0*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b63a0*, lpNumberOfBytesWritten=0x18fdb8*=0x1920, lpOverlapped=0x0) returned 1 [0233.157] CloseHandle (hObject=0xe0) returned 1 [0233.158] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.158] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x296fa [0233.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x29702) returned 0x2b4a70 [0233.158] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x296fa, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x296fa, lpOverlapped=0x0) returned 1 [0233.161] CloseHandle (hObject=0xe0) returned 1 [0233.161] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png")) returned 0 [0233.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.161] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.161] GetTickCount () returned 0x49c5d [0233.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.162] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.162] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173\\....\\temporaryfile")) returned 0 [0233.162] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173\\temporaryfile")) returned 1 [0233.163] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fecca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fecca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fecca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.163] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fecca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fecca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fecca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.163] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fecca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fecca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fecca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.163] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fecca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fecca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fecca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fecca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fecca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fecca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fecca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fecca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fecca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.164] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0233.164] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173\\temporaryfile")) returned 1 [0233.164] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fecca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fecca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fecca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.164] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.164] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173")) returned 1 [0233.164] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png") returned 1 [0233.167] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.167] WriteFile (in: hFile=0xe0, lpBuffer=0x2de188*, nNumberOfBytesToWrite=0x29700, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2de188*, lpNumberOfBytesWritten=0x18fdb8*=0x29700, lpOverlapped=0x0) returned 1 [0233.171] CloseHandle (hObject=0xe0) returned 1 [0233.171] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0233.171] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8fecca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fecca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0233.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0233.172] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0233.172] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9fdc8b88, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0233.173] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9fdc8b88, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0233.173] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x9fdc8b88, dwReserved1=0x1cbf8eb, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0233.173] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15) returned 0x25cdf0 [0233.174] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.174] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb5e [0233.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb66) returned 0x25f580 [0233.174] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb5e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb5e, lpOverlapped=0x0) returned 1 [0233.175] CloseHandle (hObject=0xe0) returned 1 [0233.175] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png")) returned 0 [0233.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0233.176] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.176] GetTickCount () returned 0x49c5d [0233.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0233.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.176] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173\\...."), lpSecurityAttributes=0x256228) returned 1 [0233.177] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173\\....\\temporaryfile")) returned 0 [0233.177] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173\\temporaryfile")) returned 1 [0233.178] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fecca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.178] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fecca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0233.178] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.178] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.178] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.178] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.178] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.178] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173\\temporaryfile")) returned 1 [0233.179] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.179] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.179] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302173" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302173")) returned 1 [0233.184] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png") returned 1 [0233.184] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.184] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb68, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb68, lpOverlapped=0x0) returned 1 [0233.185] CloseHandle (hObject=0xe0) returned 1 [0233.185] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.186] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x120d [0233.187] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1215) returned 0x25b528 [0233.187] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x120d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x120d, lpOverlapped=0x0) returned 1 [0233.188] CloseHandle (hObject=0xe0) returned 1 [0233.188] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png")) returned 0 [0233.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.188] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.188] GetTickCount () returned 0x49c6d [0233.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.189] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302189\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302189\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.189] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302189\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302189\\....\\temporaryfile")) returned 0 [0233.190] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302189\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302189\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302189\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302189\\temporaryfile")) returned 1 [0233.190] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302189\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.191] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.191] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.191] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302189\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.191] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.191] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.191] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.191] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302189\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302189\\temporaryfile")) returned 1 [0233.191] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8fef2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8fef2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8fef2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.191] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.191] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302189" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302189")) returned 1 [0233.191] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png") returned 1 [0233.192] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.192] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1218, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1218, lpOverlapped=0x0) returned 1 [0233.193] CloseHandle (hObject=0xe0) returned 1 [0233.193] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.194] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6d3c [0233.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6d44) returned 0x2b4a70 [0233.194] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6d3c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x6d3c, lpOverlapped=0x0) returned 1 [0233.196] CloseHandle (hObject=0xe0) returned 1 [0233.196] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png")) returned 0 [0233.196] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0233.196] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.196] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.196] GetTickCount () returned 0x49c7d [0233.196] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0233.196] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.197] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205\\...."), lpSecurityAttributes=0x256228) returned 1 [0233.197] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205\\....\\temporaryfile")) returned 0 [0233.197] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205\\temporaryfile")) returned 1 [0233.198] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.198] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.198] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.198] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.198] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.198] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.198] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.199] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205\\temporaryfile")) returned 1 [0233.199] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.199] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.199] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205")) returned 1 [0233.199] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png") returned 1 [0233.200] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.200] WriteFile (in: hFile=0xe0, lpBuffer=0x2bb7c8*, nNumberOfBytesToWrite=0x6d40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bb7c8*, lpNumberOfBytesWritten=0x18fdb8*=0x6d40, lpOverlapped=0x0) returned 1 [0233.201] CloseHandle (hObject=0xe0) returned 1 [0233.202] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.202] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xba2 [0233.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbaa) returned 0x25f580 [0233.202] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xba2, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xba2, lpOverlapped=0x0) returned 1 [0233.203] CloseHandle (hObject=0xe0) returned 1 [0233.204] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png")) returned 0 [0233.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.204] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.204] GetTickCount () returned 0x49c7d [0233.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0233.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.204] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.205] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205\\....\\temporaryfile")) returned 0 [0233.205] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205\\temporaryfile")) returned 1 [0233.206] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.206] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.206] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.206] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.206] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.206] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.207] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.207] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205\\temporaryfile")) returned 1 [0233.207] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff18d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff18d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff18d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.207] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.207] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302205" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302205")) returned 1 [0233.207] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png") returned 1 [0233.208] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.208] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xba8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xba8, lpOverlapped=0x0) returned 1 [0233.209] CloseHandle (hObject=0xe0) returned 1 [0233.210] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.210] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xee0 [0233.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xee8) returned 0x25f580 [0233.210] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xee0, lpOverlapped=0x0) returned 1 [0233.212] CloseHandle (hObject=0xe0) returned 1 [0233.212] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png")) returned 0 [0233.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.212] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.212] GetTickCount () returned 0x49c8c [0233.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0233.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.213] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.213] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220\\....\\temporaryfile")) returned 0 [0233.213] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220\\temporaryfile")) returned 1 [0233.214] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.214] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.214] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.214] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.214] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.214] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.214] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.215] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220\\temporaryfile")) returned 1 [0233.215] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.215] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.215] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220")) returned 1 [0233.215] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png") returned 1 [0233.215] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.218] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xee8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xee8, lpOverlapped=0x0) returned 1 [0233.219] CloseHandle (hObject=0xe0) returned 1 [0233.219] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.220] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xee2 [0233.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xeea) returned 0x25f580 [0233.220] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xee2, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xee2, lpOverlapped=0x0) returned 1 [0233.221] CloseHandle (hObject=0xe0) returned 1 [0233.221] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png")) returned 0 [0233.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.222] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.222] GetTickCount () returned 0x49c8c [0233.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0233.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.222] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.223] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220\\....\\temporaryfile")) returned 0 [0233.223] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220\\temporaryfile")) returned 1 [0233.224] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.224] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.224] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.224] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.224] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.225] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.225] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.225] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220\\temporaryfile")) returned 1 [0233.225] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff3ee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff3ee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff3ee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.225] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.225] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302220" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302220")) returned 1 [0233.225] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png") returned 1 [0233.225] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.226] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xee8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xee8, lpOverlapped=0x0) returned 1 [0233.227] CloseHandle (hObject=0xe0) returned 1 [0233.227] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.227] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xeeb [0233.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xef3) returned 0x25f580 [0233.227] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xeeb, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xeeb, lpOverlapped=0x0) returned 1 [0233.229] CloseHandle (hObject=0xe0) returned 1 [0233.229] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png")) returned 0 [0233.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.229] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.229] GetTickCount () returned 0x49c9c [0233.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0233.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.229] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.230] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236\\....\\temporaryfile")) returned 0 [0233.230] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236\\temporaryfile")) returned 1 [0233.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.231] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.231] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.231] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.232] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.232] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.232] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236\\temporaryfile")) returned 1 [0233.232] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.232] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.232] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236")) returned 1 [0233.232] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 1 [0233.232] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.233] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xef0, lpOverlapped=0x0) returned 1 [0233.234] CloseHandle (hObject=0xe0) returned 1 [0233.234] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.234] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3d [0233.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc45) returned 0x25f580 [0233.234] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3d, lpOverlapped=0x0) returned 1 [0233.236] CloseHandle (hObject=0xe0) returned 1 [0233.236] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png")) returned 0 [0233.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.236] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.236] GetTickCount () returned 0x49c9c [0233.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0233.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.236] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.237] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236\\....\\temporaryfile")) returned 0 [0233.237] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236\\temporaryfile")) returned 1 [0233.238] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.238] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.239] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.239] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.239] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.239] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.239] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.239] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236\\temporaryfile")) returned 1 [0233.239] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff64fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff64fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff64fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.239] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.239] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302236" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302236")) returned 1 [0233.239] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png") returned 1 [0233.240] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.240] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc48, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc48, lpOverlapped=0x0) returned 1 [0233.241] CloseHandle (hObject=0xe0) returned 1 [0233.241] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.241] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xdbe [0233.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdc6) returned 0x25f580 [0233.242] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xdbe, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xdbe, lpOverlapped=0x0) returned 1 [0233.243] CloseHandle (hObject=0xe0) returned 1 [0233.243] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png")) returned 0 [0233.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.243] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.243] GetTickCount () returned 0x49cab [0233.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0233.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.244] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.245] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251\\....\\temporaryfile")) returned 0 [0233.245] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251\\temporaryfile")) returned 1 [0233.246] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.246] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.247] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.247] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.247] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.247] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.247] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.247] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251\\temporaryfile")) returned 1 [0233.247] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.247] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.247] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251")) returned 1 [0233.248] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png") returned 1 [0233.248] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.249] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xdc8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xdc8, lpOverlapped=0x0) returned 1 [0233.250] CloseHandle (hObject=0xe0) returned 1 [0233.250] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.251] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2f [0233.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc37) returned 0x25f580 [0233.251] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2f, lpOverlapped=0x0) returned 1 [0233.252] CloseHandle (hObject=0xe0) returned 1 [0233.252] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png")) returned 0 [0233.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.252] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.253] GetTickCount () returned 0x49cab [0233.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0233.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.253] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.254] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251\\....\\temporaryfile")) returned 0 [0233.254] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251\\temporaryfile")) returned 1 [0233.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.255] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.255] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.255] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.255] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.255] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.255] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251\\temporaryfile")) returned 1 [0233.256] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ff8b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x8ff8b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x8ff8b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.256] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.256] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302251" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302251")) returned 1 [0233.256] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png") returned 1 [0233.256] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.257] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0233.257] CloseHandle (hObject=0xe0) returned 1 [0233.258] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.258] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x539540 [0233.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x539548) returned 0x2650020 [0233.258] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x539540, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x539540, lpOverlapped=0x0) returned 1 [0233.474] CloseHandle (hObject=0xe0) returned 1 [0233.474] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv")) returned 0 [0233.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0233.474] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0233.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0233.474] GetTickCount () returned 0x49d95 [0233.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0233.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0233.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0233.475] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302485\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302485\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0233.475] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302485\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302485\\....\\temporaryfile")) returned 0 [0233.475] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302485\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302485\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302485\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302485\\temporaryfile")) returned 1 [0233.477] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302485\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x901c65c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x901c65c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x901c65c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0233.477] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x901c65c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x901c65c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x901c65c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.477] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x901c65c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x901c65c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x901c65c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0233.477] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302485\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x901c65c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x901c65c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x901c65c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0233.477] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x901c65c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x901c65c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x901c65c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.477] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x901c65c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x901c65c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x901c65c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0233.477] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0233.477] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302485\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302485\\temporaryfile")) returned 1 [0233.477] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x901c65c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x901c65c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x901c65c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0233.477] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0233.477] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18302485" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18302485")) returned 1 [0233.478] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 1 [0233.807] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.808] WriteFile (in: hFile=0xe0, lpBuffer=0x30d0028*, nNumberOfBytesToWrite=0x539548, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x30d0028*, lpNumberOfBytesWritten=0x18fdb8*=0x539548, lpOverlapped=0x0) returned 1 [0233.907] CloseHandle (hObject=0xe0) returned 1 [0233.953] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0233.954] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x57bbc0 [0233.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x57bbc8) returned 0x2650020 [0233.954] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x57bbc0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x57bbc0, lpOverlapped=0x0) returned 1 [0234.250] CloseHandle (hObject=0xe0) returned 1 [0234.250] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv")) returned 0 [0234.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0234.251] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0234.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0234.251] GetTickCount () returned 0x4a092 [0234.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0234.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0234.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0234.252] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303250\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303250\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0234.252] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303250\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303250\\....\\temporaryfile")) returned 0 [0234.252] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303250\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303250\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303250\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303250\\temporaryfile")) returned 1 [0234.254] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303250\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90910920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90936a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90936a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0234.254] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90910920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90936a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90936a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0234.254] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90910920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90910920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90910920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0234.254] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303250\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90910920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90910920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90910920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0234.254] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90910920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90910920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90910920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0234.254] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90910920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90910920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90910920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0234.254] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0234.254] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303250\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303250\\temporaryfile")) returned 1 [0234.254] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90910920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90910920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90910920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0234.254] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0234.255] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303250" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303250")) returned 1 [0234.255] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 1 [0234.582] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0234.583] WriteFile (in: hFile=0xe0, lpBuffer=0x3150028*, nNumberOfBytesToWrite=0x57bbc8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3150028*, lpNumberOfBytesWritten=0x18fdb8*=0x57bbc8, lpOverlapped=0x0) returned 1 [0234.809] CloseHandle (hObject=0xe0) returned 1 [0234.856] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0234.857] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1beae6 [0234.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1beaee) returned 0x2650020 [0234.858] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1beae6, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x1beae6, lpOverlapped=0x0) returned 1 [0234.900] CloseHandle (hObject=0xe0) returned 1 [0234.900] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv")) returned 0 [0234.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0234.900] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0234.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0234.900] GetTickCount () returned 0x4a321 [0234.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0234.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0234.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0234.901] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303905\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303905\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0234.901] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303905\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303905\\....\\temporaryfile")) returned 0 [0234.901] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303905\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303905\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303905\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303905\\temporaryfile")) returned 1 [0234.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303905\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90f502e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90f502e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90f502e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0234.903] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90f502e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90f502e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90f502e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0234.903] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90f502e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90f502e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90f502e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0234.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303905\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90f502e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90f502e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90f502e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0234.903] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90f502e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90f502e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90f502e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0234.903] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90f502e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90f502e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90f502e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0234.903] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0234.903] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303905\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303905\\temporaryfile")) returned 1 [0234.904] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x90f502e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x90f502e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x90f502e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0234.904] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0234.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18303905" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18303905")) returned 1 [0234.904] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 1 [0234.991] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0234.993] WriteFile (in: hFile=0xe0, lpBuffer=0x29d0028*, nNumberOfBytesToWrite=0x1beaf0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29d0028*, lpNumberOfBytesWritten=0x18fdb8*=0x1beaf0, lpOverlapped=0x0) returned 1 [0235.041] CloseHandle (hObject=0xe0) returned 1 [0235.057] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0235.058] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1c0a26 [0235.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c0a2e) returned 0x2650020 [0235.059] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1c0a26, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x1c0a26, lpOverlapped=0x0) returned 1 [0235.102] CloseHandle (hObject=0xe0) returned 1 [0235.102] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv")) returned 0 [0235.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0235.102] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0235.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0235.102] GetTickCount () returned 0x4a3ec [0235.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0235.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0235.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0235.103] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304108\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304108\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0235.103] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304108\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304108\\....\\temporaryfile")) returned 0 [0235.104] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304108\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304108\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304108\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304108\\temporaryfile")) returned 1 [0235.105] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304108\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9113f4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9113f4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9113f4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0235.105] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9113f4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9113f4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9113f4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.105] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9113f4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9113f4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9113f4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0235.105] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304108\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9113f4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9113f4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9113f4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0235.105] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9113f4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9113f4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9113f4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.106] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9113f4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9113f4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9113f4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0235.106] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0235.106] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304108\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304108\\temporaryfile")) returned 1 [0235.106] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9113f4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9113f4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9113f4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0235.106] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0235.106] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304108" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304108")) returned 1 [0235.106] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 1 [0235.194] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0235.195] WriteFile (in: hFile=0xe0, lpBuffer=0x29f0028*, nNumberOfBytesToWrite=0x1c0a30, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29f0028*, lpNumberOfBytesWritten=0x18fdb8*=0x1c0a30, lpOverlapped=0x0) returned 1 [0235.225] CloseHandle (hObject=0xe0) returned 1 [0235.240] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0235.241] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x184166 [0235.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18416e) returned 0x2650020 [0235.242] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x184166, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x184166, lpOverlapped=0x0) returned 1 [0235.280] CloseHandle (hObject=0xe0) returned 1 [0235.280] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv")) returned 0 [0235.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0235.280] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0235.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0235.280] GetTickCount () returned 0x4a497 [0235.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0235.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0235.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0235.281] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304279\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0235.282] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304279\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304279\\....\\temporaryfile")) returned 0 [0235.282] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304279\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304279\\temporaryfile")) returned 1 [0235.283] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304279\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x912e23e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x912e23e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x912e23e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0235.283] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x912e23e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x912e23e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x912e23e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.283] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x912e23e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x912e23e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x912e23e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0235.284] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304279\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x912e23e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x912e23e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x912e23e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0235.284] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x912e23e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x912e23e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x912e23e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.284] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x912e23e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x912e23e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x912e23e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0235.284] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0235.284] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304279\\temporaryfile")) returned 1 [0235.284] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x912e23e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x912e23e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x912e23e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0235.284] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0235.284] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304279" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304279")) returned 1 [0235.284] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 1 [0235.373] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0235.376] WriteFile (in: hFile=0xe0, lpBuffer=0x2970028*, nNumberOfBytesToWrite=0x184170, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2970028*, lpNumberOfBytesWritten=0x18fdb8*=0x184170, lpOverlapped=0x0) returned 1 [0235.403] CloseHandle (hObject=0xe0) returned 1 [0235.416] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0235.417] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x189f26 [0235.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x189f2e) returned 0x2650020 [0235.418] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x189f26, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x189f26, lpOverlapped=0x0) returned 1 [0235.468] CloseHandle (hObject=0xe0) returned 1 [0235.468] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv")) returned 0 [0235.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0235.469] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0235.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0235.469] GetTickCount () returned 0x4a553 [0235.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0235.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0235.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0235.470] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304467\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304467\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0235.474] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304467\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304467\\....\\temporaryfile")) returned 0 [0235.475] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304467\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304467\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304467\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304467\\temporaryfile")) returned 1 [0235.476] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304467\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x914ab460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x914d15c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x914d15c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0235.476] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x914ab460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x914d15c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x914d15c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.476] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x914d15c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x914d15c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x914d15c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0235.476] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304467\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x914d15c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x914d15c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x914d15c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0235.476] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x914d15c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x914d15c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x914d15c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.476] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x914d15c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x914d15c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x914d15c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0235.476] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0235.477] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304467\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304467\\temporaryfile")) returned 1 [0235.477] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x914d15c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x914d15c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x914d15c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0235.477] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0235.477] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304467" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304467")) returned 1 [0235.477] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 1 [0235.565] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0235.565] WriteFile (in: hFile=0xe0, lpBuffer=0x2970028*, nNumberOfBytesToWrite=0x189f30, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2970028*, lpNumberOfBytesWritten=0x18fdb8*=0x189f30, lpOverlapped=0x0) returned 1 [0235.607] CloseHandle (hObject=0xe0) returned 1 [0235.621] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0235.621] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6680f4 [0235.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6680fc) returned 0x2650020 [0235.622] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x6680f4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x6680f4, lpOverlapped=0x0) returned 1 [0235.960] CloseHandle (hObject=0xe0) returned 1 [0235.960] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv")) returned 0 [0235.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0235.961] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0235.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0235.961] GetTickCount () returned 0x4a746 [0235.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0235.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0235.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0235.962] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304966\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304966\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0235.962] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304966\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304966\\....\\temporaryfile")) returned 0 [0235.962] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304966\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304966\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304966\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304966\\temporaryfile")) returned 1 [0235.964] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304966\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9196e060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9196e060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9196e060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0235.964] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9196e060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9196e060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9196e060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.964] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9196e060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9196e060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9196e060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0235.964] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304966\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9196e060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9196e060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9196e060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0235.964] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9196e060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9196e060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9196e060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.964] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9196e060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9196e060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9196e060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0235.964] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0235.964] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304966\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304966\\temporaryfile")) returned 1 [0235.964] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9196e060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9196e060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9196e060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0235.964] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0235.964] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18304966" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18304966")) returned 1 [0235.965] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 1 [0236.455] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0236.456] WriteFile (in: hFile=0xe0, lpBuffer=0x3330028*, nNumberOfBytesToWrite=0x6680f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3330028*, lpNumberOfBytesWritten=0x18fdb8*=0x6680f8, lpOverlapped=0x0) returned 1 [0236.577] CloseHandle (hObject=0xe0) returned 1 [0236.649] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0236.651] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x673c74 [0236.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x673c7c) returned 0x2650020 [0236.652] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x673c74, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x673c74, lpOverlapped=0x0) returned 1 [0236.841] CloseHandle (hObject=0xe0) returned 1 [0236.841] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv")) returned 0 [0236.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0236.841] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0236.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0236.841] GetTickCount () returned 0x4aaaf [0236.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0236.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0236.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0236.842] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18305839\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18305839\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0236.842] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18305839\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18305839\\....\\temporaryfile")) returned 0 [0236.843] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18305839\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18305839\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18305839\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18305839\\temporaryfile")) returned 1 [0236.844] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18305839\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x921c2d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x921e8ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x921e8ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0236.844] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x921c2d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x921e8ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x921e8ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.845] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x921e8ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x921e8ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x921e8ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0236.845] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18305839\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x921e8ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x921e8ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x921e8ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0236.845] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x921e8ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x921e8ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x921e8ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.845] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x921e8ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x921e8ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x921e8ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0236.845] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0236.845] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18305839\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18305839\\temporaryfile")) returned 1 [0236.845] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x921e8ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x921e8ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x921e8ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0236.845] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0236.845] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18305839" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18305839")) returned 1 [0236.845] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 1 [0237.251] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0237.252] WriteFile (in: hFile=0xe0, lpBuffer=0x3350028*, nNumberOfBytesToWrite=0x673c78, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3350028*, lpNumberOfBytesWritten=0x18fdb8*=0x673c78, lpOverlapped=0x0) returned 1 [0237.371] CloseHandle (hObject=0xe0) returned 1 [0237.428] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0237.429] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2ca474 [0237.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ca47c) returned 0x2650020 [0237.429] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x2ca474, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x2ca474, lpOverlapped=0x0) returned 1 [0237.499] CloseHandle (hObject=0xe0) returned 1 [0237.499] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv")) returned 0 [0237.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0237.500] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0237.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0237.500] GetTickCount () returned 0x4ad4e [0237.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0237.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0237.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0237.500] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306510\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306510\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0237.501] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306510\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306510\\....\\temporaryfile")) returned 0 [0237.501] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306510\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306510\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306510\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306510\\temporaryfile")) returned 1 [0237.502] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306510\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92828880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92828880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92828880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0237.503] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92828880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92828880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92828880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.503] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92828880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92828880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92828880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0237.503] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306510\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92828880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92828880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92828880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0237.503] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92828880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92828880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92828880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.503] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92828880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92828880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92828880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0237.503] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0237.503] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306510\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306510\\temporaryfile")) returned 1 [0237.503] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92828880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92828880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92828880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0237.503] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0237.503] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306510" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306510")) returned 1 [0237.503] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 1 [0237.646] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0237.647] WriteFile (in: hFile=0xe0, lpBuffer=0x2bf0028*, nNumberOfBytesToWrite=0x2ca478, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bf0028*, lpNumberOfBytesWritten=0x18fdb8*=0x2ca478, lpOverlapped=0x0) returned 1 [0237.705] CloseHandle (hObject=0xe0) returned 1 [0237.729] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0237.730] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2e59f4 [0237.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e59fc) returned 0x2650020 [0237.730] ReadFile (in: hFile=0xe0, lpBuffer=0x2650028, nNumberOfBytesToRead=0x2e59f4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdd0*=0x2e59f4, lpOverlapped=0x0) returned 1 [0237.804] CloseHandle (hObject=0xe0) returned 1 [0237.804] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv")) returned 0 [0237.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0237.805] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0237.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0237.805] GetTickCount () returned 0x4ae77 [0237.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0237.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0237.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0237.805] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306807\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306807\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0237.806] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306807\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306807\\....\\temporaryfile")) returned 0 [0237.806] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306807\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306807\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306807\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306807\\temporaryfile")) returned 1 [0237.807] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306807\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92afc2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92afc2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92afc2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0237.808] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92afc2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92afc2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92afc2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.808] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92afc2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92afc2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92afc2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0237.808] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306807\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92afc2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92afc2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92afc2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0237.808] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92afc2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92afc2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92afc2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.808] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92afc2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92afc2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92afc2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0237.808] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0237.808] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306807\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306807\\temporaryfile")) returned 1 [0237.808] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92afc2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92afc2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92afc2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0237.808] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0237.808] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18306807" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18306807")) returned 1 [0237.808] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 1 [0237.967] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0237.968] WriteFile (in: hFile=0xe0, lpBuffer=0x2c30028*, nNumberOfBytesToWrite=0x2e59f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c30028*, lpNumberOfBytesWritten=0x18fdb8*=0x2e59f8, lpOverlapped=0x0) returned 1 [0238.027] CloseHandle (hObject=0xe0) returned 1 [0238.162] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.163] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x23d2 [0238.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23da) returned 0x2b4a70 [0238.163] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x23d2, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x23d2, lpOverlapped=0x0) returned 1 [0238.165] CloseHandle (hObject=0xe0) returned 1 [0238.165] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png")) returned 0 [0238.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.165] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.166] GetTickCount () returned 0x4afdd [0238.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0238.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.166] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307165\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.167] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307165\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307165\\....\\temporaryfile")) returned 0 [0238.167] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307165\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307165\\temporaryfile")) returned 1 [0238.168] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307165\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e68240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e68240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e68240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.169] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e68240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e68240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e68240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.169] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e68240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e68240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e68240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.169] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307165\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e68240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e68240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e68240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.169] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e68240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e68240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e68240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.169] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e68240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e68240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e68240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.169] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.169] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307165\\temporaryfile")) returned 1 [0238.169] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e68240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e68240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e68240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.169] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.169] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307165" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307165")) returned 1 [0238.169] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png") returned 1 [0238.170] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.171] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6e60*, nNumberOfBytesToWrite=0x23d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6e60*, lpNumberOfBytesWritten=0x18fdb8*=0x23d8, lpOverlapped=0x0) returned 1 [0238.172] CloseHandle (hObject=0xe0) returned 1 [0238.172] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.172] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x92e8e3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e8e3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0238.173] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.173] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa198102e, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.175] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa198102e, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0238.175] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa198102e, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0238.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdf0 [0238.175] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.176] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0238.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0238.176] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0238.177] CloseHandle (hObject=0xe0) returned 1 [0238.177] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png")) returned 0 [0238.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.177] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.177] GetTickCount () returned 0x4afed [0238.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.178] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307181\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307181\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.178] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307181\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307181\\....\\temporaryfile")) returned 0 [0238.178] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307181\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307181\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307181\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307181\\temporaryfile")) returned 1 [0238.180] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307181\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e8e3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e8e3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e8e3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.180] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e8e3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e8e3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e8e3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.180] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e8e3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e8e3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e8e3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.180] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307181\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e8e3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e8e3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e8e3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.180] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e8e3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e8e3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e8e3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.180] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e8e3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e8e3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e8e3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.180] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.180] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307181\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307181\\temporaryfile")) returned 1 [0238.180] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92e8e3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92e8e3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92e8e3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.180] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.180] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307181" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307181")) returned 1 [0238.181] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 1 [0238.181] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.181] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0238.182] CloseHandle (hObject=0xe0) returned 1 [0238.183] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.183] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1928 [0238.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1930) returned 0x2b4a70 [0238.183] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1928, lpOverlapped=0x0) returned 1 [0238.185] CloseHandle (hObject=0xe0) returned 1 [0238.185] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png")) returned 0 [0238.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.185] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.185] GetTickCount () returned 0x4affd [0238.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.186] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.186] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197\\....\\temporaryfile")) returned 0 [0238.186] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197\\temporaryfile")) returned 1 [0238.187] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.187] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.187] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.187] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.188] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.188] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.188] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.188] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197\\temporaryfile")) returned 1 [0238.188] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.188] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.188] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197")) returned 1 [0238.188] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 1 [0238.188] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.189] WriteFile (in: hFile=0xe0, lpBuffer=0x2b63b0*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b63b0*, lpNumberOfBytesWritten=0x18fdb8*=0x1930, lpOverlapped=0x0) returned 1 [0238.190] CloseHandle (hObject=0xe0) returned 1 [0238.190] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.190] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb05 [0238.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0d) returned 0x25f580 [0238.191] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb05, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb05, lpOverlapped=0x0) returned 1 [0238.192] CloseHandle (hObject=0xe0) returned 1 [0238.192] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png")) returned 0 [0238.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0238.192] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.192] GetTickCount () returned 0x4affd [0238.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0238.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.193] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197\\...."), lpSecurityAttributes=0x256198) returned 1 [0238.193] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197\\....\\temporaryfile")) returned 0 [0238.193] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197\\temporaryfile")) returned 1 [0238.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.195] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.195] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.195] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.195] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.195] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.195] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197\\temporaryfile")) returned 1 [0238.195] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eb4500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eb4500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eb4500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.195] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.195] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307197" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307197")) returned 1 [0238.196] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png") returned 1 [0238.196] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.196] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb10, lpOverlapped=0x0) returned 1 [0238.197] CloseHandle (hObject=0xe0) returned 1 [0238.197] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.200] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x15f4 [0238.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15fc) returned 0x2b4a70 [0238.200] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x15f4, lpOverlapped=0x0) returned 1 [0238.202] CloseHandle (hObject=0xe0) returned 1 [0238.202] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png")) returned 0 [0238.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.202] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.202] GetTickCount () returned 0x4b00c [0238.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.202] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.203] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212\\....\\temporaryfile")) returned 0 [0238.203] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212\\temporaryfile")) returned 1 [0238.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.204] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.204] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.204] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.204] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.204] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212\\temporaryfile")) returned 1 [0238.205] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.205] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212")) returned 1 [0238.205] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned 1 [0238.205] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.206] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6080*, nNumberOfBytesToWrite=0x15f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6080*, lpNumberOfBytesWritten=0x18fdb8*=0x15f8, lpOverlapped=0x0) returned 1 [0238.207] CloseHandle (hObject=0xe0) returned 1 [0238.207] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.208] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x143e [0238.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1446) returned 0x25b528 [0238.208] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x143e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x143e, lpOverlapped=0x0) returned 1 [0238.209] CloseHandle (hObject=0xe0) returned 1 [0238.209] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png")) returned 0 [0238.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.209] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.209] GetTickCount () returned 0x4b00c [0238.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.210] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.210] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212\\....\\temporaryfile")) returned 0 [0238.210] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212\\temporaryfile")) returned 1 [0238.212] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.212] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.212] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.212] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.212] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.212] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.212] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212\\temporaryfile")) returned 1 [0238.212] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92eda660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92eda660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92eda660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.212] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307212" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307212")) returned 1 [0238.212] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned 1 [0238.213] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.213] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1448, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1448, lpOverlapped=0x0) returned 1 [0238.214] CloseHandle (hObject=0xe0) returned 1 [0238.214] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.215] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0238.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0238.215] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0238.216] CloseHandle (hObject=0xe0) returned 1 [0238.216] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png")) returned 0 [0238.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.216] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.216] GetTickCount () returned 0x4b01c [0238.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.217] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228\\....\\temporaryfile")) returned 0 [0238.217] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228\\temporaryfile")) returned 1 [0238.218] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.219] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.219] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.219] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.219] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.219] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.219] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228\\temporaryfile")) returned 1 [0238.219] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.219] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228")) returned 1 [0238.219] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned 1 [0238.220] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.220] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0238.221] CloseHandle (hObject=0xe0) returned 1 [0238.221] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.222] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0238.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0238.222] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0238.223] CloseHandle (hObject=0xe0) returned 1 [0238.223] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png")) returned 0 [0238.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.223] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.223] GetTickCount () returned 0x4b01c [0238.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.224] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.224] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228\\....\\temporaryfile")) returned 0 [0238.225] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228\\temporaryfile")) returned 1 [0238.226] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.226] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.226] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.226] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.226] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.226] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.226] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.226] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228\\temporaryfile")) returned 1 [0238.226] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f007c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f007c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f007c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.226] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.226] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307228" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307228")) returned 1 [0238.227] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned 1 [0238.227] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.227] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0238.228] CloseHandle (hObject=0xe0) returned 1 [0238.228] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.229] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0238.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0238.229] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0238.230] CloseHandle (hObject=0xe0) returned 1 [0238.230] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png")) returned 0 [0238.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.231] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.231] GetTickCount () returned 0x4b02b [0238.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.231] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.232] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243\\....\\temporaryfile")) returned 0 [0238.232] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243\\temporaryfile")) returned 1 [0238.234] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.234] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.234] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.234] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.234] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.234] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.234] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.234] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243\\temporaryfile")) returned 1 [0238.235] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.235] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.235] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243")) returned 1 [0238.235] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned 1 [0238.235] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.239] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0238.241] CloseHandle (hObject=0xe0) returned 1 [0238.241] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.241] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0238.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0238.241] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0238.243] CloseHandle (hObject=0xe0) returned 1 [0238.243] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png")) returned 0 [0238.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.243] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.243] GetTickCount () returned 0x4b02b [0238.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.244] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.244] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243\\....\\temporaryfile")) returned 0 [0238.244] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243\\temporaryfile")) returned 1 [0238.245] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.245] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.245] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.246] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.246] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.246] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.246] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.246] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243\\temporaryfile")) returned 1 [0238.246] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f26920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f26920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f26920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.246] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.246] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307243" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307243")) returned 1 [0238.246] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned 1 [0238.247] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.250] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0238.251] CloseHandle (hObject=0xe0) returned 1 [0238.251] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.251] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0238.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0238.252] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0238.253] CloseHandle (hObject=0xe0) returned 1 [0238.253] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png")) returned 0 [0238.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.253] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.253] GetTickCount () returned 0x4b03b [0238.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.254] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.254] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259\\....\\temporaryfile")) returned 0 [0238.254] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259\\temporaryfile")) returned 1 [0238.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.255] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.255] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.256] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.256] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.256] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.256] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259\\temporaryfile")) returned 1 [0238.256] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.256] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.256] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259")) returned 1 [0238.256] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned 1 [0238.256] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.257] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0238.258] CloseHandle (hObject=0xe0) returned 1 [0238.258] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.258] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0238.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0238.259] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0238.260] CloseHandle (hObject=0xe0) returned 1 [0238.260] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png")) returned 0 [0238.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.260] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.260] GetTickCount () returned 0x4b03b [0238.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.261] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.261] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259\\....\\temporaryfile")) returned 0 [0238.261] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259\\temporaryfile")) returned 1 [0238.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f72be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f72be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.263] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f72be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f72be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.263] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.263] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.263] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.263] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259\\temporaryfile")) returned 1 [0238.263] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f4ca80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f4ca80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f4ca80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.263] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307259" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307259")) returned 1 [0238.264] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned 1 [0238.264] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.264] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0238.265] CloseHandle (hObject=0xe0) returned 1 [0238.265] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.266] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x60d7 [0238.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x60df) returned 0x2b4a70 [0238.266] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x60d7, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x60d7, lpOverlapped=0x0) returned 1 [0238.267] CloseHandle (hObject=0xe0) returned 1 [0238.267] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png")) returned 0 [0238.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0238.268] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.268] GetTickCount () returned 0x4b04b [0238.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0238.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0238.269] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307275\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307275\\...."), lpSecurityAttributes=0x256198) returned 1 [0238.269] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307275\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307275\\....\\temporaryfile")) returned 0 [0238.270] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307275\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307275\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307275\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307275\\temporaryfile")) returned 1 [0238.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307275\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f72be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f72be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f72be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.271] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f72be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f72be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f72be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.271] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f72be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f72be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f72be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307275\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f72be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f72be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f72be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.271] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f72be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f72be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f72be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.271] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f72be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f72be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f72be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.272] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307275\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307275\\temporaryfile")) returned 1 [0238.272] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f72be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f72be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f72be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.272] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307275" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307275")) returned 1 [0238.272] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned 1 [0238.273] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.274] WriteFile (in: hFile=0xe0, lpBuffer=0x2bab60*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bab60*, lpNumberOfBytesWritten=0x18fdb8*=0x60e0, lpOverlapped=0x0) returned 1 [0238.275] CloseHandle (hObject=0xe0) returned 1 [0238.275] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.275] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x92f72be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f72be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0238.276] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.276] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa108fe2a, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.277] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa108fe2a, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0238.277] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0xa108fe2a, dwReserved1=0x1cbf8eb, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0238.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a) returned 0x255cc0 [0238.277] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.278] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x701d [0238.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7025) returned 0x2b4a70 [0238.279] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x701d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x701d, lpOverlapped=0x0) returned 1 [0238.280] CloseHandle (hObject=0xe0) returned 1 [0238.280] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png")) returned 0 [0238.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.280] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.280] GetTickCount () returned 0x4b05a [0238.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0238.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.281] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.281] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290\\....\\temporaryfile")) returned 0 [0238.281] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290\\temporaryfile")) returned 1 [0238.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.283] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.283] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.283] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.283] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290\\temporaryfile")) returned 1 [0238.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.283] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290")) returned 1 [0238.283] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned 1 [0238.284] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.285] WriteFile (in: hFile=0xe0, lpBuffer=0x2bbaa8*, nNumberOfBytesToWrite=0x7028, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bbaa8*, lpNumberOfBytesWritten=0x18fdb8*=0x7028, lpOverlapped=0x0) returned 1 [0238.286] CloseHandle (hObject=0xe0) returned 1 [0238.286] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.286] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x609 [0238.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x611) returned 0x259e70 [0238.286] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x609, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x609, lpOverlapped=0x0) returned 1 [0238.288] CloseHandle (hObject=0xe0) returned 1 [0238.288] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png")) returned 0 [0238.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.288] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.288] GetTickCount () returned 0x4b05a [0238.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0238.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.289] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.289] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290\\....\\temporaryfile")) returned 0 [0238.289] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290\\temporaryfile")) returned 1 [0238.290] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.291] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.291] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.291] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.291] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.291] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290\\temporaryfile")) returned 1 [0238.291] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92f98d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92f98d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92f98d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.291] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307290" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307290")) returned 1 [0238.291] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 1 [0238.292] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.292] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x610, lpOverlapped=0x0) returned 1 [0238.293] CloseHandle (hObject=0xe0) returned 1 [0238.293] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.294] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc57 [0238.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc5f) returned 0x25f580 [0238.294] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc57, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc57, lpOverlapped=0x0) returned 1 [0238.295] CloseHandle (hObject=0xe0) returned 1 [0238.295] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png")) returned 0 [0238.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.295] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.295] GetTickCount () returned 0x4b06a [0238.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0238.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.296] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.296] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306\\....\\temporaryfile")) returned 0 [0238.297] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306\\temporaryfile")) returned 1 [0238.299] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.299] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.299] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.299] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.299] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.299] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.299] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.299] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306\\temporaryfile")) returned 1 [0238.300] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.300] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.300] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306")) returned 1 [0238.300] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned 1 [0238.300] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.301] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc60, lpOverlapped=0x0) returned 1 [0238.301] CloseHandle (hObject=0xe0) returned 1 [0238.302] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.302] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x213d [0238.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2145) returned 0x2b4a70 [0238.302] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x213d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x213d, lpOverlapped=0x0) returned 1 [0238.304] CloseHandle (hObject=0xe0) returned 1 [0238.304] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png")) returned 0 [0238.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.304] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.304] GetTickCount () returned 0x4b06a [0238.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0238.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.305] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.306] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306\\....\\temporaryfile")) returned 0 [0238.306] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306\\temporaryfile")) returned 1 [0238.307] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.308] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.308] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.308] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.308] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.308] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.308] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.308] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306\\temporaryfile")) returned 1 [0238.308] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fbeea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fbeea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fbeea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.308] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.308] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307306" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307306")) returned 1 [0238.309] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 1 [0238.309] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.311] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6bc8*, nNumberOfBytesToWrite=0x2148, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6bc8*, lpNumberOfBytesWritten=0x18fdb8*=0x2148, lpOverlapped=0x0) returned 1 [0238.312] CloseHandle (hObject=0xe0) returned 1 [0238.312] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.313] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1fb8 [0238.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1fc0) returned 0x2b4a70 [0238.313] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1fb8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1fb8, lpOverlapped=0x0) returned 1 [0238.314] CloseHandle (hObject=0xe0) returned 1 [0238.314] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png")) returned 0 [0238.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.315] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.315] GetTickCount () returned 0x4b079 [0238.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0238.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.315] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.315] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321\\....\\temporaryfile")) returned 0 [0238.316] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321\\temporaryfile")) returned 1 [0238.317] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.317] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.317] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.317] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.317] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.317] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.317] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.317] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321\\temporaryfile")) returned 1 [0238.317] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.317] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.318] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321")) returned 1 [0238.318] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 1 [0238.318] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.318] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6a40*, nNumberOfBytesToWrite=0x1fc0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6a40*, lpNumberOfBytesWritten=0x18fdb8*=0x1fc0, lpOverlapped=0x0) returned 1 [0238.319] CloseHandle (hObject=0xe0) returned 1 [0238.320] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.320] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x20d6 [0238.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20de) returned 0x2b4a70 [0238.320] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x20d6, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x20d6, lpOverlapped=0x0) returned 1 [0238.321] CloseHandle (hObject=0xe0) returned 1 [0238.321] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0 [0238.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.322] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.322] GetTickCount () returned 0x4b079 [0238.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0238.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.322] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.323] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321\\....\\temporaryfile")) returned 0 [0238.323] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321\\temporaryfile")) returned 1 [0238.324] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.324] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.324] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.324] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.325] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.325] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.325] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321\\temporaryfile")) returned 1 [0238.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fe5000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x92fe5000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x92fe5000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.325] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307321" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307321")) returned 1 [0238.325] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 1 [0238.325] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.326] WriteFile (in: hFile=0xe0, lpBuffer=0x2b6b60*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b6b60*, lpNumberOfBytesWritten=0x18fdb8*=0x20e0, lpOverlapped=0x0) returned 1 [0238.327] CloseHandle (hObject=0xe0) returned 1 [0238.327] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.328] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3c2 [0238.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ca) returned 0x259e70 [0238.328] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x3c2, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x3c2, lpOverlapped=0x0) returned 1 [0238.329] CloseHandle (hObject=0xe0) returned 1 [0238.329] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0 [0238.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.329] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.329] GetTickCount () returned 0x4b089 [0238.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0238.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.330] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.331] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337\\....\\temporaryfile")) returned 0 [0238.331] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337\\temporaryfile")) returned 1 [0238.332] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.332] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.332] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.332] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.332] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.332] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.332] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.332] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337\\temporaryfile")) returned 1 [0238.332] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.332] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.333] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337")) returned 1 [0238.333] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 1 [0238.333] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.333] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x3c8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x3c8, lpOverlapped=0x0) returned 1 [0238.334] CloseHandle (hObject=0xe0) returned 1 [0238.334] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.335] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2cc [0238.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d4) returned 0x259e70 [0238.335] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x2cc, lpOverlapped=0x0) returned 1 [0238.336] CloseHandle (hObject=0xe0) returned 1 [0238.336] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0 [0238.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.337] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.337] GetTickCount () returned 0x4b089 [0238.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0238.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.337] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.338] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337\\....\\temporaryfile")) returned 0 [0238.338] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337\\temporaryfile")) returned 1 [0238.339] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.339] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.339] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.339] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.339] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.339] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.340] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.340] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337\\temporaryfile")) returned 1 [0238.340] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9300b160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9300b160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9300b160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.340] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.340] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307337" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307337")) returned 1 [0238.340] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 1 [0238.341] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.341] WriteFile (in: hFile=0xe0, lpBuffer=0x25a158*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25a158*, lpNumberOfBytesWritten=0x18fdb8*=0x2d0, lpOverlapped=0x0) returned 1 [0238.342] CloseHandle (hObject=0xe0) returned 1 [0238.342] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.343] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x47c1d [0238.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x47c25) returned 0x2b4a70 [0238.343] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x47c1d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x47c1d, lpOverlapped=0x0) returned 1 [0238.346] CloseHandle (hObject=0xe0) returned 1 [0238.346] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0 [0238.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.347] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.347] GetTickCount () returned 0x4b099 [0238.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0238.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.347] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307353\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.348] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307353\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307353\\....\\temporaryfile")) returned 0 [0238.348] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307353\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307353\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307353\\temporaryfile")) returned 1 [0238.349] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307353\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930312c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930312c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930312c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.349] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930312c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930312c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930312c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.349] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930312c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930312c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930312c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.349] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307353\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930312c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930312c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930312c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.349] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930312c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930312c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930312c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.349] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930312c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930312c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930312c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.349] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.349] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307353\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307353\\temporaryfile")) returned 1 [0238.350] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930312c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930312c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930312c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.350] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.350] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307353" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307353")) returned 1 [0238.350] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png") returned 1 [0238.354] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.355] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x47c28, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x47c28, lpOverlapped=0x0) returned 1 [0238.360] CloseHandle (hObject=0xe0) returned 1 [0238.360] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.361] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11276 [0238.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1127e) returned 0x2b4a70 [0238.361] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x11276, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x11276, lpOverlapped=0x0) returned 1 [0238.362] CloseHandle (hObject=0xe0) returned 1 [0238.362] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0 [0238.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.363] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.363] GetTickCount () returned 0x4b0a8 [0238.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0238.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.363] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307368\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307368\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.364] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307368\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307368\\....\\temporaryfile")) returned 0 [0238.364] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307368\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307368\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307368\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307368\\temporaryfile")) returned 1 [0238.365] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307368\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93057420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93057420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93057420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.365] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93057420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93057420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93057420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.365] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93057420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93057420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93057420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.365] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307368\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93057420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93057420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93057420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.365] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93057420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93057420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93057420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.365] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93057420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93057420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93057420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.365] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.365] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307368\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307368\\temporaryfile")) returned 1 [0238.365] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93057420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93057420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93057420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.366] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.366] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307368" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307368")) returned 1 [0238.366] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png") returned 1 [0238.367] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.368] WriteFile (in: hFile=0xe0, lpBuffer=0x2c5d00*, nNumberOfBytesToWrite=0x11280, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c5d00*, lpNumberOfBytesWritten=0x18fdb8*=0x11280, lpOverlapped=0x0) returned 1 [0238.369] CloseHandle (hObject=0xe0) returned 1 [0238.369] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.370] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3126b [0238.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x31273) returned 0x2b4a70 [0238.370] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3126b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x3126b, lpOverlapped=0x0) returned 1 [0238.372] CloseHandle (hObject=0xe0) returned 1 [0238.372] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0 [0238.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.373] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.373] GetTickCount () returned 0x4b0b8 [0238.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.373] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307384\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307384\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.374] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307384\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307384\\....\\temporaryfile")) returned 0 [0238.374] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307384\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307384\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307384\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307384\\temporaryfile")) returned 1 [0238.375] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307384\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9307d580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9307d580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9307d580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.375] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9307d580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9307d580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9307d580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.375] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9307d580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9307d580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9307d580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.375] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307384\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9307d580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9307d580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9307d580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.375] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9307d580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9307d580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9307d580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.375] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9307d580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9307d580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9307d580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.375] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.375] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307384\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307384\\temporaryfile")) returned 1 [0238.375] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9307d580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9307d580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9307d580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.376] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.379] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307384" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307384")) returned 1 [0238.379] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png") returned 1 [0238.382] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.382] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x31270, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x31270, lpOverlapped=0x0) returned 1 [0238.386] CloseHandle (hObject=0xe0) returned 1 [0238.386] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.386] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x10e94 [0238.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10e9c) returned 0x2b4a70 [0238.387] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x10e94, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x10e94, lpOverlapped=0x0) returned 1 [0238.388] CloseHandle (hObject=0xe0) returned 1 [0238.388] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv")) returned 0 [0238.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.388] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.388] GetTickCount () returned 0x4b0c7 [0238.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.389] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.389] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399\\....\\temporaryfile")) returned 0 [0238.390] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399\\temporaryfile")) returned 1 [0238.391] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.391] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.391] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.391] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.391] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.391] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.391] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.391] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399\\temporaryfile")) returned 1 [0238.391] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.391] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.391] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399")) returned 1 [0238.392] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv") returned 1 [0238.393] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.393] WriteFile (in: hFile=0xe0, lpBuffer=0x2c5920*, nNumberOfBytesToWrite=0x10e98, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c5920*, lpNumberOfBytesWritten=0x18fdb8*=0x10e98, lpOverlapped=0x0) returned 1 [0238.395] CloseHandle (hObject=0xe0) returned 1 [0238.395] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.396] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x58bf8 [0238.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x58c00) returned 0x2b4a70 [0238.396] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x58bf8, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x58bf8, lpOverlapped=0x0) returned 1 [0238.400] CloseHandle (hObject=0xe0) returned 1 [0238.400] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0 [0238.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.400] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.400] GetTickCount () returned 0x4b0c7 [0238.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.400] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.401] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.401] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399\\....\\temporaryfile")) returned 0 [0238.401] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399\\temporaryfile")) returned 1 [0238.403] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.403] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.403] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.403] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.403] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.403] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.403] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.403] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399\\temporaryfile")) returned 1 [0238.403] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930a36e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930a36e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930a36e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.403] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.403] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307399" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307399")) returned 1 [0238.404] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png") returned 1 [0238.409] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.410] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x58c00, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x58c00, lpOverlapped=0x0) returned 1 [0238.426] CloseHandle (hObject=0xe0) returned 1 [0238.426] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.427] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7254 [0238.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x725c) returned 0x2b4a70 [0238.427] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x7254, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x7254, lpOverlapped=0x0) returned 1 [0238.428] CloseHandle (hObject=0xe0) returned 1 [0238.428] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv")) returned 0 [0238.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.428] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.428] GetTickCount () returned 0x4b0e7 [0238.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.429] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307431\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307431\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.429] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307431\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307431\\....\\temporaryfile")) returned 0 [0238.430] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307431\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307431\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307431\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307431\\temporaryfile")) returned 1 [0238.431] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307431\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930ef9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930ef9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930ef9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.431] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930ef9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930ef9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930ef9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.431] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930ef9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930ef9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930ef9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.431] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307431\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930ef9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930ef9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930ef9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.431] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930ef9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930ef9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930ef9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.431] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930ef9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930ef9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930ef9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.431] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.431] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307431\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307431\\temporaryfile")) returned 1 [0238.431] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x930ef9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x930ef9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x930ef9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.431] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.431] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307431" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307431")) returned 1 [0238.432] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv") returned 1 [0238.432] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.433] WriteFile (in: hFile=0xe0, lpBuffer=0x2bbce0*, nNumberOfBytesToWrite=0x7258, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bbce0*, lpNumberOfBytesWritten=0x18fdb8*=0x7258, lpOverlapped=0x0) returned 1 [0238.434] CloseHandle (hObject=0xe0) returned 1 [0238.434] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.435] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7254 [0238.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x725c) returned 0x2b4a70 [0238.435] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x7254, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x7254, lpOverlapped=0x0) returned 1 [0238.436] CloseHandle (hObject=0xe0) returned 1 [0238.436] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv")) returned 0 [0238.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.437] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.437] GetTickCount () returned 0x4b0f6 [0238.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.437] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.438] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446\\....\\temporaryfile")) returned 0 [0238.438] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446\\temporaryfile")) returned 1 [0238.439] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.439] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.439] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.439] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.439] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.439] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.439] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.439] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446\\temporaryfile")) returned 1 [0238.440] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.440] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.440] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446")) returned 1 [0238.440] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv") returned 1 [0238.440] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.441] WriteFile (in: hFile=0xe0, lpBuffer=0x2bbce0*, nNumberOfBytesToWrite=0x7258, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bbce0*, lpNumberOfBytesWritten=0x18fdb8*=0x7258, lpOverlapped=0x0) returned 1 [0238.442] CloseHandle (hObject=0xe0) returned 1 [0238.442] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.443] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x12b9 [0238.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12c1) returned 0x25b528 [0238.443] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12b9, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x12b9, lpOverlapped=0x0) returned 1 [0238.444] CloseHandle (hObject=0xe0) returned 1 [0238.444] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0 [0238.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.444] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.444] GetTickCount () returned 0x4b0f6 [0238.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.445] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.446] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446\\....\\temporaryfile")) returned 0 [0238.446] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446\\temporaryfile")) returned 1 [0238.447] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.447] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.447] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.447] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.447] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.447] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.447] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.447] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446\\temporaryfile")) returned 1 [0238.448] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93115b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93115b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93115b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.448] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.448] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307446" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307446")) returned 1 [0238.448] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png") returned 1 [0238.448] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.449] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x12c0, lpOverlapped=0x0) returned 1 [0238.450] CloseHandle (hObject=0xe0) returned 1 [0238.450] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.451] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x12cd [0238.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12d5) returned 0x25b528 [0238.451] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12cd, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x12cd, lpOverlapped=0x0) returned 1 [0238.452] CloseHandle (hObject=0xe0) returned 1 [0238.452] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0 [0238.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.452] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.453] GetTickCount () returned 0x4b106 [0238.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.453] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.453] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462\\....\\temporaryfile")) returned 0 [0238.454] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462\\temporaryfile")) returned 1 [0238.455] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.455] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.455] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.455] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.455] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.455] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.455] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.455] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462\\temporaryfile")) returned 1 [0238.455] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.455] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.455] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462")) returned 1 [0238.456] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png") returned 1 [0238.456] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.456] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x12d8, lpOverlapped=0x0) returned 1 [0238.457] CloseHandle (hObject=0xe0) returned 1 [0238.457] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.458] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1aaec [0238.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1aaf4) returned 0x2b4a70 [0238.458] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1aaec, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1aaec, lpOverlapped=0x0) returned 1 [0238.460] CloseHandle (hObject=0xe0) returned 1 [0238.460] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv")) returned 0 [0238.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.460] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.460] GetTickCount () returned 0x4b106 [0238.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.462] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.462] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462\\....\\temporaryfile")) returned 0 [0238.463] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462\\temporaryfile")) returned 1 [0238.464] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.464] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.464] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.464] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.464] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.464] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.464] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.464] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462\\temporaryfile")) returned 1 [0238.465] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9313bc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9313bc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9313bc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.465] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.465] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307462" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307462")) returned 1 [0238.465] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv") returned 1 [0238.467] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.468] WriteFile (in: hFile=0xe0, lpBuffer=0x2cf578*, nNumberOfBytesToWrite=0x1aaf0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2cf578*, lpNumberOfBytesWritten=0x18fdb8*=0x1aaf0, lpOverlapped=0x0) returned 1 [0238.470] CloseHandle (hObject=0xe0) returned 1 [0238.470] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.471] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x18337 [0238.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1833f) returned 0x2b4a70 [0238.471] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x18337, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x18337, lpOverlapped=0x0) returned 1 [0238.472] CloseHandle (hObject=0xe0) returned 1 [0238.472] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0 [0238.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.473] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.473] GetTickCount () returned 0x4b115 [0238.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.473] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307477\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307477\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.474] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307477\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307477\\....\\temporaryfile")) returned 0 [0238.474] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307477\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307477\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307477\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307477\\temporaryfile")) returned 1 [0238.475] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307477\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93161dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93161dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93161dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.475] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93161dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93161dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93161dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.475] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93161dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93161dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93161dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.475] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307477\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93161dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93161dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93161dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.475] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93161dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93161dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93161dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.475] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93161dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93161dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93161dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.475] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.475] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307477\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307477\\temporaryfile")) returned 1 [0238.475] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93161dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93161dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93161dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.476] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.476] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307477" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307477")) returned 1 [0238.476] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png") returned 1 [0238.477] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.478] WriteFile (in: hFile=0xe0, lpBuffer=0x2ccdc0*, nNumberOfBytesToWrite=0x18340, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ccdc0*, lpNumberOfBytesWritten=0x18fdb8*=0x18340, lpOverlapped=0x0) returned 1 [0238.480] CloseHandle (hObject=0xe0) returned 1 [0238.480] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.481] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbf1 [0238.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbf9) returned 0x25f580 [0238.481] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xbf1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xbf1, lpOverlapped=0x0) returned 1 [0238.482] CloseHandle (hObject=0xe0) returned 1 [0238.482] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0 [0238.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.482] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.482] GetTickCount () returned 0x4b125 [0238.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.483] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.483] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493\\....\\temporaryfile")) returned 0 [0238.483] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493\\temporaryfile")) returned 1 [0238.484] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.485] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.485] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.485] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.485] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493\\temporaryfile")) returned 1 [0238.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.485] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.485] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493")) returned 1 [0238.485] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png") returned 1 [0238.486] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.486] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xbf8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xbf8, lpOverlapped=0x0) returned 1 [0238.487] CloseHandle (hObject=0xe0) returned 1 [0238.487] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.488] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x658e [0238.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6596) returned 0x2b4a70 [0238.488] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x658e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x658e, lpOverlapped=0x0) returned 1 [0238.490] CloseHandle (hObject=0xe0) returned 1 [0238.490] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0 [0238.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.490] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.490] GetTickCount () returned 0x4b125 [0238.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.490] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.491] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493\\....\\temporaryfile")) returned 0 [0238.491] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493\\temporaryfile")) returned 1 [0238.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.492] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.492] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.493] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.493] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.493] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.493] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493\\temporaryfile")) returned 1 [0238.493] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93187f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93187f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93187f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.493] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.493] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307493" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307493")) returned 1 [0238.493] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png") returned 1 [0238.494] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.494] WriteFile (in: hFile=0xe0, lpBuffer=0x2bb018*, nNumberOfBytesToWrite=0x6598, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bb018*, lpNumberOfBytesWritten=0x18fdb8*=0x6598, lpOverlapped=0x0) returned 1 [0238.495] CloseHandle (hObject=0xe0) returned 1 [0238.495] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.496] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x321a4 [0238.496] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x321ac) returned 0x2b4a70 [0238.496] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x321a4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x321a4, lpOverlapped=0x0) returned 1 [0238.498] CloseHandle (hObject=0xe0) returned 1 [0238.498] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv")) returned 0 [0238.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.499] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.499] GetTickCount () returned 0x4b135 [0238.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.499] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.500] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509\\....\\temporaryfile")) returned 0 [0238.500] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509\\temporaryfile")) returned 1 [0238.501] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931ae080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931ae080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931ae080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.501] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931ae080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931ae080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931ae080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.501] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931ae080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931ae080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931ae080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.501] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931ae080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931ae080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931ae080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.501] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931ae080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931ae080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931ae080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.501] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931ae080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931ae080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931ae080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.501] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.501] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509\\temporaryfile")) returned 1 [0238.502] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931ae080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931ae080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931ae080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.502] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.502] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509")) returned 1 [0238.502] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv") returned 1 [0238.505] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.505] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x321a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x321a8, lpOverlapped=0x0) returned 1 [0238.509] CloseHandle (hObject=0xe0) returned 1 [0238.509] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.509] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xef24 [0238.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xef2c) returned 0x2b4a70 [0238.509] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xef24, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xef24, lpOverlapped=0x0) returned 1 [0238.511] CloseHandle (hObject=0xe0) returned 1 [0238.511] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv")) returned 0 [0238.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.511] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.511] GetTickCount () returned 0x4b135 [0238.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.512] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.512] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509\\....\\temporaryfile")) returned 0 [0238.512] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509\\temporaryfile")) returned 1 [0238.513] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.514] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.514] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.514] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.514] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.514] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.514] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509\\temporaryfile")) returned 1 [0238.514] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.514] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307509" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307509")) returned 1 [0238.514] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv") returned 1 [0238.515] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.516] WriteFile (in: hFile=0xe0, lpBuffer=0x2c39b0*, nNumberOfBytesToWrite=0xef28, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c39b0*, lpNumberOfBytesWritten=0x18fdb8*=0xef28, lpOverlapped=0x0) returned 1 [0238.517] CloseHandle (hObject=0xe0) returned 1 [0238.518] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.518] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xef24 [0238.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xef2c) returned 0x2b4a70 [0238.518] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xef24, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xef24, lpOverlapped=0x0) returned 1 [0238.520] CloseHandle (hObject=0xe0) returned 1 [0238.520] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv")) returned 0 [0238.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.520] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.520] GetTickCount () returned 0x4b144 [0238.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.521] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307524\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307524\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.521] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307524\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307524\\....\\temporaryfile")) returned 0 [0238.521] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307524\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307524\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307524\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307524\\temporaryfile")) returned 1 [0238.522] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307524\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.522] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.522] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.523] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307524\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.523] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.523] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.523] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.523] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307524\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307524\\temporaryfile")) returned 1 [0238.523] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931d41e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931d41e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931d41e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.523] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.523] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307524" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307524")) returned 1 [0238.523] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv") returned 1 [0238.524] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.525] WriteFile (in: hFile=0xe0, lpBuffer=0x2c39b0*, nNumberOfBytesToWrite=0xef28, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c39b0*, lpNumberOfBytesWritten=0x18fdb8*=0xef28, lpOverlapped=0x0) returned 1 [0238.526] CloseHandle (hObject=0xe0) returned 1 [0238.526] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.528] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x37f64 [0238.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x37f6c) returned 0x2b4a70 [0238.528] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x37f64, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x37f64, lpOverlapped=0x0) returned 1 [0238.530] CloseHandle (hObject=0xe0) returned 1 [0238.530] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv")) returned 0 [0238.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.530] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.530] GetTickCount () returned 0x4b154 [0238.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.531] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307540\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307540\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.531] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307540\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307540\\....\\temporaryfile")) returned 0 [0238.531] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307540\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307540\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307540\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307540\\temporaryfile")) returned 1 [0238.532] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307540\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931fa340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931fa340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931fa340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931fa340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931fa340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931fa340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931fa340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931fa340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931fa340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307540\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931fa340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931fa340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931fa340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.533] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931fa340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931fa340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931fa340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.533] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931fa340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931fa340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931fa340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.533] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307540\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307540\\temporaryfile")) returned 1 [0238.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x931fa340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x931fa340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931fa340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.533] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307540" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307540")) returned 1 [0238.533] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv") returned 1 [0238.537] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.537] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x37f68, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x37f68, lpOverlapped=0x0) returned 1 [0238.541] CloseHandle (hObject=0xe0) returned 1 [0238.541] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.541] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x931fa340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x931fa340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0238.541] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.541] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1ad8615, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.542] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1ad8615, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0238.542] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0xa1ad8615, dwReserved1=0x1cbf8eb, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0238.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14) returned 0x25cdf0 [0238.542] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.543] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb04 [0238.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0c) returned 0x25f580 [0238.543] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb04, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb04, lpOverlapped=0x0) returned 1 [0238.544] CloseHandle (hObject=0xe0) returned 1 [0238.544] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0 [0238.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0238.544] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.544] GetTickCount () returned 0x4b163 [0238.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.545] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0238.545] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555\\....\\temporaryfile")) returned 0 [0238.546] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555\\temporaryfile")) returned 1 [0238.547] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.547] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.547] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.547] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.547] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.547] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.547] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.547] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555\\temporaryfile")) returned 1 [0238.547] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.548] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.548] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555")) returned 1 [0238.548] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png") returned 1 [0238.548] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.552] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb08, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb08, lpOverlapped=0x0) returned 1 [0238.552] CloseHandle (hObject=0xe0) returned 1 [0238.553] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.553] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4d86 [0238.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4d8e) returned 0x2b4a70 [0238.553] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4d86, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4d86, lpOverlapped=0x0) returned 1 [0238.555] CloseHandle (hObject=0xe0) returned 1 [0238.555] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0 [0238.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0238.555] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.555] GetTickCount () returned 0x4b163 [0238.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0238.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.555] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555\\...."), lpSecurityAttributes=0x256198) returned 1 [0238.556] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555\\....\\temporaryfile")) returned 0 [0238.556] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555\\temporaryfile")) returned 1 [0238.557] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.557] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.558] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.558] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.558] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.558] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.558] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.558] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555\\temporaryfile")) returned 1 [0238.558] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932204a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932204a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932204a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.558] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.558] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307555" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307555")) returned 1 [0238.558] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png") returned 1 [0238.559] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.563] WriteFile (in: hFile=0xe0, lpBuffer=0x2b9810*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b9810*, lpNumberOfBytesWritten=0x18fdb8*=0x4d90, lpOverlapped=0x0) returned 1 [0238.564] CloseHandle (hObject=0xe0) returned 1 [0238.564] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.564] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x93246600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93246600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0238.564] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.564] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1ad8615, dwReserved1=0x1cbf8eb, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.566] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1ad8615, dwReserved1=0x1cbf8eb, cFileName="..", cAlternateFileName="")) returned 1 [0238.566] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0xa1ad8615, dwReserved1=0x1cbf8eb, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0238.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12) returned 0x25cdf0 [0238.566] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.566] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11da [0238.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e2) returned 0x25b528 [0238.566] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11da, lpOverlapped=0x0) returned 1 [0238.568] CloseHandle (hObject=0xe0) returned 1 [0238.568] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0 [0238.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.568] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.568] GetTickCount () returned 0x4b173 [0238.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.569] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307571\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307571\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.569] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307571\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307571\\....\\temporaryfile")) returned 0 [0238.569] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307571\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307571\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307571\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307571\\temporaryfile")) returned 1 [0238.570] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307571\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93246600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93246600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93246600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.570] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93246600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93246600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93246600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.570] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93246600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93246600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93246600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.570] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307571\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93246600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93246600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93246600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.571] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93246600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93246600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93246600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.571] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93246600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93246600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93246600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.571] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.571] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307571\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307571\\temporaryfile")) returned 1 [0238.571] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93246600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93246600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93246600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.571] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.571] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307571" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307571")) returned 1 [0238.571] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png") returned 1 [0238.571] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.572] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11e0, lpOverlapped=0x0) returned 1 [0238.573] CloseHandle (hObject=0xe0) returned 1 [0238.573] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.574] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xb05 [0238.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb0d) returned 0x25f580 [0238.574] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xb05, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xb05, lpOverlapped=0x0) returned 1 [0238.575] CloseHandle (hObject=0xe0) returned 1 [0238.575] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png")) returned 0 [0238.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0238.575] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.575] GetTickCount () returned 0x4b183 [0238.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0238.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.576] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587\\...."), lpSecurityAttributes=0x256198) returned 1 [0238.576] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587\\....\\temporaryfile")) returned 0 [0238.576] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587\\temporaryfile")) returned 1 [0238.577] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.578] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.578] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.578] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.578] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.578] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587\\temporaryfile")) returned 1 [0238.578] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.578] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587")) returned 1 [0238.578] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png") returned 1 [0238.579] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.579] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xb10, lpOverlapped=0x0) returned 1 [0238.580] CloseHandle (hObject=0xe0) returned 1 [0238.580] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.581] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13e0 [0238.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e8) returned 0x25b528 [0238.581] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e0, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13e0, lpOverlapped=0x0) returned 1 [0238.582] CloseHandle (hObject=0xe0) returned 1 [0238.582] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png")) returned 0 [0238.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.582] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.582] GetTickCount () returned 0x4b183 [0238.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.583] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.584] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587\\....\\temporaryfile")) returned 0 [0238.584] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587\\temporaryfile")) returned 1 [0238.585] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.585] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.585] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.585] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.585] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.585] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.585] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.585] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587\\temporaryfile")) returned 1 [0238.586] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9326c760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9326c760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9326c760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.586] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.586] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307587" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307587")) returned 1 [0238.586] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png") returned 1 [0238.586] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.587] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13e8, lpOverlapped=0x0) returned 1 [0238.587] CloseHandle (hObject=0xe0) returned 1 [0238.588] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.588] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc3a [0238.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc42) returned 0x25f580 [0238.588] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc3a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc3a, lpOverlapped=0x0) returned 1 [0238.595] CloseHandle (hObject=0xe0) returned 1 [0238.595] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png")) returned 0 [0238.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.595] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.595] GetTickCount () returned 0x4b192 [0238.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.596] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.596] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602\\....\\temporaryfile")) returned 0 [0238.596] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602\\temporaryfile")) returned 1 [0238.597] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.597] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.597] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.597] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.598] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.598] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.598] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.598] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602\\temporaryfile")) returned 1 [0238.598] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.598] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.598] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602")) returned 1 [0238.598] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png") returned 1 [0238.598] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.599] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc40, lpOverlapped=0x0) returned 1 [0238.600] CloseHandle (hObject=0xe0) returned 1 [0238.600] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.600] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x13a1 [0238.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a9) returned 0x25b528 [0238.601] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x13a1, lpOverlapped=0x0) returned 1 [0238.602] CloseHandle (hObject=0xe0) returned 1 [0238.602] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png")) returned 0 [0238.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.603] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.603] GetTickCount () returned 0x4b192 [0238.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.603] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.604] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602\\....\\temporaryfile")) returned 0 [0238.604] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602\\temporaryfile")) returned 1 [0238.606] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.606] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.606] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.606] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.606] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.606] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.606] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.606] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602\\temporaryfile")) returned 1 [0238.606] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932928c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932928c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932928c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.606] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.607] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307602" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307602")) returned 1 [0238.607] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png") returned 1 [0238.607] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.608] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x13a8, lpOverlapped=0x0) returned 1 [0238.609] CloseHandle (hObject=0xe0) returned 1 [0238.609] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.610] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc2e [0238.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc36) returned 0x25f580 [0238.610] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc2e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc2e, lpOverlapped=0x0) returned 1 [0238.611] CloseHandle (hObject=0xe0) returned 1 [0238.611] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png")) returned 0 [0238.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.611] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.611] GetTickCount () returned 0x4b1a2 [0238.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.612] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307618\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307618\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.612] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307618\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307618\\....\\temporaryfile")) returned 0 [0238.612] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307618\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307618\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307618\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307618\\temporaryfile")) returned 1 [0238.614] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307618\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932b8a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932b8a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932b8a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.614] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932b8a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932b8a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932b8a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.614] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932b8a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932b8a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932b8a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.614] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307618\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932b8a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932b8a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932b8a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.614] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932b8a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932b8a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932b8a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.614] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932b8a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932b8a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932b8a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.614] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.614] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307618\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307618\\temporaryfile")) returned 1 [0238.614] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932b8a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932b8a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932b8a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.614] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.614] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307618" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307618")) returned 1 [0238.615] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png") returned 1 [0238.615] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.615] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc38, lpOverlapped=0x0) returned 1 [0238.616] CloseHandle (hObject=0xe0) returned 1 [0238.616] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.617] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x135b [0238.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0238.617] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x135b, lpOverlapped=0x0) returned 1 [0238.620] CloseHandle (hObject=0xe0) returned 1 [0238.621] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png")) returned 0 [0238.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.621] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.621] GetTickCount () returned 0x4b1b1 [0238.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.622] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.622] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\....\\temporaryfile")) returned 0 [0238.622] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\temporaryfile")) returned 1 [0238.623] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.623] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.623] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.623] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.624] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.624] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.624] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.624] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\temporaryfile")) returned 1 [0238.624] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.624] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.624] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633")) returned 1 [0238.624] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png") returned 1 [0238.624] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.625] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1360, lpOverlapped=0x0) returned 1 [0238.626] CloseHandle (hObject=0xe0) returned 1 [0238.626] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.627] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xc09 [0238.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc11) returned 0x25f580 [0238.627] ReadFile (in: hFile=0xe0, lpBuffer=0x25f588, nNumberOfBytesToRead=0xc09, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdd0*=0xc09, lpOverlapped=0x0) returned 1 [0238.628] CloseHandle (hObject=0xe0) returned 1 [0238.628] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png")) returned 0 [0238.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.628] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0238.628] GetTickCount () returned 0x4b1b1 [0238.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.629] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.629] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\....\\temporaryfile")) returned 0 [0238.629] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\temporaryfile")) returned 1 [0238.631] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.631] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.631] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.631] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.631] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.631] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.631] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.631] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\temporaryfile")) returned 1 [0238.631] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x932deb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x932deb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.631] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.631] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633")) returned 1 [0238.631] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png") returned 1 [0238.632] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.632] WriteFile (in: hFile=0xe0, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdb8*=0xc10, lpOverlapped=0x0) returned 1 [0238.633] CloseHandle (hObject=0xe0) returned 1 [0238.633] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.634] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6c2b [0238.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6c33) returned 0x2b4a70 [0238.634] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6c2b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x6c2b, lpOverlapped=0x0) returned 1 [0238.635] CloseHandle (hObject=0xe0) returned 1 [0238.635] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png")) returned 0 [0238.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0238.635] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.635] GetTickCount () returned 0x4b1b1 [0238.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0238.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.636] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\...."), lpSecurityAttributes=0x256198) returned 1 [0238.637] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\....\\temporaryfile")) returned 0 [0238.637] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\temporaryfile")) returned 1 [0238.638] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.638] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x932deb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.638] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.638] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.638] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.638] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.638] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.638] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633\\temporaryfile")) returned 1 [0238.639] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.639] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.639] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307633" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307633")) returned 1 [0238.639] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png") returned 1 [0238.639] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.640] WriteFile (in: hFile=0xe0, lpBuffer=0x2bb6b8*, nNumberOfBytesToWrite=0x6c30, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bb6b8*, lpNumberOfBytesWritten=0x18fdb8*=0x6c30, lpOverlapped=0x0) returned 1 [0238.641] CloseHandle (hObject=0xe0) returned 1 [0238.641] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.642] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xdcdf [0238.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdce7) returned 0x2b4a70 [0238.642] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xdcdf, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0xdcdf, lpOverlapped=0x0) returned 1 [0238.644] CloseHandle (hObject=0xe0) returned 1 [0238.644] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png")) returned 0 [0238.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0238.644] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.644] GetTickCount () returned 0x4b1c1 [0238.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0238.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.645] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.645] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307649\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307649\\...."), lpSecurityAttributes=0x256228) returned 1 [0238.646] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307649\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307649\\....\\temporaryfile")) returned 0 [0238.646] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307649\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307649\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307649\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307649\\temporaryfile")) returned 1 [0238.647] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307649\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.648] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.648] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.648] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307649\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.648] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.648] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.648] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.648] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307649\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307649\\temporaryfile")) returned 1 [0238.648] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93304ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93304ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93304ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.648] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.648] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307649" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307649")) returned 1 [0238.649] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png") returned 1 [0238.650] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.651] WriteFile (in: hFile=0xe0, lpBuffer=0x2c2768*, nNumberOfBytesToWrite=0xdce8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2c2768*, lpNumberOfBytesWritten=0x18fdb8*=0xdce8, lpOverlapped=0x0) returned 1 [0238.653] CloseHandle (hObject=0xe0) returned 1 [0238.653] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.654] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1c5d [0238.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c65) returned 0x2b4a70 [0238.654] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1c5d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1c5d, lpOverlapped=0x0) returned 1 [0238.655] CloseHandle (hObject=0xe0) returned 1 [0238.655] DeleteFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png")) returned 0 [0238.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256198 [0238.655] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.655] GetTickCount () returned 0x4b1d1 [0238.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561f8 [0238.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0238.656] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665\\...."), lpSecurityAttributes=0x256198) returned 1 [0238.656] MoveFileA (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665\\....\\temporaryfile")) returned 0 [0238.657] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665\\temporaryfile")) returned 1 [0238.658] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0238.658] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.658] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.658] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0238.658] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.658] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.658] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0238.658] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665\\temporaryfile")) returned 1 [0238.658] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.658] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0238.658] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665")) returned 1 [0238.659] PathFileExistsA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png") returned 1 [0238.659] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.SKYSTARS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0238.659] WriteFile (in: hFile=0xe0, lpBuffer=0x2b66e8*, nNumberOfBytesToWrite=0x1c68, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b66e8*, lpNumberOfBytesWritten=0x18fdb8*=0x1c68, lpOverlapped=0x0) returned 1 [0238.660] CloseHandle (hObject=0xe0) returned 1 [0238.660] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.660] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0238.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0238.661] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0238.661] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0238.661] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0238.661] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0238.661] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa35c50, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xaa35c50, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd885082, dwReserved1=0x1ca0431, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0238.661] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa35c50, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xaa35c50, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd885082, dwReserved1=0x1ca0431, cFileName="..", cAlternateFileName="")) returned 1 [0238.661] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfd885082, dwReserved1=0x1ca0431, cFileName="en-US", cAlternateFileName="")) returned 1 [0238.661] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0xfd885082, dwReserved1=0x1ca0431, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0238.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb) returned 0x256210 [0238.662] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.663] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xce00 [0238.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xce08) returned 0x2b4a70 [0238.663] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xce00, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0xce00, lpOverlapped=0x0) returned 1 [0238.664] CloseHandle (hObject=0xd4) returned 1 [0238.665] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0 [0238.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0238.665] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.665] GetTickCount () returned 0x4b1d1 [0238.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0238.665] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0238.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665\\....\\temporaryfile")) returned 0 [0238.666] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665\\temporaryfile")) returned 1 [0238.667] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0238.667] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.667] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.667] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0238.668] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.668] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.668] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0238.668] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665\\temporaryfile")) returned 1 [0238.668] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9332ae40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9332ae40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9332ae40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.668] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0238.668] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307665" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307665")) returned 1 [0238.668] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 1 [0238.669] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.670] WriteFile (in: hFile=0xd4, lpBuffer=0x2c1888*, nNumberOfBytesToWrite=0xce08, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2c1888*, lpNumberOfBytesWritten=0x18fe18*=0xce08, lpOverlapped=0x0) returned 1 [0238.671] CloseHandle (hObject=0xd4) returned 1 [0238.671] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.671] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xa59 [0238.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa61) returned 0x25f580 [0238.671] ReadFile (in: hFile=0xd4, lpBuffer=0x25f588, nNumberOfBytesToRead=0xa59, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fe30*=0xa59, lpOverlapped=0x0) returned 1 [0238.673] CloseHandle (hObject=0xd4) returned 1 [0238.673] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc")) returned 0 [0238.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0238.673] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.673] GetTickCount () returned 0x4b1e0 [0238.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561c8 [0238.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0238.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0238.674] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680\\...."), lpSecurityAttributes=0x256210) returned 1 [0238.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680\\....\\temporaryfile")) returned 0 [0238.674] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680\\temporaryfile")) returned 1 [0238.675] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0238.675] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.675] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.675] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0238.675] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.676] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.676] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0238.676] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680\\temporaryfile")) returned 1 [0238.676] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.676] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0238.676] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680")) returned 1 [0238.676] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\ie8props.propdesc") returned 1 [0238.676] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.677] WriteFile (in: hFile=0xd4, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fe18*=0xa60, lpOverlapped=0x0) returned 1 [0238.677] CloseHandle (hObject=0xd4) returned 1 [0238.678] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.678] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x1e00 [0238.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e08) returned 0x2b4a70 [0238.678] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x1e00, lpOverlapped=0x0) returned 1 [0238.679] CloseHandle (hObject=0xd4) returned 1 [0238.679] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll")) returned 0 [0238.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0238.680] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.680] GetTickCount () returned 0x4b1e0 [0238.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0238.681] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0238.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680\\....\\temporaryfile")) returned 0 [0238.682] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680\\temporaryfile")) returned 1 [0238.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0238.683] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.683] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0238.683] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.683] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.684] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0238.684] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680\\temporaryfile")) returned 1 [0238.684] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93350fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93350fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93350fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.684] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0238.684] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307680" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307680")) returned 1 [0238.684] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\iecompat.dll") returned 1 [0238.685] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\iecompat.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\iecompat.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.689] WriteFile (in: hFile=0xd4, lpBuffer=0x2b6888*, nNumberOfBytesToWrite=0x1e08, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2b6888*, lpNumberOfBytesWritten=0x18fe18*=0x1e08, lpOverlapped=0x0) returned 1 [0238.690] CloseHandle (hObject=0xd4) returned 1 [0238.690] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.691] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xf7600 [0238.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf7608) returned 0x2250020 [0238.692] ReadFile (in: hFile=0xd4, lpBuffer=0x2250028, nNumberOfBytesToRead=0xf7600, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2250028*, lpNumberOfBytesRead=0x18fe30*=0xf7600, lpOverlapped=0x0) returned 1 [0238.720] CloseHandle (hObject=0xd4) returned 1 [0238.720] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll")) returned 0 [0238.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0238.720] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.720] GetTickCount () returned 0x4b20f [0238.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0238.721] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307727\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307727\\...."), lpSecurityAttributes=0x256210) returned 1 [0238.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307727\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307727\\....\\temporaryfile")) returned 0 [0238.721] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307727\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307727\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307727\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307727\\temporaryfile")) returned 1 [0238.722] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307727\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x933c33c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x933c33c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x933c33c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0238.722] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x933c33c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x933c33c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x933c33c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.722] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x933c33c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x933c33c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x933c33c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.723] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307727\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x933c33c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x933c33c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x933c33c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0238.723] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x933c33c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x933c33c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x933c33c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.723] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x933c33c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x933c33c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x933c33c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.723] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0238.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307727\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307727\\temporaryfile")) returned 1 [0238.723] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x933c33c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x933c33c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x933c33c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.723] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0238.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307727" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307727")) returned 1 [0238.723] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\iedvtool.dll") returned 1 [0238.781] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\iedvtool.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.782] WriteFile (in: hFile=0xd4, lpBuffer=0x2750028*, nNumberOfBytesToWrite=0xf7608, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2750028*, lpNumberOfBytesWritten=0x18fe18*=0xf7608, lpOverlapped=0x0) returned 1 [0238.796] CloseHandle (hObject=0xd4) returned 1 [0238.804] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.805] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x41e00 [0238.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x41e08) returned 0x2b4a70 [0238.805] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x41e00, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x41e00, lpOverlapped=0x0) returned 1 [0238.808] CloseHandle (hObject=0xd4) returned 1 [0238.808] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0 [0238.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0238.809] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.809] GetTickCount () returned 0x4b26d [0238.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0238.809] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307821\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307821\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0238.810] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307821\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307821\\....\\temporaryfile")) returned 0 [0238.810] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307821\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307821\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307821\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307821\\temporaryfile")) returned 1 [0238.811] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307821\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934a7c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934a7c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934a7c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0238.811] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934a7c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934a7c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934a7c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.811] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934a7c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934a7c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934a7c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.811] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307821\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934a7c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934a7c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934a7c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0238.811] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934a7c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934a7c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934a7c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.811] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934a7c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934a7c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934a7c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.811] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0238.811] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307821\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307821\\temporaryfile")) returned 1 [0238.812] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934a7c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934a7c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934a7c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.812] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0238.812] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307821" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307821")) returned 1 [0238.812] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 1 [0238.816] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.816] WriteFile (in: hFile=0xd4, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x41e08, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fe18*=0x41e08, lpOverlapped=0x0) returned 1 [0238.831] CloseHandle (hObject=0xd4) returned 1 [0238.831] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.832] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x1c400 [0238.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c408) returned 0x2b4a70 [0238.832] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1c400, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x1c400, lpOverlapped=0x0) returned 1 [0238.834] CloseHandle (hObject=0xd4) returned 1 [0238.834] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0 [0238.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0238.834] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.834] GetTickCount () returned 0x4b27c [0238.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0238.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0238.835] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307836\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307836\\...."), lpSecurityAttributes=0x256210) returned 1 [0238.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307836\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307836\\....\\temporaryfile")) returned 0 [0238.835] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307836\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307836\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307836\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307836\\temporaryfile")) returned 1 [0238.837] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307836\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934cdd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934cdd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934cdd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0238.837] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934cdd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934cdd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934cdd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.837] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934cdd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934cdd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934cdd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.837] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307836\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934cdd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934cdd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934cdd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0238.837] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934cdd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934cdd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934cdd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.837] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934cdd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934cdd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934cdd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.837] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0238.837] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307836\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307836\\temporaryfile")) returned 1 [0238.837] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934cdd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934cdd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934cdd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.837] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0238.837] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307836" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307836")) returned 1 [0238.837] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\ielowutil.exe") returned 1 [0238.839] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.840] WriteFile (in: hFile=0xd4, lpBuffer=0x2d0e88*, nNumberOfBytesToWrite=0x1c408, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2d0e88*, lpNumberOfBytesWritten=0x18fe18*=0x1c408, lpOverlapped=0x0) returned 1 [0238.842] CloseHandle (hObject=0xd4) returned 1 [0238.842] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.842] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x6e200 [0238.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6e208) returned 0x2450048 [0238.842] ReadFile (in: hFile=0xd4, lpBuffer=0x2450050, nNumberOfBytesToRead=0x6e200, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fe30*=0x6e200, lpOverlapped=0x0) returned 1 [0238.846] CloseHandle (hObject=0xd4) returned 1 [0238.846] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll")) returned 0 [0238.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0238.846] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.846] GetTickCount () returned 0x4b28c [0238.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0238.847] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307852\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307852\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0238.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307852\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307852\\....\\temporaryfile")) returned 0 [0238.847] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307852\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307852\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307852\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307852\\temporaryfile")) returned 1 [0238.848] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307852\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934f3ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934f3ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934f3ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0238.849] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934f3ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934f3ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934f3ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.849] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934f3ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934f3ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934f3ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.849] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307852\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934f3ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934f3ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934f3ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0238.849] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934f3ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934f3ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934f3ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.849] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934f3ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934f3ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934f3ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.849] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0238.849] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307852\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307852\\temporaryfile")) returned 1 [0238.849] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x934f3ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x934f3ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x934f3ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.849] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0238.849] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307852" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307852")) returned 1 [0238.849] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\ieproxy.dll") returned 1 [0238.862] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\ieproxy.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.863] WriteFile (in: hFile=0xd4, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x6e208, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fe18*=0x6e208, lpOverlapped=0x0) returned 1 [0238.869] CloseHandle (hObject=0xd4) returned 1 [0238.870] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.870] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x47a00 [0238.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x47a08) returned 0x2b4a70 [0238.870] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x47a00, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x47a00, lpOverlapped=0x0) returned 1 [0238.873] CloseHandle (hObject=0xd4) returned 1 [0238.873] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0 [0238.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0238.873] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.873] GetTickCount () returned 0x4b2ab [0238.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0238.874] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307883\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307883\\...."), lpSecurityAttributes=0x256210) returned 1 [0238.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307883\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307883\\....\\temporaryfile")) returned 0 [0238.874] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307883\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307883\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307883\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307883\\temporaryfile")) returned 1 [0238.875] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307883\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93540180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93540180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93540180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0238.875] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93540180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93540180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93540180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.875] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93540180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93540180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93540180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.875] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307883\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93540180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93540180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93540180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0238.876] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93540180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93540180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93540180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.876] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93540180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93540180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93540180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.876] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0238.876] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307883\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307883\\temporaryfile")) returned 1 [0238.876] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93540180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93540180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93540180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.876] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0238.876] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307883" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307883")) returned 1 [0238.876] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\IEShims.dll") returned 1 [0238.884] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.885] WriteFile (in: hFile=0xd4, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x47a08, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fe18*=0x47a08, lpOverlapped=0x0) returned 1 [0238.891] CloseHandle (hObject=0xd4) returned 1 [0238.891] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.891] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0xa9b10 [0238.891] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa9b18) returned 0x1d70020 [0238.892] ReadFile (in: hFile=0xd4, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xa9b10, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe30*=0xa9b10, lpOverlapped=0x0) returned 1 [0238.914] CloseHandle (hObject=0xd4) returned 1 [0238.914] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0 [0238.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0238.914] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.914] GetTickCount () returned 0x4b2ca [0238.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0238.915] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307914\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307914\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0238.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307914\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307914\\....\\temporaryfile")) returned 0 [0238.915] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307914\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307914\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307914\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307914\\temporaryfile")) returned 1 [0238.916] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307914\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9358c440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9358c440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9358c440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0238.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9358c440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9358c440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9358c440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9358c440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9358c440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9358c440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.916] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307914\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9358c440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9358c440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9358c440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0238.917] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9358c440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9358c440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9358c440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.917] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9358c440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9358c440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9358c440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.917] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0238.917] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307914\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307914\\temporaryfile")) returned 1 [0238.917] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9358c440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9358c440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9358c440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.917] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0238.917] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307914" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307914")) returned 1 [0238.917] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\iexplore.exe") returned 1 [0238.955] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.956] WriteFile (in: hFile=0xd4, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xa9b18, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fe18*=0xa9b18, lpOverlapped=0x0) returned 1 [0238.966] CloseHandle (hObject=0xd4) returned 1 [0238.972] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.972] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x7b600 [0238.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7b608) returned 0x2350048 [0238.974] ReadFile (in: hFile=0xd4, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7b600, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe30*=0x7b600, lpOverlapped=0x0) returned 1 [0238.978] CloseHandle (hObject=0xd4) returned 1 [0238.978] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll")) returned 0 [0238.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0238.978] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0238.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0238.978] GetTickCount () returned 0x4b309 [0238.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0238.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0238.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0238.979] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307977\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307977\\...."), lpSecurityAttributes=0x256210) returned 1 [0238.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307977\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307977\\....\\temporaryfile")) returned 0 [0238.979] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307977\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307977\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307977\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307977\\temporaryfile")) returned 1 [0238.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307977\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936249c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936249c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936249c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0238.981] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936249c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936249c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936249c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.981] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936249c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936249c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936249c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0238.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307977\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936249c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936249c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936249c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0238.981] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936249c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936249c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936249c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.981] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936249c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936249c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936249c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.981] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0238.981] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307977\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307977\\temporaryfile")) returned 1 [0238.981] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936249c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936249c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936249c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0238.981] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0238.981] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18307977" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18307977")) returned 1 [0238.982] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\jsdbgui.dll") returned 1 [0238.996] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\jsdbgui.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0238.997] WriteFile (in: hFile=0xd4, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x7b608, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fe18*=0x7b608, lpOverlapped=0x0) returned 1 [0239.014] CloseHandle (hObject=0xd4) returned 1 [0239.023] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.024] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x23600 [0239.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23608) returned 0x2b4a70 [0239.024] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x23600, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x23600, lpOverlapped=0x0) returned 1 [0239.026] CloseHandle (hObject=0xd4) returned 1 [0239.026] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll")) returned 0 [0239.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.026] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.026] GetTickCount () returned 0x4b347 [0239.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0239.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0239.027] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308039\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308039\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308039\\....\\temporaryfile")) returned 0 [0239.028] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308039\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308039\\temporaryfile")) returned 1 [0239.029] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308039\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936bcf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936bcf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936bcf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.029] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936bcf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936bcf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936bcf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.029] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936bcf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936bcf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936bcf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.029] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308039\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936bcf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936bcf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936bcf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.029] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936bcf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936bcf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936bcf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.029] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936bcf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936bcf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936bcf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.029] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.029] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308039\\temporaryfile")) returned 1 [0239.029] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936bcf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936bcf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936bcf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.030] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.030] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308039" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308039")) returned 1 [0239.030] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll") returned 1 [0239.034] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.034] WriteFile (in: hFile=0xd4, lpBuffer=0x2d8088*, nNumberOfBytesToWrite=0x23608, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2d8088*, lpNumberOfBytesWritten=0x18fe18*=0x23608, lpOverlapped=0x0) returned 1 [0239.037] CloseHandle (hObject=0xd4) returned 1 [0239.037] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.045] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x20400 [0239.045] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20408) returned 0x2b4a70 [0239.045] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x20400, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x20400, lpOverlapped=0x0) returned 1 [0239.047] CloseHandle (hObject=0xd4) returned 1 [0239.047] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll")) returned 0 [0239.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.047] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.047] GetTickCount () returned 0x4b357 [0239.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0239.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0239.048] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308055\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308055\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308055\\....\\temporaryfile")) returned 0 [0239.048] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308055\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308055\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308055\\temporaryfile")) returned 1 [0239.050] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308055\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936e30a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936e30a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936e30a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.050] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936e30a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936e30a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936e30a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.050] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936e30a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936e30a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936e30a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.050] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308055\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936e30a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936e30a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936e30a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.050] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936e30a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936e30a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936e30a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.050] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936e30a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936e30a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936e30a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.050] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.050] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308055\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308055\\temporaryfile")) returned 1 [0239.050] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x936e30a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x936e30a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x936e30a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.050] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.050] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308055" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308055")) returned 1 [0239.050] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll") returned 1 [0239.053] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.053] WriteFile (in: hFile=0xd4, lpBuffer=0x2d4e88*, nNumberOfBytesToWrite=0x20408, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2d4e88*, lpNumberOfBytesWritten=0x18fe18*=0x20408, lpOverlapped=0x0) returned 1 [0239.056] CloseHandle (hObject=0xd4) returned 1 [0239.056] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.056] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x46400 [0239.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x46408) returned 0x2b4a70 [0239.056] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x46400, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x46400, lpOverlapped=0x0) returned 1 [0239.060] CloseHandle (hObject=0xd4) returned 1 [0239.060] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll")) returned 0 [0239.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.060] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.060] GetTickCount () returned 0x4b366 [0239.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0239.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0239.061] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308070\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308070\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308070\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308070\\....\\temporaryfile")) returned 0 [0239.061] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308070\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308070\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308070\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308070\\temporaryfile")) returned 1 [0239.062] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308070\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93709200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93709200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93709200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.063] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93709200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93709200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93709200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.063] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93709200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93709200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93709200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.063] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308070\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93709200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93709200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93709200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.063] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93709200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93709200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93709200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.063] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93709200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93709200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93709200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.063] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.063] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308070\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308070\\temporaryfile")) returned 1 [0239.063] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93709200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93709200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93709200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.063] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.063] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308070" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308070")) returned 1 [0239.063] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll") returned 1 [0239.073] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\jsprofilerui.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.074] WriteFile (in: hFile=0xd4, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x46408, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fe18*=0x46408, lpOverlapped=0x0) returned 1 [0239.080] CloseHandle (hObject=0xd4) returned 1 [0239.080] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.080] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x579f8 [0239.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x57a00) returned 0x2b4a70 [0239.080] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x579f8, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x579f8, lpOverlapped=0x0) returned 1 [0239.086] CloseHandle (hObject=0xd4) returned 1 [0239.086] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll")) returned 0 [0239.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0239.087] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.087] GetTickCount () returned 0x4b376 [0239.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0239.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0239.087] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308086\\...."), lpSecurityAttributes=0x256210) returned 1 [0239.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308086\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308086\\....\\temporaryfile")) returned 0 [0239.088] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308086\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308086\\temporaryfile")) returned 1 [0239.089] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308086\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9372f360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9372f360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9372f360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0239.089] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9372f360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9372f360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9372f360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.089] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9372f360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9372f360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9372f360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.089] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308086\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9372f360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9372f360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9372f360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.089] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9372f360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9372f360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9372f360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.089] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9372f360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9372f360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9372f360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.089] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308086\\temporaryfile")) returned 1 [0239.090] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9372f360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9372f360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9372f360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.090] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0239.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308086" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308086")) returned 1 [0239.090] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\msdbg2.dll") returned 1 [0239.099] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\msdbg2.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.099] WriteFile (in: hFile=0xd4, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x57a00, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fe18*=0x57a00, lpOverlapped=0x0) returned 1 [0239.108] CloseHandle (hObject=0xd4) returned 1 [0239.110] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.111] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x83200 [0239.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x83208) returned 0x1d70020 [0239.111] ReadFile (in: hFile=0xd4, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x83200, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe30*=0x83200, lpOverlapped=0x0) returned 1 [0239.127] CloseHandle (hObject=0xd4) returned 1 [0239.127] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll")) returned 0 [0239.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.127] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.127] GetTickCount () returned 0x4b3a5 [0239.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0239.128] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308133\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308133\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308133\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308133\\....\\temporaryfile")) returned 0 [0239.128] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308133\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308133\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308133\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308133\\temporaryfile")) returned 1 [0239.130] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308133\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x937a1780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x937a1780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x937a1780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0239.130] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x937a1780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x937a1780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x937a1780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.130] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x937a1780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x937a1780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x937a1780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.130] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308133\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x937a1780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x937a1780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x937a1780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.130] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x937a1780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x937a1780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x937a1780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.130] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x937a1780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x937a1780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x937a1780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.130] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.130] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308133\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308133\\temporaryfile")) returned 1 [0239.130] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x937a1780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x937a1780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x937a1780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.130] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0239.130] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308133" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308133")) returned 1 [0239.131] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\pdm.dll") returned 1 [0239.162] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\pdm.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\pdm.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.162] WriteFile (in: hFile=0xd4, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x83208, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fe18*=0x83208, lpOverlapped=0x0) returned 1 [0239.171] CloseHandle (hObject=0xd4) returned 1 [0239.176] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\scholars-departmental-investor.exe" (normalized: "c:\\program files\\internet explorer\\scholars-departmental-investor.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.176] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x12800 [0239.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12808) returned 0x2b4a70 [0239.176] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x12800, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x12800, lpOverlapped=0x0) returned 1 [0239.177] CloseHandle (hObject=0xd4) returned 1 [0239.178] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\scholars-departmental-investor.exe" (normalized: "c:\\program files\\internet explorer\\scholars-departmental-investor.exe")) returned 0 [0239.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.178] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x259688 [0239.178] GetTickCount () returned 0x4b3d3 [0239.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0239.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0239.178] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308179\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308179\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\scholars-departmental-investor.exe" (normalized: "c:\\program files\\internet explorer\\scholars-departmental-investor.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308179\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308179\\....\\temporaryfile")) returned 1 [0239.180] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308179\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308179\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308179\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308179\\temporaryfile")) returned 1 [0239.181] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308179\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93813ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93813ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93813ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0239.182] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93813ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93813ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93813ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.182] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93813ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93813ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93813ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.182] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308179\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93813ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93813ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93813ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.182] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93813ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93813ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93813ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.182] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d056d0, ftCreationTime.dwHighDateTime=0x1d4bfeb, ftLastAccessTime.dwLowDateTime=0x9e2ff3d0, ftLastAccessTime.dwHighDateTime=0x1d502d5, ftLastWriteTime.dwLowDateTime=0x9e2ff3d0, ftLastWriteTime.dwHighDateTime=0x1d502d5, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.182] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308179\\TemporaryFile\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308179\\temporaryfile\\temporaryfile")) returned 0 [0239.182] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.182] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0239.182] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\scholars-departmental-investor.exe") returned 0 [0239.184] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\scholars-departmental-investor.exe.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\scholars-departmental-investor.exe.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.184] WriteFile (in: hFile=0xd4, lpBuffer=0x2c7288*, nNumberOfBytesToWrite=0x12808, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2c7288*, lpNumberOfBytesWritten=0x18fe18*=0x12808, lpOverlapped=0x0) returned 1 [0239.186] CloseHandle (hObject=0xd4) returned 1 [0239.186] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.186] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x18fe30 | out: lpFileSizeHigh=0x18fe30*=0x0) returned 0x3bc00 [0239.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3bc08) returned 0x2b4a70 [0239.186] ReadFile (in: hFile=0xd4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3bc00, lpNumberOfBytesRead=0x18fe30, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fe30*=0x3bc00, lpOverlapped=0x0) returned 1 [0239.188] CloseHandle (hObject=0xd4) returned 1 [0239.188] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0 [0239.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0239.188] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcdc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.189] GetTickCount () returned 0x4b3e3 [0239.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0239.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b10 [0239.189] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308195\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308195\\...."), lpSecurityAttributes=0x256210) returned 1 [0239.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308195\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308195\\....\\temporaryfile")) returned 0 [0239.190] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308195\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308195\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308195\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308195\\temporaryfile")) returned 1 [0239.191] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308195\\*", lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93839d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93839d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93839d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e2ff3d0, dwReserved1=0x1d502d5, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0239.191] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93839d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93839d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93839d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e2ff3d0, dwReserved1=0x1d502d5, cFileName="..", cAlternateFileName="")) returned 1 [0239.191] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93839d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93839d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93839d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e2ff3d0, dwReserved1=0x1d502d5, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.191] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308195\\TemporaryFile\\*", lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93839d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93839d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93839d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.191] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93839d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93839d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93839d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.191] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18f854 | out: lpFindFileData=0x18f854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93839d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93839d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93839d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.191] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.191] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308195\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308195\\temporaryfile")) returned 1 [0239.192] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fbb4 | out: lpFindFileData=0x18fbb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93839d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93839d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93839d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e2ff3d0, dwReserved1=0x1d502d5, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.192] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0239.192] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308195" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308195")) returned 1 [0239.192] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\sqmapi.dll") returned 1 [0239.199] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd4 [0239.199] WriteFile (in: hFile=0xd4, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x3bc08, lpNumberOfBytesWritten=0x18fe18, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fe18*=0x3bc08, lpOverlapped=0x0) returned 1 [0239.203] CloseHandle (hObject=0xd4) returned 1 [0239.203] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0239.203] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9385fe60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9385fe60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0239.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0239.203] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ead9a68, dwReserved1=0x1cbf8ea, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0239.204] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ead9a68, dwReserved1=0x1cbf8ea, cFileName="..", cAlternateFileName="")) returned 1 [0239.205] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x1ead9a68, dwReserved1=0x1cbf8ea, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0239.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x2561c8 [0239.205] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.205] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xa00 [0239.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa08) returned 0x2450048 [0239.206] ReadFile (in: hFile=0xd8, lpBuffer=0x2450050, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fe10*=0xa00, lpOverlapped=0x0) returned 1 [0239.207] CloseHandle (hObject=0xd8) returned 1 [0239.207] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0 [0239.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0239.207] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.207] GetTickCount () returned 0x4b3f3 [0239.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0239.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0239.208] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308211\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308211\\...."), lpSecurityAttributes=0x256210) returned 1 [0239.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308211\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308211\\....\\temporaryfile")) returned 0 [0239.212] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308211\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308211\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308211\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308211\\temporaryfile")) returned 1 [0239.214] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308211\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9385fe60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9385fe60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9385fe60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.214] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9385fe60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9385fe60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9385fe60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.214] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9385fe60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9385fe60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9385fe60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.214] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308211\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9385fe60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9385fe60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9385fe60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0239.214] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9385fe60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9385fe60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9385fe60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.214] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9385fe60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9385fe60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9385fe60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.214] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0239.214] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308211\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308211\\temporaryfile")) returned 1 [0239.214] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9385fe60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9385fe60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9385fe60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.214] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.214] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308211" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308211")) returned 1 [0239.214] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned 1 [0239.215] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.215] WriteFile (in: hFile=0xd8, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdf8*=0xa08, lpOverlapped=0x0) returned 1 [0239.216] CloseHandle (hObject=0xd8) returned 1 [0239.216] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.216] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x7000 [0239.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7008) returned 0x2350048 [0239.217] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x7000, lpOverlapped=0x0) returned 1 [0239.218] CloseHandle (hObject=0xd8) returned 1 [0239.218] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui")) returned 0 [0239.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.218] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.218] GetTickCount () returned 0x4b402 [0239.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0239.219] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226\\....\\temporaryfile")) returned 0 [0239.219] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226\\temporaryfile")) returned 1 [0239.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.221] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.221] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.221] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.221] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.221] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.221] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226\\temporaryfile")) returned 1 [0239.221] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.221] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226")) returned 1 [0239.221] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui") returned 1 [0239.222] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.222] WriteFile (in: hFile=0xd8, lpBuffer=0x2357060*, nNumberOfBytesToWrite=0x7008, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2357060*, lpNumberOfBytesWritten=0x18fdf8*=0x7008, lpOverlapped=0x0) returned 1 [0239.224] CloseHandle (hObject=0xd8) returned 1 [0239.224] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.224] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x800 [0239.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x2450048 [0239.224] ReadFile (in: hFile=0xd8, lpBuffer=0x2450050, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fe10*=0x800, lpOverlapped=0x0) returned 1 [0239.226] CloseHandle (hObject=0xd8) returned 1 [0239.226] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0 [0239.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.226] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.226] GetTickCount () returned 0x4b402 [0239.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0239.227] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226\\....\\temporaryfile")) returned 0 [0239.227] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226\\temporaryfile")) returned 1 [0239.228] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.228] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.229] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.229] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.229] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.229] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226\\temporaryfile")) returned 1 [0239.229] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x93885fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x93885fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x93885fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.229] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308226" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308226")) returned 1 [0239.229] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui") returned 1 [0239.230] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.230] WriteFile (in: hFile=0xd8, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x808, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdf8*=0x808, lpOverlapped=0x0) returned 1 [0239.231] CloseHandle (hObject=0xd8) returned 1 [0239.231] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.231] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x800 [0239.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x2450048 [0239.232] ReadFile (in: hFile=0xd8, lpBuffer=0x2450050, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fe10*=0x800, lpOverlapped=0x0) returned 1 [0239.233] CloseHandle (hObject=0xd8) returned 1 [0239.233] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui")) returned 0 [0239.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.233] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.233] GetTickCount () returned 0x4b412 [0239.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0239.234] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242\\....\\temporaryfile")) returned 0 [0239.234] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242\\temporaryfile")) returned 1 [0239.235] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.235] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.235] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.236] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.236] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.236] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.236] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.236] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242\\temporaryfile")) returned 1 [0239.236] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.236] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.236] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242")) returned 1 [0239.236] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui") returned 1 [0239.237] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.237] WriteFile (in: hFile=0xd8, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x808, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdf8*=0x808, lpOverlapped=0x0) returned 1 [0239.238] CloseHandle (hObject=0xd8) returned 1 [0239.238] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.238] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1400 [0239.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1408) returned 0x25b528 [0239.238] ReadFile (in: hFile=0xd8, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fe10*=0x1400, lpOverlapped=0x0) returned 1 [0239.240] CloseHandle (hObject=0xd8) returned 1 [0239.240] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0 [0239.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.240] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.240] GetTickCount () returned 0x4b412 [0239.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0239.241] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242\\....\\temporaryfile")) returned 0 [0239.242] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242\\temporaryfile")) returned 1 [0239.243] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.243] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.243] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.243] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.243] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.243] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.243] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242\\temporaryfile")) returned 1 [0239.244] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938ac120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938ac120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938ac120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.244] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.244] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308242" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308242")) returned 1 [0239.244] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui") returned 1 [0239.244] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.245] WriteFile (in: hFile=0xd8, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1408, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdf8*=0x1408, lpOverlapped=0x0) returned 1 [0239.246] CloseHandle (hObject=0xd8) returned 1 [0239.246] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.246] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x2e00 [0239.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e08) returned 0x2350048 [0239.246] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x2e00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x2e00, lpOverlapped=0x0) returned 1 [0239.248] CloseHandle (hObject=0xd8) returned 1 [0239.248] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui")) returned 0 [0239.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0239.248] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.248] GetTickCount () returned 0x4b421 [0239.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0239.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0239.249] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257\\...."), lpSecurityAttributes=0x256210) returned 1 [0239.249] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257\\....\\temporaryfile")) returned 0 [0239.249] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257\\temporaryfile")) returned 1 [0239.250] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.250] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.250] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.250] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.251] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.251] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.251] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.251] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257\\temporaryfile")) returned 1 [0239.251] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.251] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.251] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257")) returned 1 [0239.251] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui") returned 1 [0239.252] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.252] WriteFile (in: hFile=0xd8, lpBuffer=0x2352e60*, nNumberOfBytesToWrite=0x2e08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2352e60*, lpNumberOfBytesWritten=0x18fdf8*=0x2e08, lpOverlapped=0x0) returned 1 [0239.253] CloseHandle (hObject=0xd8) returned 1 [0239.253] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.254] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x800 [0239.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x2450048 [0239.254] ReadFile (in: hFile=0xd8, lpBuffer=0x2450050, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fe10*=0x800, lpOverlapped=0x0) returned 1 [0239.255] CloseHandle (hObject=0xd8) returned 1 [0239.255] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui")) returned 0 [0239.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.255] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.255] GetTickCount () returned 0x4b421 [0239.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0239.256] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257\\....\\temporaryfile")) returned 0 [0239.257] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257\\temporaryfile")) returned 1 [0239.258] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.258] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.258] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.258] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.258] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.258] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.258] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.258] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257\\temporaryfile")) returned 1 [0239.258] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938d2280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938d2280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938d2280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.258] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.258] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308257" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308257")) returned 1 [0239.258] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui") returned 1 [0239.259] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.259] WriteFile (in: hFile=0xd8, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x808, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdf8*=0x808, lpOverlapped=0x0) returned 1 [0239.260] CloseHandle (hObject=0xd8) returned 1 [0239.260] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.261] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x800 [0239.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x808) returned 0x2450048 [0239.261] ReadFile (in: hFile=0xd8, lpBuffer=0x2450050, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fe10*=0x800, lpOverlapped=0x0) returned 1 [0239.262] CloseHandle (hObject=0xd8) returned 1 [0239.262] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui")) returned 0 [0239.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.262] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.262] GetTickCount () returned 0x4b431 [0239.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0239.263] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273\\....\\temporaryfile")) returned 0 [0239.263] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273\\temporaryfile")) returned 1 [0239.264] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.264] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.264] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.265] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.265] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.265] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.265] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.265] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273\\temporaryfile")) returned 1 [0239.265] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.265] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.265] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273")) returned 1 [0239.265] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui") returned 1 [0239.265] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.266] WriteFile (in: hFile=0xd8, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x808, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdf8*=0x808, lpOverlapped=0x0) returned 1 [0239.267] CloseHandle (hObject=0xd8) returned 1 [0239.267] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.268] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1c00 [0239.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c08) returned 0x2350048 [0239.268] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x1c00, lpOverlapped=0x0) returned 1 [0239.269] CloseHandle (hObject=0xd8) returned 1 [0239.270] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui")) returned 0 [0239.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0239.270] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.270] GetTickCount () returned 0x4b431 [0239.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0239.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289ad0 [0239.270] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0239.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273\\....\\temporaryfile")) returned 0 [0239.271] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273\\temporaryfile")) returned 1 [0239.272] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.272] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.272] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.272] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289aec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.273] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.273] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273\\temporaryfile")) returned 1 [0239.273] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938f83e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.273] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.273] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308273" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308273")) returned 1 [0239.273] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui") returned 1 [0239.273] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.274] WriteFile (in: hFile=0xd8, lpBuffer=0x2351c60*, nNumberOfBytesToWrite=0x1c08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2351c60*, lpNumberOfBytesWritten=0x18fdf8*=0x1c08, lpOverlapped=0x0) returned 1 [0239.275] CloseHandle (hObject=0xd8) returned 1 [0239.275] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0239.275] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x938f83e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x938f83e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0239.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0239.275] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0239.275] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80046d91, dwReserved1=0x1ca0444, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0239.276] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80046d91, dwReserved1=0x1ca0444, cFileName="..", cAlternateFileName="")) returned 1 [0239.276] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x80046d91, dwReserved1=0x1ca0444, cFileName="install.ins", cAlternateFileName="")) returned 1 [0239.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561c8 [0239.276] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.277] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1cc [0239.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d4) returned 0x28f1f8 [0239.277] ReadFile (in: hFile=0xd8, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fe10*=0x1cc, lpOverlapped=0x0) returned 1 [0239.278] CloseHandle (hObject=0xd8) returned 1 [0239.278] DeleteFileA (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1 [0239.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0239.279] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0239.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0239.279] GetTickCount () returned 0x4b441 [0239.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0239.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0239.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0239.280] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308289\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308289\\...."), lpSecurityAttributes=0x256210) returned 1 [0239.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308289\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308289\\....\\temporaryfile")) returned 0 [0239.280] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308289\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308289\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308289\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308289\\temporaryfile")) returned 1 [0239.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308289\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9391e540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9391e540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9391e540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9391e540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9391e540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9391e540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9391e540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9391e540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9391e540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0239.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308289\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9391e540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9391e540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9391e540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0239.281] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9391e540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9391e540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9391e540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.281] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9391e540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9391e540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9391e540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0239.282] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0239.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308289\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308289\\temporaryfile")) returned 1 [0239.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9391e540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9391e540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9391e540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0239.282] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0239.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18308289" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18308289")) returned 1 [0239.282] PathFileExistsA (pszPath="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 0 [0239.282] CreateFileA (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.SKYSTARS" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0239.283] WriteFile (in: hFile=0xd8, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdf8*=0x1d0, lpOverlapped=0x0) returned 1 [0239.284] CloseHandle (hObject=0xd8) returned 1 [0239.284] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0239.284] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9391e540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9391e540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0239.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0239.284] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0239.284] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0239.284] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0239.284] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0239.285] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0239.285] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0239.285] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0239.285] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0239.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0239.285] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.285] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0239.285] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="10", cAlternateFileName="")) returned 1 [0239.285] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="10", cAlternateFileName="")) returned 0 [0239.285] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0239.286] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0239.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0239.286] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0239.287] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0239.287] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0239.287] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0239.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe) returned 0x256210 [0239.288] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0239.289] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a65d68 [0239.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a65d70) returned 0x2650020 [0239.290] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x2a65d68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x2a65d68, lpOverlapped=0x0) returned 1 [0241.386] CloseHandle (hObject=0xdc) returned 1 [0241.386] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll")) returned 1 [0241.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0241.393] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0241.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0241.393] GetTickCount () returned 0x4bc7b [0241.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0241.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0241.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0241.394] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18310395\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18310395\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0241.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18310395\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18310395\\....\\temporaryfile")) returned 0 [0241.395] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18310395\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18310395\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18310395\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18310395\\temporaryfile")) returned 1 [0241.397] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18310395\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x94d33ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x94d33ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x94d33ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0241.397] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x94d33ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x94d33ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x94d33ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="..", cAlternateFileName="")) returned 1 [0241.397] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x94d33ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x94d33ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x94d33ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0241.397] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18310395\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x94d33ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x94d33ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x94d33ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0241.397] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x94d33ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x94d33ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x94d33ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.397] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x94d33ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x94d33ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x94d33ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0241.397] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0241.397] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18310395\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18310395\\temporaryfile")) returned 1 [0241.397] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x94d33ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x94d33ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x94d33ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x11, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0241.397] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0241.398] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18310395" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18310395")) returned 1 [0241.398] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 0 [0243.925] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0243.926] WriteFile (in: hFile=0xdc, lpBuffer=0x7b30028*, nNumberOfBytesToWrite=0x2a65d70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x7b30028*, lpNumberOfBytesWritten=0x18fdd8*=0x2a65d70, lpOverlapped=0x0) returned 1 [0245.127] CloseHandle (hObject=0xdc) returned 1 [0245.497] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0245.498] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbc4568 [0245.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbc4570) returned 0x2650020 [0245.499] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0xbc4568, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0xbc4568, lpOverlapped=0x0) returned 1 [0245.877] CloseHandle (hObject=0xdc) returned 1 [0245.877] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll")) returned 1 [0245.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0245.885] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0245.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0245.885] GetTickCount () returned 0x4ce08 [0245.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0245.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0245.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0245.886] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18314888\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18314888\\...."), lpSecurityAttributes=0x256210) returned 1 [0245.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18314888\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18314888\\....\\temporaryfile")) returned 0 [0245.886] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18314888\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18314888\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18314888\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18314888\\temporaryfile")) returned 1 [0245.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18314888\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9780cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9780cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9780cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0245.888] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9780cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9780cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9780cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.888] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9780cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9780cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9780cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0245.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18314888\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9780cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9780cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9780cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0245.888] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9780cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9780cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9780cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.888] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9780cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9780cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9780cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0245.888] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0245.888] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18314888\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18314888\\temporaryfile")) returned 1 [0245.889] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9780cae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9780cae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9780cae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0245.889] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0245.889] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18314888" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18314888")) returned 1 [0245.890] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 0 [0246.542] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0246.543] WriteFile (in: hFile=0xdc, lpBuffer=0x3df0028*, nNumberOfBytesToWrite=0xbc4570, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x3df0028*, lpNumberOfBytesWritten=0x18fdd8*=0xbc4570, lpOverlapped=0x0) returned 1 [0246.768] CloseHandle (hObject=0xdc) returned 1 [0246.870] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0246.870] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c6f68 [0246.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c6f70) returned 0x2650020 [0246.871] ReadFile (in: hFile=0xdc, lpBuffer=0x2650028, nNumberOfBytesToRead=0x7c6f68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fdf0*=0x7c6f68, lpOverlapped=0x0) returned 1 [0247.113] CloseHandle (hObject=0xdc) returned 1 [0247.113] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll")) returned 1 [0247.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0247.121] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.121] GetTickCount () returned 0x4d2d8 [0247.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0247.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0247.122] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316120\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316120\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0247.122] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316120\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316120\\....\\temporaryfile")) returned 0 [0247.122] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316120\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316120\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316120\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316120\\temporaryfile")) returned 1 [0247.124] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316120\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x983cd780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x983cd780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x983cd780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0247.124] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x983cd780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x983cd780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x983cd780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.124] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x983cd780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x983cd780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x983cd780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.124] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316120\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x983cd780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x983cd780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x983cd780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.124] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x983cd780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x983cd780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x983cd780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.124] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x983cd780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x983cd780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x983cd780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.124] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.124] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316120\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316120\\temporaryfile")) returned 1 [0247.124] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x983cd780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x983cd780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x983cd780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.124] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0247.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316120" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316120")) returned 1 [0247.125] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 0 [0247.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.504] WriteFile (in: hFile=0xdc, lpBuffer=0x35f0028*, nNumberOfBytesToWrite=0x7c6f70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x35f0028*, lpNumberOfBytesWritten=0x18fdd8*=0x7c6f70, lpOverlapped=0x0) returned 1 [0247.655] CloseHandle (hObject=0xdc) returned 1 [0247.721] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.722] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4dc18 [0247.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4dc20) returned 0x2b4a70 [0247.723] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4dc18, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4dc18, lpOverlapped=0x0) returned 1 [0247.728] CloseHandle (hObject=0xdc) returned 1 [0247.728] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll")) returned 1 [0247.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0247.731] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.731] GetTickCount () returned 0x4d548 [0247.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256228 [0247.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289bd0 [0247.731] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316744\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316744\\...."), lpSecurityAttributes=0x256210) returned 1 [0247.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316744\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316744\\....\\temporaryfile")) returned 0 [0247.732] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316744\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316744\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316744\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316744\\temporaryfile")) returned 1 [0247.733] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316744\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989c0e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989c0e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989c0e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0247.734] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989c0e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989c0e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989c0e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.734] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989c0e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989c0e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989c0e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.734] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316744\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989c0e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989c0e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989c0e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.734] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989c0e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989c0e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989c0e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.734] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989c0e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989c0e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989c0e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.734] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.734] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316744\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316744\\temporaryfile")) returned 1 [0247.734] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989c0e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989c0e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989c0e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.734] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0247.734] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316744" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316744")) returned 1 [0247.734] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 0 [0247.741] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.741] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x4dc20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x4dc20, lpOverlapped=0x0) returned 1 [0247.746] CloseHandle (hObject=0xdc) returned 1 [0247.748] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0247.748] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x989c0e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989c0e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0247.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0247.749] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5146e3d0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0247.750] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5146e3d0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0247.750] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x5146e3d0, dwReserved1=0x1d301bf, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0247.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0247.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.751] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4360 [0247.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4368) returned 0x2b4a70 [0247.751] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4360, lpOverlapped=0x0) returned 1 [0247.752] CloseHandle (hObject=0xe0) returned 1 [0247.752] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0247.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0247.753] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.753] GetTickCount () returned 0x4d558 [0247.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0247.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0247.754] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316760\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316760\\...."), lpSecurityAttributes=0x256228) returned 1 [0247.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316760\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316760\\....\\temporaryfile")) returned 0 [0247.754] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316760\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316760\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316760\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316760\\temporaryfile")) returned 1 [0247.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316760\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989e6fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989e6fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989e6fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.756] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989e6fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989e6fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989e6fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.756] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989e6fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989e6fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989e6fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316760\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989e6fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989e6fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989e6fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0247.756] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989e6fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989e6fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989e6fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.756] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989e6fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989e6fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989e6fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.756] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0247.756] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316760\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316760\\temporaryfile")) returned 1 [0247.756] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x989e6fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x989e6fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x989e6fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.757] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316760" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316760")) returned 1 [0247.757] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 0 [0247.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.758] WriteFile (in: hFile=0xe0, lpBuffer=0x2b8de8*, nNumberOfBytesToWrite=0x4368, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b8de8*, lpNumberOfBytesWritten=0x18fdb8*=0x4368, lpOverlapped=0x0) returned 1 [0247.759] CloseHandle (hObject=0xe0) returned 1 [0247.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.760] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4932 [0247.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x493a) returned 0x2b4a70 [0247.760] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4932, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x4932, lpOverlapped=0x0) returned 1 [0247.761] CloseHandle (hObject=0xe0) returned 1 [0247.761] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0247.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0247.762] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.762] GetTickCount () returned 0x4d567 [0247.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0247.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0247.763] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775\\...."), lpSecurityAttributes=0x256210) returned 1 [0247.763] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775\\....\\temporaryfile")) returned 0 [0247.764] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775\\temporaryfile")) returned 1 [0247.765] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.765] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.765] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.765] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0247.765] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.765] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.765] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0247.765] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775\\temporaryfile")) returned 1 [0247.765] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.765] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.765] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775")) returned 1 [0247.766] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 0 [0247.766] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.767] WriteFile (in: hFile=0xe0, lpBuffer=0x2b93c0*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2b93c0*, lpNumberOfBytesWritten=0x18fdb8*=0x4938, lpOverlapped=0x0) returned 1 [0247.768] CloseHandle (hObject=0xe0) returned 1 [0247.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.769] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x78e4 [0247.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78ec) returned 0x2b4a70 [0247.769] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x78e4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x78e4, lpOverlapped=0x0) returned 1 [0247.770] CloseHandle (hObject=0xe0) returned 1 [0247.770] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0247.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0247.771] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.771] GetTickCount () returned 0x4d567 [0247.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0247.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0247.772] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775\\...."), lpSecurityAttributes=0x256228) returned 1 [0247.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775\\....\\temporaryfile")) returned 0 [0247.773] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775\\temporaryfile")) returned 1 [0247.774] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.774] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.774] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.774] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0247.774] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.774] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.774] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0247.774] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775\\temporaryfile")) returned 1 [0247.774] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a0d140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a0d140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a0d140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.774] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.774] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316775" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316775")) returned 1 [0247.775] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 0 [0247.775] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.776] WriteFile (in: hFile=0xe0, lpBuffer=0x2bc370*, nNumberOfBytesToWrite=0x78e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bc370*, lpNumberOfBytesWritten=0x18fdb8*=0x78e8, lpOverlapped=0x0) returned 1 [0247.777] CloseHandle (hObject=0xe0) returned 1 [0247.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.777] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x712e [0247.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7136) returned 0x2b4a70 [0247.777] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x712e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x712e, lpOverlapped=0x0) returned 1 [0247.779] CloseHandle (hObject=0xe0) returned 1 [0247.779] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0247.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0247.781] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.781] GetTickCount () returned 0x4d577 [0247.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0247.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0247.781] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791\\...."), lpSecurityAttributes=0x256210) returned 1 [0247.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791\\....\\temporaryfile")) returned 0 [0247.782] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791\\temporaryfile")) returned 1 [0247.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.783] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.783] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0247.783] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.783] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.783] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0247.783] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791\\temporaryfile")) returned 1 [0247.783] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.783] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.783] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791")) returned 1 [0247.784] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 0 [0247.784] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.785] WriteFile (in: hFile=0xe0, lpBuffer=0x2bbbb8*, nNumberOfBytesToWrite=0x7138, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bbbb8*, lpNumberOfBytesWritten=0x18fdb8*=0x7138, lpOverlapped=0x0) returned 1 [0247.786] CloseHandle (hObject=0xe0) returned 1 [0247.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.786] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x851c [0247.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8524) returned 0x2b4a70 [0247.786] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x851c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x851c, lpOverlapped=0x0) returned 1 [0247.788] CloseHandle (hObject=0xe0) returned 1 [0247.788] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0247.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0247.789] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.789] GetTickCount () returned 0x4d577 [0247.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0247.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0247.790] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791\\...."), lpSecurityAttributes=0x256228) returned 1 [0247.790] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791\\....\\temporaryfile")) returned 0 [0247.790] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791\\temporaryfile")) returned 1 [0247.791] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.791] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.791] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.791] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0247.792] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.792] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.792] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0247.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791\\temporaryfile")) returned 1 [0247.792] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a332a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a332a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a332a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.792] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316791" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316791")) returned 1 [0247.792] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 0 [0247.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.793] WriteFile (in: hFile=0xe0, lpBuffer=0x2bcfa8*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bcfa8*, lpNumberOfBytesWritten=0x18fdb8*=0x8520, lpOverlapped=0x0) returned 1 [0247.795] CloseHandle (hObject=0xe0) returned 1 [0247.795] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.797] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x7d92 [0247.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7d9a) returned 0x2b4a70 [0247.797] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x7d92, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x7d92, lpOverlapped=0x0) returned 1 [0247.799] CloseHandle (hObject=0xe0) returned 1 [0247.799] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0247.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0247.800] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.800] GetTickCount () returned 0x4d586 [0247.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0247.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0247.801] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316806\\...."), lpSecurityAttributes=0x256210) returned 1 [0247.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316806\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316806\\....\\temporaryfile")) returned 0 [0247.802] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316806\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316806\\temporaryfile")) returned 1 [0247.803] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316806\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a59400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a59400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a59400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.803] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a59400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a59400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a59400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.803] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a59400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a59400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a59400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.803] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316806\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a59400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a59400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a59400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0247.804] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a59400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a59400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a59400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.804] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a59400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a59400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a59400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.804] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0247.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316806\\temporaryfile")) returned 1 [0247.804] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a59400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a59400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a59400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.804] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316806" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316806")) returned 1 [0247.805] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 0 [0247.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.806] WriteFile (in: hFile=0xe0, lpBuffer=0x2bc820*, nNumberOfBytesToWrite=0x7d98, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bc820*, lpNumberOfBytesWritten=0x18fdb8*=0x7d98, lpOverlapped=0x0) returned 1 [0247.807] CloseHandle (hObject=0xe0) returned 1 [0247.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.808] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x9a5b [0247.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9a63) returned 0x2b4a70 [0247.808] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x9a5b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x9a5b, lpOverlapped=0x0) returned 1 [0247.809] CloseHandle (hObject=0xe0) returned 1 [0247.809] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0247.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0247.810] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.810] GetTickCount () returned 0x4d596 [0247.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0247.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0247.811] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822\\...."), lpSecurityAttributes=0x256228) returned 1 [0247.811] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822\\....\\temporaryfile")) returned 0 [0247.812] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822\\temporaryfile")) returned 1 [0247.813] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.813] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.813] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.813] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0247.813] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.813] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.813] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0247.813] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822\\temporaryfile")) returned 1 [0247.813] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.813] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.813] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822")) returned 1 [0247.813] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 0 [0247.814] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.815] WriteFile (in: hFile=0xe0, lpBuffer=0x2be4e8*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2be4e8*, lpNumberOfBytesWritten=0x18fdb8*=0x9a60, lpOverlapped=0x0) returned 1 [0247.816] CloseHandle (hObject=0xe0) returned 1 [0247.816] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.816] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x745e [0247.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7466) returned 0x2b4a70 [0247.817] ReadFile (in: hFile=0xe0, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x745e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdd0*=0x745e, lpOverlapped=0x0) returned 1 [0247.818] CloseHandle (hObject=0xe0) returned 1 [0247.818] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0247.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0247.819] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.819] GetTickCount () returned 0x4d596 [0247.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0247.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0247.820] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822\\...."), lpSecurityAttributes=0x256210) returned 1 [0247.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822\\....\\temporaryfile")) returned 0 [0247.823] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822\\temporaryfile")) returned 1 [0247.825] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.825] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.825] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.825] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0247.825] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.825] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.825] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0247.825] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822\\temporaryfile")) returned 1 [0247.825] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98a7f560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98a7f560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98a7f560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.825] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.825] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316822" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316822")) returned 1 [0247.825] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 0 [0247.826] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0247.827] WriteFile (in: hFile=0xe0, lpBuffer=0x2bbee8*, nNumberOfBytesToWrite=0x7468, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2bbee8*, lpNumberOfBytesWritten=0x18fdb8*=0x7468, lpOverlapped=0x0) returned 1 [0247.828] CloseHandle (hObject=0xe0) returned 1 [0247.828] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0247.828] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x98aa56c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98aa56c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0247.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0247.828] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0247.828] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0247.829] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0247.829] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="1033", cAlternateFileName="")) returned 1 [0247.829] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="1033", cAlternateFileName="")) returned 0 [0247.829] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0247.829] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0247.829] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0247.829] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.830] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0247.830] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0xfa1d4a90, dwReserved1=0x1d301be, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0247.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc) returned 0x2561e0 [0247.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0247.830] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0xa2b58 [0247.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa2b60) returned 0x1d70020 [0247.831] ReadFile (in: hFile=0xe4, lpBuffer=0x1d70028, nNumberOfBytesToRead=0xa2b58, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fdb0*=0xa2b58, lpOverlapped=0x0) returned 1 [0247.853] CloseHandle (hObject=0xe4) returned 1 [0247.853] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1 [0247.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0247.859] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.859] GetTickCount () returned 0x4d5c5 [0247.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0247.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0247.859] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316869\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316869\\...."), lpSecurityAttributes=0x256210) returned 1 [0247.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316869\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316869\\....\\temporaryfile")) returned 0 [0247.860] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316869\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316869\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316869\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316869\\temporaryfile")) returned 1 [0247.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316869\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98af1980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98af1980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98af1980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0247.861] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98af1980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98af1980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98af1980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="..", cAlternateFileName="")) returned 1 [0247.861] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98af1980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98af1980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98af1980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316869\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98af1980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98af1980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98af1980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0247.861] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98af1980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98af1980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98af1980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.861] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98af1980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98af1980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98af1980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.861] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0247.861] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316869\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316869\\temporaryfile")) returned 1 [0247.862] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98af1980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98af1980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98af1980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x14, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.862] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0247.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316869" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316869")) returned 1 [0247.862] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 0 [0247.891] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0247.892] WriteFile (in: hFile=0xe4, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fd98*=0xa2b60, lpOverlapped=0x0) returned 1 [0247.901] CloseHandle (hObject=0xe4) returned 1 [0247.907] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0247.908] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x18fdb0 | out: lpFileSizeHigh=0x18fdb0*=0x0) returned 0x3a18 [0247.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3a20) returned 0x2b4a70 [0247.908] ReadFile (in: hFile=0xe4, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3a18, lpNumberOfBytesRead=0x18fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdb0*=0x3a18, lpOverlapped=0x0) returned 1 [0247.909] CloseHandle (hObject=0xe4) returned 1 [0247.909] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1 [0247.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0247.910] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc5c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596b8 [0247.910] GetTickCount () returned 0x4d5f4 [0247.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0247.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0247.911] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316916\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316916\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0247.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316916\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316916\\....\\temporaryfile")) returned 0 [0247.911] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316916\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316916\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316916\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316916\\temporaryfile")) returned 1 [0247.912] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316916\\*", lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b63da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b63da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b63da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0247.912] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b63da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b63da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b63da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.912] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b63da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b63da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b63da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.912] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316916\\TemporaryFile\\*", lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b63da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b63da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b63da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0247.913] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b63da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b63da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b63da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.913] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7d4 | out: lpFindFileData=0x18f7d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b63da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b63da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b63da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.913] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0247.913] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316916\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316916\\temporaryfile")) returned 1 [0247.913] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb34 | out: lpFindFileData=0x18fb34*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b63da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b63da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b63da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.913] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0247.913] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316916" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316916")) returned 1 [0247.913] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 0 [0247.914] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.SKYSTARS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe4 [0247.914] WriteFile (in: hFile=0xe4, lpBuffer=0x2b84a0*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2b84a0*, lpNumberOfBytesWritten=0x18fd98*=0x3a20, lpOverlapped=0x0) returned 1 [0247.915] CloseHandle (hObject=0xe4) returned 1 [0247.915] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.915] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18fc88 | out: lpFindFileData=0x18fc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x98b63da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b63da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9d0 [0247.916] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.916] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0247.916] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0247.916] FindClose (in: hFindFile=0x289ad0 | out: hFindFile=0x289ad0) returned 1 [0247.916] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0247.916] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0247.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="..", cAlternateFileName="")) returned 1 [0247.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0247.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0247.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0247.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="Office14", cAlternateFileName="")) returned 1 [0247.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0247.916] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0247.917] FindNextFileA (in: hFindFile=0x289b10, lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0247.917] FindClose (in: hFindFile=0x289b10 | out: hFindFile=0x289b10) returned 1 [0247.917] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x18fd08 | out: lpFindFileData=0x18fd08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xee2ce510, dwReserved1=0x1d301be, cFileName=".", cAlternateFileName="")) returned 0x289b10 [0247.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c990 [0247.917] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0247.918] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0247.918] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0247.918] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0247.918] FindNextFileA (in: hFindFile=0x289a90, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0247.918] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0247.918] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289a90 [0247.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0247.918] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0247.920] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0247.921] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x512f1610, dwReserved1=0x1d301bf, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0247.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256228 [0247.921] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.921] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2340 [0247.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2348) returned 0x2b4a70 [0247.921] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2340, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2340, lpOverlapped=0x0) returned 1 [0247.923] CloseHandle (hObject=0xdc) returned 1 [0247.923] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0247.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0247.924] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0247.924] GetTickCount () returned 0x4d603 [0247.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0247.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0247.925] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931\\...."), lpSecurityAttributes=0x256210) returned 1 [0247.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931\\....\\temporaryfile")) returned 0 [0247.926] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931\\temporaryfile")) returned 1 [0247.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b89f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b89f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b89f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0247.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b89f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b89f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b89f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b89f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b89f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b89f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b89f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b89f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b89f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.927] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b89f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b89f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b89f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.927] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b89f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b89f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b89f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.927] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931\\temporaryfile")) returned 1 [0247.928] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98b89f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98b89f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98b89f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.928] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0247.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931")) returned 1 [0247.928] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 0 [0247.929] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.929] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6dc8*, nNumberOfBytesToWrite=0x2348, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6dc8*, lpNumberOfBytesWritten=0x18fdd8*=0x2348, lpOverlapped=0x0) returned 1 [0247.930] CloseHandle (hObject=0xdc) returned 1 [0247.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.931] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c30 [0247.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c38) returned 0x2b4a70 [0247.931] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1c30, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1c30, lpOverlapped=0x0) returned 1 [0247.932] CloseHandle (hObject=0xdc) returned 1 [0247.933] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0247.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0247.933] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0247.933] GetTickCount () returned 0x4d603 [0247.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0247.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0247.934] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931\\...."), lpSecurityAttributes=0x256228) returned 1 [0247.934] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931\\....\\temporaryfile")) returned 0 [0247.935] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931\\temporaryfile")) returned 1 [0247.936] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0247.936] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.936] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.936] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.936] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.936] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.936] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.936] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931\\temporaryfile")) returned 1 [0247.936] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.936] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0247.936] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316931" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316931")) returned 1 [0247.937] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 0 [0247.937] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.937] WriteFile (in: hFile=0xdc, lpBuffer=0x2b66b8*, nNumberOfBytesToWrite=0x1c38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b66b8*, lpNumberOfBytesWritten=0x18fdd8*=0x1c38, lpOverlapped=0x0) returned 1 [0247.938] CloseHandle (hObject=0xdc) returned 1 [0247.938] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.939] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3a19 [0247.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3a21) returned 0x2b4a70 [0247.939] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3a19, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3a19, lpOverlapped=0x0) returned 1 [0247.941] CloseHandle (hObject=0xdc) returned 1 [0247.941] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0247.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0247.942] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0247.942] GetTickCount () returned 0x4d613 [0247.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0247.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0247.942] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316947\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316947\\...."), lpSecurityAttributes=0x256210) returned 1 [0247.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316947\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316947\\....\\temporaryfile")) returned 0 [0247.943] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316947\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316947\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316947\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316947\\temporaryfile")) returned 1 [0247.944] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316947\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0247.944] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.944] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.944] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316947\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.945] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.945] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.945] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.945] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316947\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316947\\temporaryfile")) returned 1 [0247.945] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bb0060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bb0060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bb0060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.945] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0247.945] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316947" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316947")) returned 1 [0247.945] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 0 [0247.946] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.946] WriteFile (in: hFile=0xdc, lpBuffer=0x2b84a8*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b84a8*, lpNumberOfBytesWritten=0x18fdd8*=0x3a20, lpOverlapped=0x0) returned 1 [0247.947] CloseHandle (hObject=0xdc) returned 1 [0247.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.947] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a1c [0247.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a24) returned 0x2b4a70 [0247.948] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1a1c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a1c, lpOverlapped=0x0) returned 1 [0247.949] CloseHandle (hObject=0xdc) returned 1 [0247.949] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0247.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0247.950] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0247.950] GetTickCount () returned 0x4d622 [0247.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0247.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0247.951] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962\\...."), lpSecurityAttributes=0x256228) returned 1 [0247.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962\\....\\temporaryfile")) returned 0 [0247.952] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962\\temporaryfile")) returned 1 [0247.953] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0247.953] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.953] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.953] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.953] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.953] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.953] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.953] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962\\temporaryfile")) returned 1 [0247.953] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.953] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0247.953] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962")) returned 1 [0247.954] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 0 [0247.954] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.954] WriteFile (in: hFile=0xdc, lpBuffer=0x2b64a8*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b64a8*, lpNumberOfBytesWritten=0x18fdd8*=0x1a20, lpOverlapped=0x0) returned 1 [0247.955] CloseHandle (hObject=0xdc) returned 1 [0247.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.956] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcb3 [0247.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcbb) returned 0x2350048 [0247.956] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xcb3, lpOverlapped=0x0) returned 1 [0247.959] CloseHandle (hObject=0xdc) returned 1 [0247.959] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0247.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0247.960] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0247.960] GetTickCount () returned 0x4d622 [0247.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0247.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0247.961] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962\\...."), lpSecurityAttributes=0x256210) returned 1 [0247.961] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962\\....\\temporaryfile")) returned 0 [0247.961] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962\\temporaryfile")) returned 1 [0247.962] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0247.963] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.963] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.963] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.963] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.963] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.963] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.963] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962\\temporaryfile")) returned 1 [0247.963] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bd61c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bd61c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bd61c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.963] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0247.963] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316962" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316962")) returned 1 [0247.963] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 0 [0247.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.965] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xcb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xcb8, lpOverlapped=0x0) returned 1 [0247.966] CloseHandle (hObject=0xdc) returned 1 [0247.966] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.966] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1fa1 [0247.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1fa9) returned 0x2b4a70 [0247.966] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1fa1, lpOverlapped=0x0) returned 1 [0247.968] CloseHandle (hObject=0xdc) returned 1 [0247.968] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0247.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0247.969] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0247.969] GetTickCount () returned 0x4d632 [0247.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0247.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0247.969] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978\\...."), lpSecurityAttributes=0x256228) returned 1 [0247.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978\\....\\temporaryfile")) returned 0 [0247.970] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978\\temporaryfile")) returned 1 [0247.971] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0247.971] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.971] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.971] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.971] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.971] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.971] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.972] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978\\temporaryfile")) returned 1 [0247.972] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.972] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0247.972] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978")) returned 1 [0247.972] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 0 [0247.972] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.973] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6a30*, nNumberOfBytesToWrite=0x1fa8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6a30*, lpNumberOfBytesWritten=0x18fdd8*=0x1fa8, lpOverlapped=0x0) returned 1 [0247.975] CloseHandle (hObject=0xdc) returned 1 [0247.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.976] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e06 [0247.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e0e) returned 0x2b4a70 [0247.976] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1e06, lpOverlapped=0x0) returned 1 [0247.977] CloseHandle (hObject=0xdc) returned 1 [0247.977] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0247.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0247.978] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0247.978] GetTickCount () returned 0x4d632 [0247.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0247.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0247.979] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978\\...."), lpSecurityAttributes=0x256210) returned 1 [0247.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978\\....\\temporaryfile")) returned 0 [0247.979] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978\\temporaryfile")) returned 1 [0247.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0247.981] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.981] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.981] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.981] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.981] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.981] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978\\temporaryfile")) returned 1 [0247.981] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98bfc320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98bfc320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98bfc320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.981] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0247.981] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316978" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316978")) returned 1 [0247.981] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 0 [0247.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.982] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6890*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6890*, lpNumberOfBytesWritten=0x18fdd8*=0x1e10, lpOverlapped=0x0) returned 1 [0247.983] CloseHandle (hObject=0xdc) returned 1 [0247.983] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.984] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2e73 [0247.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e7b) returned 0x2b4a70 [0247.984] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2e73, lpOverlapped=0x0) returned 1 [0247.985] CloseHandle (hObject=0xdc) returned 1 [0247.985] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0247.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0247.986] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0247.986] GetTickCount () returned 0x4d642 [0247.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0247.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0247.987] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994\\...."), lpSecurityAttributes=0x256228) returned 1 [0247.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994\\....\\temporaryfile")) returned 0 [0247.987] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994\\temporaryfile")) returned 1 [0247.988] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0247.988] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.988] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.988] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.988] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.988] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.989] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.989] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994\\temporaryfile")) returned 1 [0247.989] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.989] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0247.989] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994")) returned 1 [0247.989] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 0 [0247.989] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.990] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7900*, nNumberOfBytesToWrite=0x2e78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7900*, lpNumberOfBytesWritten=0x18fdd8*=0x2e78, lpOverlapped=0x0) returned 1 [0247.991] CloseHandle (hObject=0xdc) returned 1 [0247.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.991] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x205 [0247.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20d) returned 0x28f1f8 [0247.991] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x205, lpOverlapped=0x0) returned 1 [0247.992] CloseHandle (hObject=0xdc) returned 1 [0247.992] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0247.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0247.993] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0247.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0247.993] GetTickCount () returned 0x4d642 [0247.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0247.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0247.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0247.994] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994\\...."), lpSecurityAttributes=0x256210) returned 1 [0247.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994\\....\\temporaryfile")) returned 0 [0247.994] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994\\temporaryfile")) returned 1 [0247.995] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0247.996] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.996] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0247.996] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0247.996] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.996] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0247.996] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0247.996] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994\\temporaryfile")) returned 1 [0247.997] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c22480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c22480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c22480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0247.997] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0247.997] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18316994" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18316994")) returned 1 [0247.997] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 0 [0247.997] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.997] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x210, lpOverlapped=0x0) returned 1 [0247.998] CloseHandle (hObject=0xdc) returned 1 [0247.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0247.999] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f6 [0247.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1fe) returned 0x28f1f8 [0247.999] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x1f6, lpOverlapped=0x0) returned 1 [0248.000] CloseHandle (hObject=0xdc) returned 1 [0248.000] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0248.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.001] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.001] GetTickCount () returned 0x4d651 [0248.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.001] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.001] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009\\....\\temporaryfile")) returned 0 [0248.002] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009\\temporaryfile")) returned 1 [0248.003] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.003] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.003] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.003] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.003] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.003] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.003] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.003] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009\\temporaryfile")) returned 1 [0248.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.004] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.004] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009")) returned 1 [0248.004] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 0 [0248.004] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.004] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x200, lpOverlapped=0x0) returned 1 [0248.005] CloseHandle (hObject=0xdc) returned 1 [0248.005] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.006] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x319e [0248.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x31a6) returned 0x2b4a70 [0248.006] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x319e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x319e, lpOverlapped=0x0) returned 1 [0248.008] CloseHandle (hObject=0xdc) returned 1 [0248.008] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0248.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.009] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.009] GetTickCount () returned 0x4d651 [0248.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.009] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.009] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009\\....\\temporaryfile")) returned 0 [0248.010] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009\\temporaryfile")) returned 1 [0248.011] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.011] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.011] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.011] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.011] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.011] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.012] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.012] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009\\temporaryfile")) returned 1 [0248.012] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c485e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c485e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c485e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.012] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.012] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317009" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317009")) returned 1 [0248.012] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 0 [0248.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.013] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7c28*, nNumberOfBytesToWrite=0x31a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7c28*, lpNumberOfBytesWritten=0x18fdd8*=0x31a8, lpOverlapped=0x0) returned 1 [0248.014] CloseHandle (hObject=0xdc) returned 1 [0248.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.015] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd9c [0248.015] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xda4) returned 0x2350048 [0248.015] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd9c, lpOverlapped=0x0) returned 1 [0248.016] CloseHandle (hObject=0xdc) returned 1 [0248.016] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0248.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.017] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.017] GetTickCount () returned 0x4d661 [0248.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.018] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.018] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317025\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317025\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317025\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317025\\....\\temporaryfile")) returned 0 [0248.018] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317025\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317025\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317025\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317025\\temporaryfile")) returned 1 [0248.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317025\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c6e740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c6e740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c6e740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.022] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c6e740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c6e740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c6e740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.022] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c6e740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c6e740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c6e740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317025\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c6e740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c6e740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c6e740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.023] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c6e740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c6e740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c6e740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.023] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c6e740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c6e740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c6e740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.023] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317025\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317025\\temporaryfile")) returned 1 [0248.023] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c6e740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c6e740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c6e740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.023] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317025" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317025")) returned 1 [0248.023] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 0 [0248.023] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.024] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xda0, lpOverlapped=0x0) returned 1 [0248.025] CloseHandle (hObject=0xdc) returned 1 [0248.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.025] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc44 [0248.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc4c) returned 0x2350048 [0248.025] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xc44, lpOverlapped=0x0) returned 1 [0248.027] CloseHandle (hObject=0xdc) returned 1 [0248.027] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0248.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.028] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.028] GetTickCount () returned 0x4d670 [0248.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.028] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317040\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317040\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317040\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317040\\....\\temporaryfile")) returned 0 [0248.029] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317040\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317040\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317040\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317040\\temporaryfile")) returned 1 [0248.030] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317040\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c948a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c948a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c948a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.030] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c948a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c948a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c948a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.030] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c948a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c948a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c948a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.030] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317040\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c948a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c948a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c948a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.030] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c948a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c948a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c948a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.030] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c948a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c948a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c948a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.030] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.030] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317040\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317040\\temporaryfile")) returned 1 [0248.031] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98c948a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98c948a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98c948a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.031] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.031] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317040" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317040")) returned 1 [0248.031] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 0 [0248.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.032] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xc48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xc48, lpOverlapped=0x0) returned 1 [0248.032] CloseHandle (hObject=0xdc) returned 1 [0248.033] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.033] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30c2 [0248.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30ca) returned 0x2b4a70 [0248.033] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x30c2, lpOverlapped=0x0) returned 1 [0248.143] CloseHandle (hObject=0xdc) returned 1 [0248.143] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0248.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.145] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.145] GetTickCount () returned 0x4d6de [0248.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.145] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317150\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317150\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317150\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317150\\....\\temporaryfile")) returned 0 [0248.146] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317150\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317150\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317150\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317150\\temporaryfile")) returned 1 [0248.147] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317150\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98d9f240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98d9f240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98d9f240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.147] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98d9f240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98d9f240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98d9f240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.147] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98d9f240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98d9f240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98d9f240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.147] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317150\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98d9f240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98d9f240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98d9f240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.148] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98d9f240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98d9f240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98d9f240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.148] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98d9f240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98d9f240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98d9f240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.148] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.148] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317150\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317150\\temporaryfile")) returned 1 [0248.148] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98d9f240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98d9f240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98d9f240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.148] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.148] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317150" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317150")) returned 1 [0248.148] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 0 [0248.149] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.149] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7b50*, nNumberOfBytesToWrite=0x30c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7b50*, lpNumberOfBytesWritten=0x18fdd8*=0x30c8, lpOverlapped=0x0) returned 1 [0248.150] CloseHandle (hObject=0xdc) returned 1 [0248.150] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.151] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1485 [0248.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x148d) returned 0x29b460 [0248.151] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1485, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1485, lpOverlapped=0x0) returned 1 [0248.152] CloseHandle (hObject=0xdc) returned 1 [0248.152] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0248.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.153] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.153] GetTickCount () returned 0x4d6ed [0248.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.154] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165\\....\\temporaryfile")) returned 0 [0248.154] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165\\temporaryfile")) returned 1 [0248.156] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.156] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.156] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.156] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.156] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.156] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.156] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.156] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165\\temporaryfile")) returned 1 [0248.156] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.156] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.156] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165")) returned 1 [0248.157] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 0 [0248.157] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.157] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1490, lpOverlapped=0x0) returned 1 [0248.158] CloseHandle (hObject=0xdc) returned 1 [0248.158] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.160] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa24 [0248.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa2c) returned 0x2350048 [0248.160] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xa24, lpOverlapped=0x0) returned 1 [0248.161] CloseHandle (hObject=0xdc) returned 1 [0248.161] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0248.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.162] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.162] GetTickCount () returned 0x4d6ed [0248.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.163] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165\\....\\temporaryfile")) returned 0 [0248.163] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165\\temporaryfile")) returned 1 [0248.164] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.165] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.165] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.165] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.165] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.165] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.165] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.165] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165\\temporaryfile")) returned 1 [0248.165] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98dc53a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98dc53a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98dc53a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.165] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.165] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317165" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317165")) returned 1 [0248.165] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 0 [0248.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.166] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xa28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xa28, lpOverlapped=0x0) returned 1 [0248.167] CloseHandle (hObject=0xdc) returned 1 [0248.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.168] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x296f [0248.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2977) returned 0x2b4a70 [0248.168] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x296f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x296f, lpOverlapped=0x0) returned 1 [0248.178] CloseHandle (hObject=0xdc) returned 1 [0248.178] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0248.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.179] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.179] GetTickCount () returned 0x4d6fd [0248.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.180] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317181\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317181\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317181\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317181\\....\\temporaryfile")) returned 0 [0248.180] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317181\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317181\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317181\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317181\\temporaryfile")) returned 1 [0248.181] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317181\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98deb500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98deb500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98deb500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.182] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98deb500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98deb500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98deb500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.182] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98deb500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98deb500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98deb500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.182] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317181\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98deb500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98deb500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98deb500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.182] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98deb500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98deb500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98deb500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.182] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98deb500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98deb500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98deb500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.182] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.182] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317181\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317181\\temporaryfile")) returned 1 [0248.182] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98deb500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98deb500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98deb500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.182] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.182] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317181" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317181")) returned 1 [0248.182] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 0 [0248.183] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.184] WriteFile (in: hFile=0xdc, lpBuffer=0x2b73f8*, nNumberOfBytesToWrite=0x2978, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b73f8*, lpNumberOfBytesWritten=0x18fdd8*=0x2978, lpOverlapped=0x0) returned 1 [0248.185] CloseHandle (hObject=0xdc) returned 1 [0248.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.185] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3bcc [0248.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3bd4) returned 0x2b4a70 [0248.185] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3bcc, lpOverlapped=0x0) returned 1 [0248.189] CloseHandle (hObject=0xdc) returned 1 [0248.189] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0248.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.190] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.190] GetTickCount () returned 0x4d70c [0248.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.190] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196\\....\\temporaryfile")) returned 0 [0248.191] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196\\temporaryfile")) returned 1 [0248.192] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.192] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.192] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.192] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.192] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.192] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.192] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.192] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196\\temporaryfile")) returned 1 [0248.193] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.193] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.193] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196")) returned 1 [0248.193] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 0 [0248.193] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.194] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8658*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8658*, lpNumberOfBytesWritten=0x18fdd8*=0x3bd0, lpOverlapped=0x0) returned 1 [0248.195] CloseHandle (hObject=0xdc) returned 1 [0248.195] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.195] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14c3 [0248.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14cb) returned 0x29b460 [0248.195] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x14c3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x14c3, lpOverlapped=0x0) returned 1 [0248.197] CloseHandle (hObject=0xdc) returned 1 [0248.197] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0248.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.198] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.198] GetTickCount () returned 0x4d70c [0248.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.198] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196\\....\\temporaryfile")) returned 0 [0248.199] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196\\temporaryfile")) returned 1 [0248.200] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e377c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e377c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.200] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e377c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e377c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.201] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.201] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.201] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.201] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.201] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.201] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196\\temporaryfile")) returned 1 [0248.201] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e11660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e11660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e11660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.201] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.201] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317196" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317196")) returned 1 [0248.201] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 0 [0248.202] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.202] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x14c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x14c8, lpOverlapped=0x0) returned 1 [0248.203] CloseHandle (hObject=0xdc) returned 1 [0248.203] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.203] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x135b [0248.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1363) returned 0x25b528 [0248.204] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x135b, lpOverlapped=0x0) returned 1 [0248.205] CloseHandle (hObject=0xdc) returned 1 [0248.205] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0248.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.207] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.207] GetTickCount () returned 0x4d71c [0248.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.207] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317212\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317212\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317212\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317212\\....\\temporaryfile")) returned 0 [0248.208] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317212\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317212\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317212\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317212\\temporaryfile")) returned 1 [0248.209] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317212\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e377c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e377c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e377c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.209] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e377c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e377c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e377c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.209] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e377c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e377c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e377c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.209] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317212\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e377c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e377c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e377c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.209] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e377c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e377c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e377c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.209] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e377c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e377c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e377c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.209] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.209] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317212\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317212\\temporaryfile")) returned 1 [0248.210] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e377c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e377c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e377c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.210] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.210] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317212" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317212")) returned 1 [0248.210] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 0 [0248.210] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.211] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1360, lpOverlapped=0x0) returned 1 [0248.211] CloseHandle (hObject=0xdc) returned 1 [0248.212] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.212] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13a6 [0248.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13ae) returned 0x25b528 [0248.212] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13a6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13a6, lpOverlapped=0x0) returned 1 [0248.214] CloseHandle (hObject=0xdc) returned 1 [0248.214] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0248.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.215] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.215] GetTickCount () returned 0x4d72c [0248.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.215] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228\\....\\temporaryfile")) returned 0 [0248.216] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228\\temporaryfile")) returned 1 [0248.217] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.217] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.217] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.217] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.217] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.217] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.217] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.217] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228\\temporaryfile")) returned 1 [0248.218] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.218] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.218] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228")) returned 1 [0248.218] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 0 [0248.218] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.219] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x13b0, lpOverlapped=0x0) returned 1 [0248.219] CloseHandle (hObject=0xdc) returned 1 [0248.220] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.220] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x47a [0248.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x482) returned 0x259e70 [0248.220] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x47a, lpOverlapped=0x0) returned 1 [0248.222] CloseHandle (hObject=0xdc) returned 1 [0248.222] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0248.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.222] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.223] GetTickCount () returned 0x4d72c [0248.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.223] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.224] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228\\....\\temporaryfile")) returned 0 [0248.224] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228\\temporaryfile")) returned 1 [0248.225] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.225] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.225] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.225] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.225] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.225] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.225] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.225] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228\\temporaryfile")) returned 1 [0248.226] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e5d920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e5d920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e5d920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.226] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.226] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317228" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317228")) returned 1 [0248.226] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 0 [0248.226] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.226] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x480, lpOverlapped=0x0) returned 1 [0248.227] CloseHandle (hObject=0xdc) returned 1 [0248.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.228] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d9f [0248.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1da7) returned 0x2b4a70 [0248.228] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1d9f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1d9f, lpOverlapped=0x0) returned 1 [0248.229] CloseHandle (hObject=0xdc) returned 1 [0248.229] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0248.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.230] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.230] GetTickCount () returned 0x4d73b [0248.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.231] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243\\....\\temporaryfile")) returned 0 [0248.231] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243\\temporaryfile")) returned 1 [0248.232] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.232] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.233] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.233] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.233] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.233] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.233] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.233] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243\\temporaryfile")) returned 1 [0248.233] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.233] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.233] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243")) returned 1 [0248.233] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 0 [0248.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.234] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6828*, nNumberOfBytesToWrite=0x1da8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6828*, lpNumberOfBytesWritten=0x18fdd8*=0x1da8, lpOverlapped=0x0) returned 1 [0248.235] CloseHandle (hObject=0xdc) returned 1 [0248.235] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.238] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b48 [0248.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b50) returned 0x2b4a70 [0248.238] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1b48, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b48, lpOverlapped=0x0) returned 1 [0248.239] CloseHandle (hObject=0xdc) returned 1 [0248.239] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0248.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.240] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.240] GetTickCount () returned 0x4d73b [0248.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.241] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.241] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243\\....\\temporaryfile")) returned 0 [0248.241] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243\\temporaryfile")) returned 1 [0248.242] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.243] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.243] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.243] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.243] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.243] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.243] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243\\temporaryfile")) returned 1 [0248.243] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98e83a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98e83a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98e83a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.243] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317243" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317243")) returned 1 [0248.243] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 0 [0248.244] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.244] WriteFile (in: hFile=0xdc, lpBuffer=0x2b65d0*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b65d0*, lpNumberOfBytesWritten=0x18fdd8*=0x1b50, lpOverlapped=0x0) returned 1 [0248.245] CloseHandle (hObject=0xdc) returned 1 [0248.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.246] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x33c6 [0248.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x33ce) returned 0x2b4a70 [0248.246] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x33c6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x33c6, lpOverlapped=0x0) returned 1 [0248.247] CloseHandle (hObject=0xdc) returned 1 [0248.247] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0248.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.248] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.248] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.248] GetTickCount () returned 0x4d74b [0248.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.249] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.249] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259\\....\\temporaryfile")) returned 0 [0248.250] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259\\temporaryfile")) returned 1 [0248.251] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.251] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.251] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.251] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.251] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.251] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.251] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.251] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259\\temporaryfile")) returned 1 [0248.251] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.251] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.251] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259")) returned 1 [0248.251] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 0 [0248.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.252] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7e50*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7e50*, lpNumberOfBytesWritten=0x18fdd8*=0x33d0, lpOverlapped=0x0) returned 1 [0248.253] CloseHandle (hObject=0xdc) returned 1 [0248.253] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.254] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2186 [0248.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x218e) returned 0x2b4a70 [0248.254] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2186, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2186, lpOverlapped=0x0) returned 1 [0248.256] CloseHandle (hObject=0xdc) returned 1 [0248.256] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0248.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.257] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.257] GetTickCount () returned 0x4d74b [0248.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.260] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.261] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259\\....\\temporaryfile")) returned 0 [0248.261] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259\\temporaryfile")) returned 1 [0248.262] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.262] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.262] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.262] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.262] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.263] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.263] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259\\temporaryfile")) returned 1 [0248.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ea9be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ea9be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ea9be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.263] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317259" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317259")) returned 1 [0248.263] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 0 [0248.263] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.264] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6c10*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6c10*, lpNumberOfBytesWritten=0x18fdd8*=0x2190, lpOverlapped=0x0) returned 1 [0248.265] CloseHandle (hObject=0xdc) returned 1 [0248.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.265] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x131e [0248.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1326) returned 0x25b528 [0248.265] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x131e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x131e, lpOverlapped=0x0) returned 1 [0248.267] CloseHandle (hObject=0xdc) returned 1 [0248.267] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0248.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.268] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.268] GetTickCount () returned 0x4d75a [0248.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.268] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274\\....\\temporaryfile")) returned 0 [0248.269] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274\\temporaryfile")) returned 1 [0248.270] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.270] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.270] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.270] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.270] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.270] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.270] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.271] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274\\temporaryfile")) returned 1 [0248.271] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.271] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.271] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274")) returned 1 [0248.271] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 0 [0248.271] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.272] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1328, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1328, lpOverlapped=0x0) returned 1 [0248.273] CloseHandle (hObject=0xdc) returned 1 [0248.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.273] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14ff [0248.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1507) returned 0x29b460 [0248.273] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x14ff, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x14ff, lpOverlapped=0x0) returned 1 [0248.275] CloseHandle (hObject=0xdc) returned 1 [0248.275] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0248.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.275] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.276] GetTickCount () returned 0x4d75a [0248.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.276] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.277] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274\\....\\temporaryfile")) returned 0 [0248.277] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274\\temporaryfile")) returned 1 [0248.278] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ef5ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ef5ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.278] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ef5ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ef5ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.278] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.278] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.278] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.279] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.279] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.279] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274\\temporaryfile")) returned 1 [0248.279] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ecfd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ecfd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ecfd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.279] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.279] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317274" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317274")) returned 1 [0248.279] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 0 [0248.279] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.280] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x1508, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1508, lpOverlapped=0x0) returned 1 [0248.281] CloseHandle (hObject=0xdc) returned 1 [0248.281] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.281] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2420 [0248.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2428) returned 0x2b4a70 [0248.281] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2420, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2420, lpOverlapped=0x0) returned 1 [0248.283] CloseHandle (hObject=0xdc) returned 1 [0248.283] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0248.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.284] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.284] GetTickCount () returned 0x4d76a [0248.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.284] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.285] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290\\....\\temporaryfile")) returned 0 [0248.285] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290\\temporaryfile")) returned 1 [0248.286] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ef5ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ef5ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ef5ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.286] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ef5ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ef5ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ef5ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.286] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ef5ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ef5ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ef5ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.286] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ef5ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ef5ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ef5ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.286] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ef5ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ef5ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ef5ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.286] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ef5ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ef5ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ef5ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.286] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.286] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290\\temporaryfile")) returned 1 [0248.287] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ef5ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98ef5ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98ef5ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.287] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.287] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290")) returned 1 [0248.287] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 0 [0248.287] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.288] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6ea8*, nNumberOfBytesToWrite=0x2428, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6ea8*, lpNumberOfBytesWritten=0x18fdd8*=0x2428, lpOverlapped=0x0) returned 1 [0248.289] CloseHandle (hObject=0xdc) returned 1 [0248.289] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.289] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1398 [0248.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13a0) returned 0x25b528 [0248.289] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1398, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1398, lpOverlapped=0x0) returned 1 [0248.290] CloseHandle (hObject=0xdc) returned 1 [0248.291] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0248.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.292] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.292] GetTickCount () returned 0x4d76a [0248.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.293] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290\\....\\temporaryfile")) returned 0 [0248.293] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290\\temporaryfile")) returned 1 [0248.294] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ef5ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.294] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98ef5ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.294] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.294] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.295] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.295] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.295] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.295] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290\\temporaryfile")) returned 1 [0248.295] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.295] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.295] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317290" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317290")) returned 1 [0248.295] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 0 [0248.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.296] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x13a0, lpOverlapped=0x0) returned 1 [0248.297] CloseHandle (hObject=0xdc) returned 1 [0248.297] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.298] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1126 [0248.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x112e) returned 0x25b528 [0248.298] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1126, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1126, lpOverlapped=0x0) returned 1 [0248.299] CloseHandle (hObject=0xdc) returned 1 [0248.299] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0248.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.300] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.300] GetTickCount () returned 0x4d77a [0248.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.301] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317306\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317306\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317306\\....\\temporaryfile")) returned 0 [0248.302] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317306\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317306\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317306\\temporaryfile")) returned 1 [0248.303] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317306\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.303] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.303] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.303] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317306\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.303] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.303] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.303] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.303] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317306\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317306\\temporaryfile")) returned 1 [0248.304] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f1c000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f1c000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f1c000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.304] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.304] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317306" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317306")) returned 1 [0248.304] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 0 [0248.304] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.305] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1130, lpOverlapped=0x0) returned 1 [0248.305] CloseHandle (hObject=0xdc) returned 1 [0248.306] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.306] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf7e [0248.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf86) returned 0x2350048 [0248.306] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xf7e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xf7e, lpOverlapped=0x0) returned 1 [0248.307] CloseHandle (hObject=0xdc) returned 1 [0248.308] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0248.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.309] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.309] GetTickCount () returned 0x4d789 [0248.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.309] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321\\....\\temporaryfile")) returned 0 [0248.310] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321\\temporaryfile")) returned 1 [0248.311] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.311] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.311] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.311] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.311] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.311] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.311] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.311] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321\\temporaryfile")) returned 1 [0248.311] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.312] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.312] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321")) returned 1 [0248.312] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 0 [0248.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.312] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xf88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xf88, lpOverlapped=0x0) returned 1 [0248.313] CloseHandle (hObject=0xdc) returned 1 [0248.313] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.314] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd32 [0248.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd3a) returned 0x2350048 [0248.314] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd32, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd32, lpOverlapped=0x0) returned 1 [0248.315] CloseHandle (hObject=0xdc) returned 1 [0248.315] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0248.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.316] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.316] GetTickCount () returned 0x4d789 [0248.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.317] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.317] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321\\....\\temporaryfile")) returned 0 [0248.317] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321\\temporaryfile")) returned 1 [0248.319] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.319] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.319] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.319] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.319] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.319] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.319] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.319] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321\\temporaryfile")) returned 1 [0248.319] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f42160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f42160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f42160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.319] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.319] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317321" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317321")) returned 1 [0248.319] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 0 [0248.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.320] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd38, lpOverlapped=0x0) returned 1 [0248.321] CloseHandle (hObject=0xdc) returned 1 [0248.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.322] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc30 [0248.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc38) returned 0x2350048 [0248.322] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc30, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xc30, lpOverlapped=0x0) returned 1 [0248.324] CloseHandle (hObject=0xdc) returned 1 [0248.324] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0248.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.325] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.325] GetTickCount () returned 0x4d799 [0248.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.325] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.326] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337\\....\\temporaryfile")) returned 0 [0248.326] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337\\temporaryfile")) returned 1 [0248.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.327] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.327] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.327] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.327] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337\\temporaryfile")) returned 1 [0248.328] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.328] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.328] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337")) returned 1 [0248.328] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 0 [0248.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.328] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xc38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xc38, lpOverlapped=0x0) returned 1 [0248.329] CloseHandle (hObject=0xdc) returned 1 [0248.329] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.330] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbd2 [0248.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbda) returned 0x2350048 [0248.331] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xbd2, lpOverlapped=0x0) returned 1 [0248.332] CloseHandle (hObject=0xdc) returned 1 [0248.332] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0248.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.333] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.333] GetTickCount () returned 0x4d799 [0248.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.333] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337\\....\\temporaryfile")) returned 0 [0248.334] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337\\temporaryfile")) returned 1 [0248.335] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.335] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.335] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.335] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.336] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.336] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.336] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337\\temporaryfile")) returned 1 [0248.336] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f682c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f682c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f682c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.336] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317337" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317337")) returned 1 [0248.336] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 0 [0248.336] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.339] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xbd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xbd8, lpOverlapped=0x0) returned 1 [0248.340] CloseHandle (hObject=0xdc) returned 1 [0248.340] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.340] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x127e [0248.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1286) returned 0x25b528 [0248.340] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x127e, lpOverlapped=0x0) returned 1 [0248.342] CloseHandle (hObject=0xdc) returned 1 [0248.342] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0248.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.343] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.343] GetTickCount () returned 0x4d7a8 [0248.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.343] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352\\....\\temporaryfile")) returned 0 [0248.344] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352\\temporaryfile")) returned 1 [0248.345] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.345] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.345] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.345] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.345] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.345] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.345] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.345] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352\\temporaryfile")) returned 1 [0248.345] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.345] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.346] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352")) returned 1 [0248.346] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 0 [0248.346] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.346] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1288, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1288, lpOverlapped=0x0) returned 1 [0248.347] CloseHandle (hObject=0xdc) returned 1 [0248.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.349] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1634 [0248.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x163c) returned 0x2b4a70 [0248.349] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1634, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1634, lpOverlapped=0x0) returned 1 [0248.350] CloseHandle (hObject=0xdc) returned 1 [0248.350] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0248.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.351] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.351] GetTickCount () returned 0x4d7a8 [0248.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.352] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352\\....\\temporaryfile")) returned 0 [0248.352] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352\\temporaryfile")) returned 1 [0248.353] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.354] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.354] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.354] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.354] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.354] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.354] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.354] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352\\temporaryfile")) returned 1 [0248.354] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98f8e420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98f8e420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98f8e420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.354] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.354] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317352" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317352")) returned 1 [0248.354] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 0 [0248.355] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.355] WriteFile (in: hFile=0xdc, lpBuffer=0x2b60c0*, nNumberOfBytesToWrite=0x1638, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b60c0*, lpNumberOfBytesWritten=0x18fdd8*=0x1638, lpOverlapped=0x0) returned 1 [0248.356] CloseHandle (hObject=0xdc) returned 1 [0248.356] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.357] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5062 [0248.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x506a) returned 0x2b4a70 [0248.357] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5062, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x5062, lpOverlapped=0x0) returned 1 [0248.358] CloseHandle (hObject=0xdc) returned 1 [0248.358] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0248.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.359] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.359] GetTickCount () returned 0x4d7b8 [0248.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.360] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368\\....\\temporaryfile")) returned 0 [0248.361] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368\\temporaryfile")) returned 1 [0248.362] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.362] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.362] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.362] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.362] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368\\temporaryfile")) returned 1 [0248.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.362] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368")) returned 1 [0248.363] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 0 [0248.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.364] WriteFile (in: hFile=0xdc, lpBuffer=0x2b9af0*, nNumberOfBytesToWrite=0x5068, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b9af0*, lpNumberOfBytesWritten=0x18fdd8*=0x5068, lpOverlapped=0x0) returned 1 [0248.365] CloseHandle (hObject=0xdc) returned 1 [0248.365] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.366] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a50 [0248.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a58) returned 0x2b4a70 [0248.366] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2a50, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2a50, lpOverlapped=0x0) returned 1 [0248.367] CloseHandle (hObject=0xdc) returned 1 [0248.367] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0248.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.368] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.368] GetTickCount () returned 0x4d7b8 [0248.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.369] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368\\....\\temporaryfile")) returned 0 [0248.370] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368\\temporaryfile")) returned 1 [0248.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.371] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.371] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.371] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.371] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.371] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.371] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368\\temporaryfile")) returned 1 [0248.371] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fb4580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fb4580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fb4580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.372] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.372] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317368" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317368")) returned 1 [0248.372] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 0 [0248.372] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.373] WriteFile (in: hFile=0xdc, lpBuffer=0x2b74d8*, nNumberOfBytesToWrite=0x2a58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b74d8*, lpNumberOfBytesWritten=0x18fdd8*=0x2a58, lpOverlapped=0x0) returned 1 [0248.373] CloseHandle (hObject=0xdc) returned 1 [0248.374] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.374] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x385c [0248.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3864) returned 0x2b4a70 [0248.374] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x385c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x385c, lpOverlapped=0x0) returned 1 [0248.376] CloseHandle (hObject=0xdc) returned 1 [0248.376] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0248.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.377] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.377] GetTickCount () returned 0x4d7c8 [0248.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.377] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317384\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317384\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317384\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317384\\....\\temporaryfile")) returned 0 [0248.378] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317384\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317384\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317384\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317384\\temporaryfile")) returned 1 [0248.382] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317384\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fda6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fda6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fda6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.382] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fda6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fda6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fda6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.382] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fda6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fda6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fda6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.382] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317384\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fda6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fda6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fda6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.382] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fda6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fda6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fda6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.382] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fda6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fda6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fda6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.382] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.382] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317384\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317384\\temporaryfile")) returned 1 [0248.383] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x98fda6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x98fda6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x98fda6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.383] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.383] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317384" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317384")) returned 1 [0248.383] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 0 [0248.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.384] WriteFile (in: hFile=0xdc, lpBuffer=0x2b82e8*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b82e8*, lpNumberOfBytesWritten=0x18fdd8*=0x3860, lpOverlapped=0x0) returned 1 [0248.385] CloseHandle (hObject=0xdc) returned 1 [0248.385] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.385] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ba0 [0248.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ba8) returned 0x2b4a70 [0248.385] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1ba0, lpOverlapped=0x0) returned 1 [0248.387] CloseHandle (hObject=0xdc) returned 1 [0248.387] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0248.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.388] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.388] GetTickCount () returned 0x4d7d7 [0248.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.389] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399\\....\\temporaryfile")) returned 0 [0248.389] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399\\temporaryfile")) returned 1 [0248.390] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.390] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.390] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.390] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.390] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.390] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.391] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.391] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399\\temporaryfile")) returned 1 [0248.391] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.391] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.391] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399")) returned 1 [0248.391] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 0 [0248.391] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.392] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6628*, nNumberOfBytesToWrite=0x1ba8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6628*, lpNumberOfBytesWritten=0x18fdd8*=0x1ba8, lpOverlapped=0x0) returned 1 [0248.393] CloseHandle (hObject=0xdc) returned 1 [0248.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.393] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd10 [0248.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd18) returned 0x2350048 [0248.393] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd10, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd10, lpOverlapped=0x0) returned 1 [0248.395] CloseHandle (hObject=0xdc) returned 1 [0248.395] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0248.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.396] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.396] GetTickCount () returned 0x4d7d7 [0248.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.397] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399\\....\\temporaryfile")) returned 0 [0248.397] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399\\temporaryfile")) returned 1 [0248.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.399] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.399] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.399] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.399] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399\\temporaryfile")) returned 1 [0248.399] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99000840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99000840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99000840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.399] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317399" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317399")) returned 1 [0248.399] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 0 [0248.400] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.400] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd18, lpOverlapped=0x0) returned 1 [0248.401] CloseHandle (hObject=0xdc) returned 1 [0248.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.401] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x63c [0248.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x644) returned 0x259e70 [0248.401] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x63c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x63c, lpOverlapped=0x0) returned 1 [0248.403] CloseHandle (hObject=0xdc) returned 1 [0248.403] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0248.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.404] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.404] GetTickCount () returned 0x4d7e7 [0248.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.405] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415\\....\\temporaryfile")) returned 0 [0248.405] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415\\temporaryfile")) returned 1 [0248.406] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.406] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.406] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.406] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.407] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.407] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.407] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.407] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415\\temporaryfile")) returned 1 [0248.407] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.407] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.407] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415")) returned 1 [0248.407] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 0 [0248.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.408] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x640, lpOverlapped=0x0) returned 1 [0248.409] CloseHandle (hObject=0xdc) returned 1 [0248.409] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.410] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f20 [0248.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f28) returned 0x2b4a70 [0248.410] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1f20, lpOverlapped=0x0) returned 1 [0248.411] CloseHandle (hObject=0xdc) returned 1 [0248.411] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0248.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.412] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.412] GetTickCount () returned 0x4d7e7 [0248.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.413] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415\\....\\temporaryfile")) returned 0 [0248.414] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415\\temporaryfile")) returned 1 [0248.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.415] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.415] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.415] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415\\temporaryfile")) returned 1 [0248.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990269a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990269a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990269a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.415] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317415" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317415")) returned 1 [0248.416] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 0 [0248.416] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.416] WriteFile (in: hFile=0xdc, lpBuffer=0x2b69a8*, nNumberOfBytesToWrite=0x1f28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b69a8*, lpNumberOfBytesWritten=0x18fdd8*=0x1f28, lpOverlapped=0x0) returned 1 [0248.417] CloseHandle (hObject=0xdc) returned 1 [0248.417] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.418] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x728 [0248.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x730) returned 0x2350048 [0248.418] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x728, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x728, lpOverlapped=0x0) returned 1 [0248.419] CloseHandle (hObject=0xdc) returned 1 [0248.419] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0248.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.420] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.420] GetTickCount () returned 0x4d7f6 [0248.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.421] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.421] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430\\....\\temporaryfile")) returned 0 [0248.421] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430\\temporaryfile")) returned 1 [0248.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.423] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.423] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.423] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430\\temporaryfile")) returned 1 [0248.423] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.423] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430")) returned 1 [0248.423] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 0 [0248.424] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.424] WriteFile (in: hFile=0xdc, lpBuffer=0x2350788*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350788*, lpNumberOfBytesWritten=0x18fdd8*=0x730, lpOverlapped=0x0) returned 1 [0248.425] CloseHandle (hObject=0xdc) returned 1 [0248.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.426] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x66dc [0248.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x66e4) returned 0x2b4a70 [0248.426] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x66dc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x66dc, lpOverlapped=0x0) returned 1 [0248.428] CloseHandle (hObject=0xdc) returned 1 [0248.428] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0248.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.429] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.429] GetTickCount () returned 0x4d7f6 [0248.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.429] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430\\....\\temporaryfile")) returned 0 [0248.430] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430\\temporaryfile")) returned 1 [0248.431] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.431] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.431] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.431] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.432] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.432] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.432] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.432] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430\\temporaryfile")) returned 1 [0248.432] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9904cb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9904cb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9904cb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.432] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.432] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317430" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317430")) returned 1 [0248.432] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 0 [0248.433] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.434] WriteFile (in: hFile=0xdc, lpBuffer=0x2bb168*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bb168*, lpNumberOfBytesWritten=0x18fdd8*=0x66e0, lpOverlapped=0x0) returned 1 [0248.435] CloseHandle (hObject=0xdc) returned 1 [0248.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.435] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6cd2 [0248.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6cda) returned 0x2b4a70 [0248.435] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6cd2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x6cd2, lpOverlapped=0x0) returned 1 [0248.437] CloseHandle (hObject=0xdc) returned 1 [0248.437] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0248.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.438] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.438] GetTickCount () returned 0x4d806 [0248.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.439] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446\\....\\temporaryfile")) returned 0 [0248.439] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446\\temporaryfile")) returned 1 [0248.440] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.440] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.440] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.440] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.440] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.441] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.441] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.441] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446\\temporaryfile")) returned 1 [0248.441] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.441] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.441] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446")) returned 1 [0248.441] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 0 [0248.442] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.442] WriteFile (in: hFile=0xdc, lpBuffer=0x2bb760*, nNumberOfBytesToWrite=0x6cd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bb760*, lpNumberOfBytesWritten=0x18fdd8*=0x6cd8, lpOverlapped=0x0) returned 1 [0248.443] CloseHandle (hObject=0xdc) returned 1 [0248.443] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.444] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xea2 [0248.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xeaa) returned 0x2350048 [0248.444] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xea2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xea2, lpOverlapped=0x0) returned 1 [0248.445] CloseHandle (hObject=0xdc) returned 1 [0248.445] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0248.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.446] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.446] GetTickCount () returned 0x4d806 [0248.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.447] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446\\....\\temporaryfile")) returned 0 [0248.447] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446\\temporaryfile")) returned 1 [0248.449] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.449] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.449] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.449] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.449] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.449] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.449] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.449] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446\\temporaryfile")) returned 1 [0248.450] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99072c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99072c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99072c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.450] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.450] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317446" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317446")) returned 1 [0248.450] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 0 [0248.450] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.451] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xea8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xea8, lpOverlapped=0x0) returned 1 [0248.451] CloseHandle (hObject=0xdc) returned 1 [0248.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.452] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16cc [0248.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16d4) returned 0x2b4a70 [0248.452] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x16cc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16cc, lpOverlapped=0x0) returned 1 [0248.454] CloseHandle (hObject=0xdc) returned 1 [0248.454] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0248.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.455] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.455] GetTickCount () returned 0x4d816 [0248.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.455] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462\\....\\temporaryfile")) returned 0 [0248.456] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462\\temporaryfile")) returned 1 [0248.457] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.457] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.457] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.457] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.457] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.457] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462\\temporaryfile")) returned 1 [0248.457] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.458] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.458] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462")) returned 1 [0248.458] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 0 [0248.458] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.458] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6158*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6158*, lpNumberOfBytesWritten=0x18fdd8*=0x16d0, lpOverlapped=0x0) returned 1 [0248.459] CloseHandle (hObject=0xdc) returned 1 [0248.460] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.460] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbc4 [0248.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbcc) returned 0x2350048 [0248.460] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xbc4, lpOverlapped=0x0) returned 1 [0248.461] CloseHandle (hObject=0xdc) returned 1 [0248.461] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0248.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.462] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.462] GetTickCount () returned 0x4d816 [0248.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.463] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462\\....\\temporaryfile")) returned 0 [0248.464] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462\\temporaryfile")) returned 1 [0248.465] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.465] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.465] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.465] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.465] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.465] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.465] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.465] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462\\temporaryfile")) returned 1 [0248.466] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99098dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99098dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99098dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.466] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.466] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317462" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317462")) returned 1 [0248.466] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 0 [0248.466] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.467] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xbc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xbc8, lpOverlapped=0x0) returned 1 [0248.467] CloseHandle (hObject=0xdc) returned 1 [0248.468] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.468] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xac4 [0248.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xacc) returned 0x2350048 [0248.468] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xac4, lpOverlapped=0x0) returned 1 [0248.469] CloseHandle (hObject=0xdc) returned 1 [0248.469] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0248.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.470] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.470] GetTickCount () returned 0x4d825 [0248.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.471] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477\\....\\temporaryfile")) returned 0 [0248.472] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477\\temporaryfile")) returned 1 [0248.473] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.473] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.473] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.473] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.473] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.473] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477\\temporaryfile")) returned 1 [0248.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.473] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.473] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477")) returned 1 [0248.474] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 0 [0248.474] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.474] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xac8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xac8, lpOverlapped=0x0) returned 1 [0248.475] CloseHandle (hObject=0xdc) returned 1 [0248.475] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.476] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ccc [0248.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1cd4) returned 0x2b4a70 [0248.476] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1ccc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1ccc, lpOverlapped=0x0) returned 1 [0248.477] CloseHandle (hObject=0xdc) returned 1 [0248.477] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0248.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.478] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.478] GetTickCount () returned 0x4d825 [0248.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.479] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477\\....\\temporaryfile")) returned 0 [0248.479] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477\\temporaryfile")) returned 1 [0248.481] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990e5080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990e5080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.481] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990e5080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990e5080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.481] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.481] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.481] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.481] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.481] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.481] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477\\temporaryfile")) returned 1 [0248.481] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990bef20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990bef20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990bef20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.481] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.481] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317477" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317477")) returned 1 [0248.481] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 0 [0248.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.482] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6758*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6758*, lpNumberOfBytesWritten=0x18fdd8*=0x1cd0, lpOverlapped=0x0) returned 1 [0248.483] CloseHandle (hObject=0xdc) returned 1 [0248.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.484] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d74 [0248.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d7c) returned 0x2b4a70 [0248.484] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1d74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1d74, lpOverlapped=0x0) returned 1 [0248.486] CloseHandle (hObject=0xdc) returned 1 [0248.486] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0248.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.487] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.487] GetTickCount () returned 0x4d835 [0248.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.487] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.488] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493\\....\\temporaryfile")) returned 0 [0248.488] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493\\temporaryfile")) returned 1 [0248.489] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990e5080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990e5080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990e5080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.489] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990e5080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990e5080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990e5080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.489] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990e5080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990e5080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990e5080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.489] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990e5080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990e5080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990e5080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.489] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990e5080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990e5080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990e5080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.489] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990e5080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990e5080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990e5080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.490] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.490] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493\\temporaryfile")) returned 1 [0248.490] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990e5080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x990e5080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x990e5080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.490] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.490] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493")) returned 1 [0248.490] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 0 [0248.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.491] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6800*, nNumberOfBytesToWrite=0x1d78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6800*, lpNumberOfBytesWritten=0x18fdd8*=0x1d78, lpOverlapped=0x0) returned 1 [0248.492] CloseHandle (hObject=0xdc) returned 1 [0248.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.492] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x19e8 [0248.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19f0) returned 0x2b4a70 [0248.492] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x19e8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x19e8, lpOverlapped=0x0) returned 1 [0248.494] CloseHandle (hObject=0xdc) returned 1 [0248.494] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0248.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.495] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.495] GetTickCount () returned 0x4d835 [0248.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.495] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493\\....\\temporaryfile")) returned 0 [0248.496] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493\\temporaryfile")) returned 1 [0248.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990e5080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x990e5080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.498] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.498] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.498] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.498] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493\\temporaryfile")) returned 1 [0248.498] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.498] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.498] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317493" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317493")) returned 1 [0248.498] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 0 [0248.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.502] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6470*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6470*, lpNumberOfBytesWritten=0x18fdd8*=0x19f0, lpOverlapped=0x0) returned 1 [0248.503] CloseHandle (hObject=0xdc) returned 1 [0248.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.504] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x83c [0248.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x844) returned 0x2350048 [0248.504] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x83c, lpOverlapped=0x0) returned 1 [0248.505] CloseHandle (hObject=0xdc) returned 1 [0248.506] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0248.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.506] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.506] GetTickCount () returned 0x4d844 [0248.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.507] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317508\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317508\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317508\\....\\temporaryfile")) returned 0 [0248.508] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317508\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317508\\temporaryfile")) returned 1 [0248.509] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317508\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.509] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.509] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.509] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317508\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.509] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.509] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.509] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.509] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317508\\temporaryfile")) returned 1 [0248.509] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9910b1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9910b1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9910b1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.510] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.510] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317508" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317508")) returned 1 [0248.510] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 0 [0248.510] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.511] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x840, lpOverlapped=0x0) returned 1 [0248.512] CloseHandle (hObject=0xdc) returned 1 [0248.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.512] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2418 [0248.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2420) returned 0x2b4a70 [0248.512] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2418, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2418, lpOverlapped=0x0) returned 1 [0248.514] CloseHandle (hObject=0xdc) returned 1 [0248.514] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0248.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.515] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.515] GetTickCount () returned 0x4d854 [0248.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.515] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.515] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524\\....\\temporaryfile")) returned 0 [0248.516] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524\\temporaryfile")) returned 1 [0248.517] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.517] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.517] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.517] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.517] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.517] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.517] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.517] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524\\temporaryfile")) returned 1 [0248.517] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.517] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.518] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524")) returned 1 [0248.518] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 0 [0248.518] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.518] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6ea0*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6ea0*, lpNumberOfBytesWritten=0x18fdd8*=0x2420, lpOverlapped=0x0) returned 1 [0248.519] CloseHandle (hObject=0xdc) returned 1 [0248.520] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.520] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x928 [0248.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x930) returned 0x2350048 [0248.520] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x928, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x928, lpOverlapped=0x0) returned 1 [0248.521] CloseHandle (hObject=0xdc) returned 1 [0248.521] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0248.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.522] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.522] GetTickCount () returned 0x4d854 [0248.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.523] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.523] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.524] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524\\....\\temporaryfile")) returned 0 [0248.524] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524\\temporaryfile")) returned 1 [0248.525] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.525] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.526] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.526] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.526] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.526] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.526] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.526] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524\\temporaryfile")) returned 1 [0248.526] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99131340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99131340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99131340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.526] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.526] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317524" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317524")) returned 1 [0248.526] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 0 [0248.527] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.527] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x930, lpOverlapped=0x0) returned 1 [0248.528] CloseHandle (hObject=0xdc) returned 1 [0248.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.529] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17ac [0248.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17b4) returned 0x2b4a70 [0248.529] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x17ac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x17ac, lpOverlapped=0x0) returned 1 [0248.530] CloseHandle (hObject=0xdc) returned 1 [0248.530] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0248.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.531] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.531] GetTickCount () returned 0x4d864 [0248.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.532] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540\\....\\temporaryfile")) returned 0 [0248.532] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540\\temporaryfile")) returned 1 [0248.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.534] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.534] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540\\temporaryfile")) returned 1 [0248.534] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.534] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540")) returned 1 [0248.534] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 0 [0248.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.535] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6238*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6238*, lpNumberOfBytesWritten=0x18fdd8*=0x17b0, lpOverlapped=0x0) returned 1 [0248.536] CloseHandle (hObject=0xdc) returned 1 [0248.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.536] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd58 [0248.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd60) returned 0x2350048 [0248.536] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd58, lpOverlapped=0x0) returned 1 [0248.538] CloseHandle (hObject=0xdc) returned 1 [0248.538] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0248.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.539] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.539] GetTickCount () returned 0x4d864 [0248.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.539] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540\\....\\temporaryfile")) returned 0 [0248.540] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540\\temporaryfile")) returned 1 [0248.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.541] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.541] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.542] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.542] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540\\temporaryfile")) returned 1 [0248.542] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991574a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991574a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991574a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.542] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.542] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317540" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317540")) returned 1 [0248.542] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 0 [0248.542] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.543] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd60, lpOverlapped=0x0) returned 1 [0248.544] CloseHandle (hObject=0xdc) returned 1 [0248.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.545] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa4c [0248.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa54) returned 0x2350048 [0248.545] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xa4c, lpOverlapped=0x0) returned 1 [0248.546] CloseHandle (hObject=0xdc) returned 1 [0248.546] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0248.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.547] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.547] GetTickCount () returned 0x4d873 [0248.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.548] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555\\....\\temporaryfile")) returned 0 [0248.548] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555\\temporaryfile")) returned 1 [0248.549] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.550] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.550] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.550] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.550] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.550] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.550] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.550] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555\\temporaryfile")) returned 1 [0248.550] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.550] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.550] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555")) returned 1 [0248.550] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 0 [0248.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.551] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xa50, lpOverlapped=0x0) returned 1 [0248.552] CloseHandle (hObject=0xdc) returned 1 [0248.552] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.553] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x19ec [0248.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19f4) returned 0x2b4a70 [0248.553] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x19ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x19ec, lpOverlapped=0x0) returned 1 [0248.554] CloseHandle (hObject=0xdc) returned 1 [0248.554] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0248.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.555] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.555] GetTickCount () returned 0x4d873 [0248.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.556] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555\\....\\temporaryfile")) returned 0 [0248.557] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555\\temporaryfile")) returned 1 [0248.558] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.558] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.558] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.558] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.558] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.558] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.558] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.558] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555\\temporaryfile")) returned 1 [0248.558] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9917d600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9917d600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9917d600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.559] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.559] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317555" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317555")) returned 1 [0248.559] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 0 [0248.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.560] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6478*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6478*, lpNumberOfBytesWritten=0x18fdd8*=0x19f0, lpOverlapped=0x0) returned 1 [0248.560] CloseHandle (hObject=0xdc) returned 1 [0248.561] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.561] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1204 [0248.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x120c) returned 0x25b528 [0248.561] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1204, lpOverlapped=0x0) returned 1 [0248.562] CloseHandle (hObject=0xdc) returned 1 [0248.562] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0248.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.563] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.563] GetTickCount () returned 0x4d883 [0248.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.564] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571\\....\\temporaryfile")) returned 0 [0248.564] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571\\temporaryfile")) returned 1 [0248.566] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.566] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.566] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.566] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.566] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.566] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.566] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.566] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571\\temporaryfile")) returned 1 [0248.566] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.566] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.566] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571")) returned 1 [0248.567] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 0 [0248.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.567] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1208, lpOverlapped=0x0) returned 1 [0248.568] CloseHandle (hObject=0xdc) returned 1 [0248.568] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.569] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc48 [0248.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc50) returned 0x2350048 [0248.569] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc48, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xc48, lpOverlapped=0x0) returned 1 [0248.570] CloseHandle (hObject=0xdc) returned 1 [0248.570] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0248.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.571] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.571] GetTickCount () returned 0x4d883 [0248.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.572] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571\\....\\temporaryfile")) returned 0 [0248.572] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571\\temporaryfile")) returned 1 [0248.574] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.574] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.574] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.574] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.574] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.574] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.574] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.574] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571\\temporaryfile")) returned 1 [0248.574] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991a3760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991a3760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991a3760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.574] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.574] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317571" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317571")) returned 1 [0248.575] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 0 [0248.575] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.575] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xc50, lpOverlapped=0x0) returned 1 [0248.576] CloseHandle (hObject=0xdc) returned 1 [0248.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.577] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1df4 [0248.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1dfc) returned 0x2b4a70 [0248.577] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1df4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1df4, lpOverlapped=0x0) returned 1 [0248.579] CloseHandle (hObject=0xdc) returned 1 [0248.579] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0248.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.580] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.580] GetTickCount () returned 0x4d892 [0248.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.580] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586\\....\\temporaryfile")) returned 0 [0248.581] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586\\temporaryfile")) returned 1 [0248.582] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.582] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.582] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.582] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.582] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.582] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.582] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.582] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586\\temporaryfile")) returned 1 [0248.583] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.583] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.583] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586")) returned 1 [0248.583] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 0 [0248.583] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.584] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6880*, nNumberOfBytesToWrite=0x1df8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6880*, lpNumberOfBytesWritten=0x18fdd8*=0x1df8, lpOverlapped=0x0) returned 1 [0248.585] CloseHandle (hObject=0xdc) returned 1 [0248.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.585] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x212c [0248.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2134) returned 0x2b4a70 [0248.585] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x212c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x212c, lpOverlapped=0x0) returned 1 [0248.587] CloseHandle (hObject=0xdc) returned 1 [0248.587] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0248.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.588] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.588] GetTickCount () returned 0x4d892 [0248.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.588] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586\\....\\temporaryfile")) returned 0 [0248.599] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586\\temporaryfile")) returned 1 [0248.600] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991efa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991efa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.600] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991efa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991efa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.601] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.601] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.601] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.601] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586\\temporaryfile")) returned 1 [0248.601] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x991c98c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x991c98c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x991c98c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.601] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317586" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317586")) returned 1 [0248.601] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 0 [0248.602] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.602] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6bb8*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6bb8*, lpNumberOfBytesWritten=0x18fdd8*=0x2130, lpOverlapped=0x0) returned 1 [0248.603] CloseHandle (hObject=0xdc) returned 1 [0248.603] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.604] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e7c [0248.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e84) returned 0x2b4a70 [0248.604] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1e7c, lpOverlapped=0x0) returned 1 [0248.605] CloseHandle (hObject=0xdc) returned 1 [0248.605] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0248.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.606] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.606] GetTickCount () returned 0x4d8b2 [0248.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.607] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.607] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618\\....\\temporaryfile")) returned 0 [0248.607] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618\\temporaryfile")) returned 1 [0248.608] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.609] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.609] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.609] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.609] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.609] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.609] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.609] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618\\temporaryfile")) returned 1 [0248.609] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.609] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.609] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618")) returned 1 [0248.609] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 0 [0248.610] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.610] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6908*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6908*, lpNumberOfBytesWritten=0x18fdd8*=0x1e80, lpOverlapped=0x0) returned 1 [0248.611] CloseHandle (hObject=0xdc) returned 1 [0248.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.612] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e7c [0248.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e84) returned 0x2b4a70 [0248.612] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1e7c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1e7c, lpOverlapped=0x0) returned 1 [0248.613] CloseHandle (hObject=0xdc) returned 1 [0248.613] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0248.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.614] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.614] GetTickCount () returned 0x4d8b2 [0248.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.615] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618\\....\\temporaryfile")) returned 0 [0248.616] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618\\temporaryfile")) returned 1 [0248.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.617] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.617] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.617] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.617] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.617] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.617] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618\\temporaryfile")) returned 1 [0248.617] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99215b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99215b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99215b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.618] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.618] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317618" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317618")) returned 1 [0248.618] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 0 [0248.618] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.619] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6908*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6908*, lpNumberOfBytesWritten=0x18fdd8*=0x1e80, lpOverlapped=0x0) returned 1 [0248.620] CloseHandle (hObject=0xdc) returned 1 [0248.620] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.621] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7e0 [0248.621] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7e8) returned 0x2350048 [0248.621] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7e0, lpOverlapped=0x0) returned 1 [0248.622] CloseHandle (hObject=0xdc) returned 1 [0248.622] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0248.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.623] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.623] GetTickCount () returned 0x4d8c1 [0248.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.624] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.624] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633\\....\\temporaryfile")) returned 0 [0248.624] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633\\temporaryfile")) returned 1 [0248.626] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.626] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.626] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.626] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.626] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.626] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.626] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.626] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633\\temporaryfile")) returned 1 [0248.626] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.626] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.626] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633")) returned 1 [0248.627] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 0 [0248.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.627] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x7e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x7e8, lpOverlapped=0x0) returned 1 [0248.628] CloseHandle (hObject=0xdc) returned 1 [0248.628] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.629] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9bc [0248.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9c4) returned 0x2350048 [0248.629] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x9bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x9bc, lpOverlapped=0x0) returned 1 [0248.631] CloseHandle (hObject=0xdc) returned 1 [0248.631] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0248.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.632] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.632] GetTickCount () returned 0x4d8c1 [0248.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.635] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633\\....\\temporaryfile")) returned 0 [0248.636] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633\\temporaryfile")) returned 1 [0248.637] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99261e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99261e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.637] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99261e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99261e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.638] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.638] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.638] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.638] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.638] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.638] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633\\temporaryfile")) returned 1 [0248.638] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9923bce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9923bce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9923bce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.638] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.638] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317633" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317633")) returned 1 [0248.638] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 0 [0248.639] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.639] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x9c0, lpOverlapped=0x0) returned 1 [0248.640] CloseHandle (hObject=0xdc) returned 1 [0248.640] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.640] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd14 [0248.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd1c) returned 0x2350048 [0248.641] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd14, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd14, lpOverlapped=0x0) returned 1 [0248.642] CloseHandle (hObject=0xdc) returned 1 [0248.642] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0248.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.643] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.643] GetTickCount () returned 0x4d8d1 [0248.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.643] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317649\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317649\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317649\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317649\\....\\temporaryfile")) returned 0 [0248.644] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317649\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317649\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317649\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317649\\temporaryfile")) returned 1 [0248.645] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317649\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99261e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99261e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99261e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.645] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99261e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99261e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99261e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.645] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99261e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99261e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99261e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.645] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317649\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99261e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99261e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99261e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.646] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99261e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99261e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99261e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.646] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99261e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99261e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99261e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.646] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.646] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317649\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317649\\temporaryfile")) returned 1 [0248.646] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99261e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99261e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99261e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.646] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.646] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317649" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317649")) returned 1 [0248.646] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 0 [0248.646] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.647] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd18, lpOverlapped=0x0) returned 1 [0248.648] CloseHandle (hObject=0xdc) returned 1 [0248.648] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.649] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10c8 [0248.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10d0) returned 0x25b528 [0248.649] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x10c8, lpOverlapped=0x0) returned 1 [0248.650] CloseHandle (hObject=0xdc) returned 1 [0248.650] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0248.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.651] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.651] GetTickCount () returned 0x4d8e0 [0248.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.652] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.652] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664\\....\\temporaryfile")) returned 0 [0248.653] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664\\temporaryfile")) returned 1 [0248.654] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.654] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.654] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.654] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.654] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.654] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.654] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.654] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664\\temporaryfile")) returned 1 [0248.654] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.654] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.654] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664")) returned 1 [0248.655] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 0 [0248.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.655] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x10d0, lpOverlapped=0x0) returned 1 [0248.656] CloseHandle (hObject=0xdc) returned 1 [0248.656] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.657] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc9c [0248.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xca4) returned 0x2350048 [0248.657] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc9c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xc9c, lpOverlapped=0x0) returned 1 [0248.658] CloseHandle (hObject=0xdc) returned 1 [0248.658] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0248.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.659] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.659] GetTickCount () returned 0x4d8e0 [0248.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.660] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664\\....\\temporaryfile")) returned 0 [0248.661] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664\\temporaryfile")) returned 1 [0248.662] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.662] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.662] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.662] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.662] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.662] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.662] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.662] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664\\temporaryfile")) returned 1 [0248.662] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99287fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99287fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99287fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.663] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.663] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317664" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317664")) returned 1 [0248.663] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 0 [0248.663] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.664] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xca0, lpOverlapped=0x0) returned 1 [0248.664] CloseHandle (hObject=0xdc) returned 1 [0248.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.665] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x12c8 [0248.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12d0) returned 0x25b528 [0248.665] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x12c8, lpOverlapped=0x0) returned 1 [0248.666] CloseHandle (hObject=0xdc) returned 1 [0248.666] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0248.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.667] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.667] GetTickCount () returned 0x4d8f0 [0248.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.668] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680\\....\\temporaryfile")) returned 0 [0248.668] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680\\temporaryfile")) returned 1 [0248.670] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.670] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.670] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.670] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.670] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.670] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.670] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680\\temporaryfile")) returned 1 [0248.670] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.670] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680")) returned 1 [0248.671] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 0 [0248.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.671] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x12d0, lpOverlapped=0x0) returned 1 [0248.672] CloseHandle (hObject=0xdc) returned 1 [0248.672] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.673] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1384 [0248.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x138c) returned 0x25b528 [0248.673] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1384, lpOverlapped=0x0) returned 1 [0248.674] CloseHandle (hObject=0xdc) returned 1 [0248.674] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0248.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.675] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.675] GetTickCount () returned 0x4d8f0 [0248.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.676] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.676] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680\\....\\temporaryfile")) returned 0 [0248.676] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680\\temporaryfile")) returned 1 [0248.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.678] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.678] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.678] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.678] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680\\temporaryfile")) returned 1 [0248.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992ae100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992ae100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992ae100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.678] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.678] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317680" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317680")) returned 1 [0248.679] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 0 [0248.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.679] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1388, lpOverlapped=0x0) returned 1 [0248.680] CloseHandle (hObject=0xdc) returned 1 [0248.680] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.681] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x138c [0248.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1394) returned 0x25b528 [0248.681] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x138c, lpOverlapped=0x0) returned 1 [0248.682] CloseHandle (hObject=0xdc) returned 1 [0248.682] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0248.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.683] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.683] GetTickCount () returned 0x4d900 [0248.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.684] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696\\....\\temporaryfile")) returned 0 [0248.684] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696\\temporaryfile")) returned 1 [0248.685] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.686] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.686] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.686] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.686] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.686] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.686] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.686] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696\\temporaryfile")) returned 1 [0248.686] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.686] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.686] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696")) returned 1 [0248.686] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 0 [0248.687] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.687] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1390, lpOverlapped=0x0) returned 1 [0248.688] CloseHandle (hObject=0xdc) returned 1 [0248.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.689] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1cd8 [0248.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ce0) returned 0x2b4a70 [0248.689] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1cd8, lpOverlapped=0x0) returned 1 [0248.690] CloseHandle (hObject=0xdc) returned 1 [0248.690] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0248.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.691] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.691] GetTickCount () returned 0x4d900 [0248.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.692] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696\\....\\temporaryfile")) returned 0 [0248.692] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696\\temporaryfile")) returned 1 [0248.693] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.694] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.694] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.694] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.694] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.694] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696\\temporaryfile")) returned 1 [0248.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992d4260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992d4260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992d4260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.694] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.694] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317696" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317696")) returned 1 [0248.694] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 0 [0248.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.695] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6760*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6760*, lpNumberOfBytesWritten=0x18fdd8*=0x1ce0, lpOverlapped=0x0) returned 1 [0248.696] CloseHandle (hObject=0xdc) returned 1 [0248.696] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.697] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1306 [0248.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x130e) returned 0x25b528 [0248.697] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1306, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1306, lpOverlapped=0x0) returned 1 [0248.699] CloseHandle (hObject=0xdc) returned 1 [0248.699] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0248.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.700] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.700] GetTickCount () returned 0x4d90f [0248.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.700] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.701] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711\\....\\temporaryfile")) returned 0 [0248.701] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711\\temporaryfile")) returned 1 [0248.702] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.702] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.702] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.702] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.702] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.702] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.702] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.702] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711\\temporaryfile")) returned 1 [0248.703] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.703] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.703] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711")) returned 1 [0248.703] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 0 [0248.703] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.704] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1310, lpOverlapped=0x0) returned 1 [0248.705] CloseHandle (hObject=0xdc) returned 1 [0248.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.705] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6906 [0248.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x690e) returned 0x2b4a70 [0248.705] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6906, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x6906, lpOverlapped=0x0) returned 1 [0248.707] CloseHandle (hObject=0xdc) returned 1 [0248.707] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0248.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.708] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.708] GetTickCount () returned 0x4d90f [0248.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.708] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711\\....\\temporaryfile")) returned 0 [0248.709] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711\\temporaryfile")) returned 1 [0248.710] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.710] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.710] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.710] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.710] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.710] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.711] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.711] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711\\temporaryfile")) returned 1 [0248.711] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x992fa3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x992fa3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x992fa3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.711] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.711] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317711" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317711")) returned 1 [0248.711] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 0 [0248.712] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.712] WriteFile (in: hFile=0xdc, lpBuffer=0x2bb390*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bb390*, lpNumberOfBytesWritten=0x18fdd8*=0x6910, lpOverlapped=0x0) returned 1 [0248.713] CloseHandle (hObject=0xdc) returned 1 [0248.713] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.714] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7114 [0248.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x711c) returned 0x2b4a70 [0248.714] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x7114, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x7114, lpOverlapped=0x0) returned 1 [0248.715] CloseHandle (hObject=0xdc) returned 1 [0248.716] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0248.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.717] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.717] GetTickCount () returned 0x4d91f [0248.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.717] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.717] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727\\....\\temporaryfile")) returned 0 [0248.718] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727\\temporaryfile")) returned 1 [0248.719] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.719] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.719] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.719] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.719] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.719] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.719] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.719] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727\\temporaryfile")) returned 1 [0248.720] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.720] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.720] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727")) returned 1 [0248.720] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 0 [0248.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.721] WriteFile (in: hFile=0xdc, lpBuffer=0x2bbba0*, nNumberOfBytesToWrite=0x7118, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bbba0*, lpNumberOfBytesWritten=0x18fdd8*=0x7118, lpOverlapped=0x0) returned 1 [0248.722] CloseHandle (hObject=0xdc) returned 1 [0248.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.723] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2d74 [0248.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d7c) returned 0x2b4a70 [0248.723] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2d74, lpOverlapped=0x0) returned 1 [0248.724] CloseHandle (hObject=0xdc) returned 1 [0248.724] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0248.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.725] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.725] GetTickCount () returned 0x4d91f [0248.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.726] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727\\....\\temporaryfile")) returned 0 [0248.727] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727\\temporaryfile")) returned 1 [0248.728] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.728] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.728] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.728] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.728] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.728] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.728] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.728] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727\\temporaryfile")) returned 1 [0248.729] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99320520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99320520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99320520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.729] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317727" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317727")) returned 1 [0248.729] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 0 [0248.729] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.730] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7800*, nNumberOfBytesToWrite=0x2d78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7800*, lpNumberOfBytesWritten=0x18fdd8*=0x2d78, lpOverlapped=0x0) returned 1 [0248.731] CloseHandle (hObject=0xdc) returned 1 [0248.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.732] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x57f4 [0248.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x57fc) returned 0x2b4a70 [0248.732] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x57f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x57f4, lpOverlapped=0x0) returned 1 [0248.733] CloseHandle (hObject=0xdc) returned 1 [0248.733] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0248.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.734] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.734] GetTickCount () returned 0x4d92e [0248.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.735] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742\\....\\temporaryfile")) returned 0 [0248.735] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742\\temporaryfile")) returned 1 [0248.736] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.737] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.737] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.737] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742\\temporaryfile")) returned 1 [0248.737] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.737] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742")) returned 1 [0248.737] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 0 [0248.738] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.738] WriteFile (in: hFile=0xdc, lpBuffer=0x2ba280*, nNumberOfBytesToWrite=0x57f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ba280*, lpNumberOfBytesWritten=0x18fdd8*=0x57f8, lpOverlapped=0x0) returned 1 [0248.739] CloseHandle (hObject=0xdc) returned 1 [0248.740] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.740] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3f34 [0248.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3f3c) returned 0x2b4a70 [0248.740] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3f34, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3f34, lpOverlapped=0x0) returned 1 [0248.741] CloseHandle (hObject=0xdc) returned 1 [0248.741] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0248.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.742] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.742] GetTickCount () returned 0x4d92e [0248.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.743] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742\\....\\temporaryfile")) returned 0 [0248.744] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742\\temporaryfile")) returned 1 [0248.745] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.745] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.745] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.745] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.745] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.745] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.745] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.746] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742\\temporaryfile")) returned 1 [0248.746] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99346680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99346680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99346680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.746] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.746] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317742" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317742")) returned 1 [0248.746] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 0 [0248.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.747] WriteFile (in: hFile=0xdc, lpBuffer=0x2b89c0*, nNumberOfBytesToWrite=0x3f38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b89c0*, lpNumberOfBytesWritten=0x18fdd8*=0x3f38, lpOverlapped=0x0) returned 1 [0248.748] CloseHandle (hObject=0xdc) returned 1 [0248.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.749] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4354 [0248.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x435c) returned 0x2b4a70 [0248.749] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4354, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4354, lpOverlapped=0x0) returned 1 [0248.750] CloseHandle (hObject=0xdc) returned 1 [0248.750] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0248.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.751] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.751] GetTickCount () returned 0x4d93e [0248.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.752] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317758\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317758\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317758\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317758\\....\\temporaryfile")) returned 0 [0248.752] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317758\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317758\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317758\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317758\\temporaryfile")) returned 1 [0248.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317758\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9936c7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9936c7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9936c7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9936c7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9936c7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9936c7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9936c7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9936c7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9936c7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.757] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317758\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9936c7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9936c7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9936c7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.757] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9936c7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9936c7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9936c7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.757] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9936c7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9936c7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9936c7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.757] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317758\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317758\\temporaryfile")) returned 1 [0248.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9936c7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9936c7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9936c7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.757] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317758" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317758")) returned 1 [0248.757] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 0 [0248.758] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.758] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8de0*, nNumberOfBytesToWrite=0x4358, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8de0*, lpNumberOfBytesWritten=0x18fdd8*=0x4358, lpOverlapped=0x0) returned 1 [0248.759] CloseHandle (hObject=0xdc) returned 1 [0248.760] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.760] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3ef0 [0248.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ef8) returned 0x2b4a70 [0248.760] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3ef0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3ef0, lpOverlapped=0x0) returned 1 [0248.762] CloseHandle (hObject=0xdc) returned 1 [0248.762] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0248.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.763] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.763] GetTickCount () returned 0x4d94e [0248.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.764] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.764] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774\\....\\temporaryfile")) returned 0 [0248.764] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774\\temporaryfile")) returned 1 [0248.765] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.765] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.765] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.765] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.765] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.766] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.766] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.766] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774\\temporaryfile")) returned 1 [0248.766] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.766] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.766] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774")) returned 1 [0248.766] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 0 [0248.767] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.767] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8978*, nNumberOfBytesToWrite=0x3ef8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8978*, lpNumberOfBytesWritten=0x18fdd8*=0x3ef8, lpOverlapped=0x0) returned 1 [0248.768] CloseHandle (hObject=0xdc) returned 1 [0248.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.769] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4124 [0248.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x412c) returned 0x2b4a70 [0248.769] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4124, lpOverlapped=0x0) returned 1 [0248.770] CloseHandle (hObject=0xdc) returned 1 [0248.771] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0248.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.771] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.772] GetTickCount () returned 0x4d94e [0248.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.772] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774\\....\\temporaryfile")) returned 0 [0248.773] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774\\temporaryfile")) returned 1 [0248.774] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.774] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.774] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.774] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.774] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.774] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.774] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.774] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774\\temporaryfile")) returned 1 [0248.775] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99392940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99392940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99392940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.775] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.775] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317774" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317774")) returned 1 [0248.775] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 0 [0248.775] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.776] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8bb0*, nNumberOfBytesToWrite=0x4128, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8bb0*, lpNumberOfBytesWritten=0x18fdd8*=0x4128, lpOverlapped=0x0) returned 1 [0248.777] CloseHandle (hObject=0xdc) returned 1 [0248.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.778] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x687c [0248.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6884) returned 0x2b4a70 [0248.778] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x687c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x687c, lpOverlapped=0x0) returned 1 [0248.779] CloseHandle (hObject=0xdc) returned 1 [0248.779] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0248.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.780] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.780] GetTickCount () returned 0x4d95d [0248.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.781] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789\\....\\temporaryfile")) returned 0 [0248.781] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789\\temporaryfile")) returned 1 [0248.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.783] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.783] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.783] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.783] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.784] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.784] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789\\temporaryfile")) returned 1 [0248.784] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.784] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.784] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789")) returned 1 [0248.784] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 0 [0248.785] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.785] WriteFile (in: hFile=0xdc, lpBuffer=0x2bb308*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bb308*, lpNumberOfBytesWritten=0x18fdd8*=0x6880, lpOverlapped=0x0) returned 1 [0248.786] CloseHandle (hObject=0xdc) returned 1 [0248.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.787] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x133c [0248.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1344) returned 0x25b528 [0248.787] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x133c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x133c, lpOverlapped=0x0) returned 1 [0248.788] CloseHandle (hObject=0xdc) returned 1 [0248.788] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0248.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.789] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.789] GetTickCount () returned 0x4d95d [0248.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.790] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.790] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789\\....\\temporaryfile")) returned 0 [0248.791] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789\\temporaryfile")) returned 1 [0248.792] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.792] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.792] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.792] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.792] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.792] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.792] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789\\temporaryfile")) returned 1 [0248.792] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993b8aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993b8aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993b8aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.792] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317789" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317789")) returned 1 [0248.793] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 0 [0248.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.793] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1340, lpOverlapped=0x0) returned 1 [0248.794] CloseHandle (hObject=0xdc) returned 1 [0248.794] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.795] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xfe2 [0248.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfea) returned 0x25f580 [0248.796] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xfe2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xfe2, lpOverlapped=0x0) returned 1 [0248.797] CloseHandle (hObject=0xdc) returned 1 [0248.797] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0248.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.798] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.798] GetTickCount () returned 0x4d96d [0248.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.798] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805\\....\\temporaryfile")) returned 0 [0248.799] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805\\temporaryfile")) returned 1 [0248.800] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.800] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.800] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.800] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.800] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.800] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.800] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.800] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805\\temporaryfile")) returned 1 [0248.801] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.801] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.801] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805")) returned 1 [0248.801] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 0 [0248.801] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.802] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xfe8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xfe8, lpOverlapped=0x0) returned 1 [0248.802] CloseHandle (hObject=0xdc) returned 1 [0248.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.803] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5f00 [0248.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5f08) returned 0x2b4a70 [0248.803] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x5f00, lpOverlapped=0x0) returned 1 [0248.804] CloseHandle (hObject=0xdc) returned 1 [0248.805] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0248.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.806] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.806] GetTickCount () returned 0x4d96d [0248.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.806] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805\\....\\temporaryfile")) returned 0 [0248.807] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805\\temporaryfile")) returned 1 [0248.808] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.808] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.808] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.808] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.808] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.809] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.809] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.809] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805\\temporaryfile")) returned 1 [0248.809] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x993dec00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x993dec00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x993dec00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.809] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.809] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317805" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317805")) returned 1 [0248.809] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 0 [0248.810] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.810] WriteFile (in: hFile=0xdc, lpBuffer=0x2ba988*, nNumberOfBytesToWrite=0x5f08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ba988*, lpNumberOfBytesWritten=0x18fdd8*=0x5f08, lpOverlapped=0x0) returned 1 [0248.811] CloseHandle (hObject=0xdc) returned 1 [0248.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.812] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x60ca [0248.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x60d2) returned 0x2b4a70 [0248.812] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x60ca, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x60ca, lpOverlapped=0x0) returned 1 [0248.813] CloseHandle (hObject=0xdc) returned 1 [0248.813] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0248.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.814] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.814] GetTickCount () returned 0x4d97c [0248.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.815] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317820\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317820\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.816] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317820\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317820\\....\\temporaryfile")) returned 0 [0248.816] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317820\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317820\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317820\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317820\\temporaryfile")) returned 1 [0248.817] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317820\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99404d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99404d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99404d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.817] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99404d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99404d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99404d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.817] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99404d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99404d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99404d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.817] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317820\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99404d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99404d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99404d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.817] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99404d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99404d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99404d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.817] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99404d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99404d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99404d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.817] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.818] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317820\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317820\\temporaryfile")) returned 1 [0248.818] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99404d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99404d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99404d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.818] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.818] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317820" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317820")) returned 1 [0248.818] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 0 [0248.819] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.819] WriteFile (in: hFile=0xdc, lpBuffer=0x2bab58*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bab58*, lpNumberOfBytesWritten=0x18fdd8*=0x60d0, lpOverlapped=0x0) returned 1 [0248.820] CloseHandle (hObject=0xdc) returned 1 [0248.820] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.821] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbb7c [0248.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbb84) returned 0x2b4a70 [0248.821] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xbb7c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0xbb7c, lpOverlapped=0x0) returned 1 [0248.822] CloseHandle (hObject=0xdc) returned 1 [0248.822] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0248.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.824] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.824] GetTickCount () returned 0x4d98c [0248.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.824] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836\\....\\temporaryfile")) returned 0 [0248.825] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836\\temporaryfile")) returned 1 [0248.826] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.826] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.826] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.826] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.826] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.826] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.826] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.826] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836\\temporaryfile")) returned 1 [0248.827] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.827] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.827] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836")) returned 1 [0248.827] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 0 [0248.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.828] WriteFile (in: hFile=0xdc, lpBuffer=0x2c0608*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c0608*, lpNumberOfBytesWritten=0x18fdd8*=0xbb80, lpOverlapped=0x0) returned 1 [0248.830] CloseHandle (hObject=0xdc) returned 1 [0248.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.830] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9d0e [0248.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9d16) returned 0x2b4a70 [0248.830] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x9d0e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x9d0e, lpOverlapped=0x0) returned 1 [0248.832] CloseHandle (hObject=0xdc) returned 1 [0248.832] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0248.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.833] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.833] GetTickCount () returned 0x4d98c [0248.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.834] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836\\....\\temporaryfile")) returned 0 [0248.834] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836\\temporaryfile")) returned 1 [0248.836] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.836] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.836] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.836] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.836] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.836] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.836] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.836] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836\\temporaryfile")) returned 1 [0248.836] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9942aec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9942aec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9942aec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.836] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.836] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317836" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317836")) returned 1 [0248.836] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 0 [0248.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.838] WriteFile (in: hFile=0xdc, lpBuffer=0x2be798*, nNumberOfBytesToWrite=0x9d18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2be798*, lpNumberOfBytesWritten=0x18fdd8*=0x9d18, lpOverlapped=0x0) returned 1 [0248.839] CloseHandle (hObject=0xdc) returned 1 [0248.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.840] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbaaa [0248.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbab2) returned 0x2b4a70 [0248.840] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0xbaaa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0xbaaa, lpOverlapped=0x0) returned 1 [0248.844] CloseHandle (hObject=0xdc) returned 1 [0248.844] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0248.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.845] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.845] GetTickCount () returned 0x4d99c [0248.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.845] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852\\....\\temporaryfile")) returned 0 [0248.846] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852\\temporaryfile")) returned 1 [0248.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99451020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99451020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99451020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.847] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99451020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99451020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99451020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.847] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99451020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99451020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99451020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99451020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99451020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99451020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.847] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99451020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99451020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99451020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.847] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99451020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99451020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99451020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.847] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.847] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852\\temporaryfile")) returned 1 [0248.848] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99451020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99451020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99451020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.848] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852")) returned 1 [0248.848] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 0 [0248.849] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.849] WriteFile (in: hFile=0xdc, lpBuffer=0x2c0538*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c0538*, lpNumberOfBytesWritten=0x18fdd8*=0xbab0, lpOverlapped=0x0) returned 1 [0248.851] CloseHandle (hObject=0xdc) returned 1 [0248.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.851] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x38cc [0248.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x38d4) returned 0x2b4a70 [0248.851] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x38cc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x38cc, lpOverlapped=0x0) returned 1 [0248.853] CloseHandle (hObject=0xdc) returned 1 [0248.853] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0248.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.854] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.854] GetTickCount () returned 0x4d99c [0248.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.854] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852\\....\\temporaryfile")) returned 0 [0248.855] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852\\temporaryfile")) returned 1 [0248.856] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99451020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.856] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99451020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.856] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.856] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.856] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.857] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.857] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.857] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852\\temporaryfile")) returned 1 [0248.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.857] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.857] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317852" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317852")) returned 1 [0248.857] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 0 [0248.858] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.858] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8358*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8358*, lpNumberOfBytesWritten=0x18fdd8*=0x38d0, lpOverlapped=0x0) returned 1 [0248.859] CloseHandle (hObject=0xdc) returned 1 [0248.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.860] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x504a [0248.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5052) returned 0x2b4a70 [0248.860] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x504a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x504a, lpOverlapped=0x0) returned 1 [0248.862] CloseHandle (hObject=0xdc) returned 1 [0248.862] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0248.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.863] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.863] GetTickCount () returned 0x4d9ab [0248.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.863] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317867\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317867\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317867\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317867\\....\\temporaryfile")) returned 0 [0248.864] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317867\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317867\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317867\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317867\\temporaryfile")) returned 1 [0248.865] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317867\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.865] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.865] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.865] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317867\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.866] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.866] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.866] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317867\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317867\\temporaryfile")) returned 1 [0248.866] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99477180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99477180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99477180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.866] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317867" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317867")) returned 1 [0248.866] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 0 [0248.867] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.867] WriteFile (in: hFile=0xdc, lpBuffer=0x2b9ad8*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b9ad8*, lpNumberOfBytesWritten=0x18fdd8*=0x5050, lpOverlapped=0x0) returned 1 [0248.868] CloseHandle (hObject=0xdc) returned 1 [0248.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.869] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f1e [0248.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f26) returned 0x2b4a70 [0248.869] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1f1e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1f1e, lpOverlapped=0x0) returned 1 [0248.870] CloseHandle (hObject=0xdc) returned 1 [0248.870] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0248.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.871] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.871] GetTickCount () returned 0x4d9bb [0248.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.872] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883\\....\\temporaryfile")) returned 0 [0248.872] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883\\temporaryfile")) returned 1 [0248.873] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.873] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.873] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.874] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.874] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.874] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.874] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.874] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883\\temporaryfile")) returned 1 [0248.874] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.874] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.874] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883")) returned 1 [0248.874] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 0 [0248.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.875] WriteFile (in: hFile=0xdc, lpBuffer=0x2b69a8*, nNumberOfBytesToWrite=0x1f28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b69a8*, lpNumberOfBytesWritten=0x18fdd8*=0x1f28, lpOverlapped=0x0) returned 1 [0248.876] CloseHandle (hObject=0xdc) returned 1 [0248.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.877] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x34cb [0248.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x34d3) returned 0x2b4a70 [0248.877] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x34cb, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x34cb, lpOverlapped=0x0) returned 1 [0248.878] CloseHandle (hObject=0xdc) returned 1 [0248.878] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0248.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.879] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.879] GetTickCount () returned 0x4d9bb [0248.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.880] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883\\....\\temporaryfile")) returned 0 [0248.880] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883\\temporaryfile")) returned 1 [0248.882] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.882] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.882] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.882] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.882] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.882] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.882] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.882] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883\\temporaryfile")) returned 1 [0248.882] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9949d2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9949d2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9949d2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.882] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.882] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317883" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317883")) returned 1 [0248.882] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 0 [0248.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.883] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7f58*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7f58*, lpNumberOfBytesWritten=0x18fdd8*=0x34d0, lpOverlapped=0x0) returned 1 [0248.884] CloseHandle (hObject=0xdc) returned 1 [0248.884] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.886] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4edd [0248.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4ee5) returned 0x2b4a70 [0248.886] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4edd, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4edd, lpOverlapped=0x0) returned 1 [0248.887] CloseHandle (hObject=0xdc) returned 1 [0248.887] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0248.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.888] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.888] GetTickCount () returned 0x4d9ca [0248.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.892] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.892] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898\\....\\temporaryfile")) returned 0 [0248.892] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898\\temporaryfile")) returned 1 [0248.893] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.893] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.894] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.894] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.894] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.894] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.894] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.894] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898\\temporaryfile")) returned 1 [0248.894] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.894] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.894] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898")) returned 1 [0248.894] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 0 [0248.895] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.895] WriteFile (in: hFile=0xdc, lpBuffer=0x2b9968*, nNumberOfBytesToWrite=0x4ee8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b9968*, lpNumberOfBytesWritten=0x18fdd8*=0x4ee8, lpOverlapped=0x0) returned 1 [0248.896] CloseHandle (hObject=0xdc) returned 1 [0248.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.897] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4fe6 [0248.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4fee) returned 0x2b4a70 [0248.897] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4fe6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4fe6, lpOverlapped=0x0) returned 1 [0248.898] CloseHandle (hObject=0xdc) returned 1 [0248.898] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0248.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.899] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.899] GetTickCount () returned 0x4d9ca [0248.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.900] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898\\....\\temporaryfile")) returned 0 [0248.901] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898\\temporaryfile")) returned 1 [0248.902] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.902] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.902] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.902] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.902] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.902] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.902] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.902] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898\\temporaryfile")) returned 1 [0248.902] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994c3440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994c3440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994c3440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.902] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.902] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317898" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317898")) returned 1 [0248.903] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 0 [0248.903] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.904] WriteFile (in: hFile=0xdc, lpBuffer=0x2b9a70*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b9a70*, lpNumberOfBytesWritten=0x18fdd8*=0x4ff0, lpOverlapped=0x0) returned 1 [0248.905] CloseHandle (hObject=0xdc) returned 1 [0248.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.906] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d75 [0248.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d7d) returned 0x2b4a70 [0248.906] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3d75, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3d75, lpOverlapped=0x0) returned 1 [0248.907] CloseHandle (hObject=0xdc) returned 1 [0248.907] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0248.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.908] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.908] GetTickCount () returned 0x4d9da [0248.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.909] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317914\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317914\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.909] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317914\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317914\\....\\temporaryfile")) returned 0 [0248.910] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317914\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317914\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317914\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317914\\temporaryfile")) returned 1 [0248.911] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317914\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994e95a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994e95a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994e95a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.911] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994e95a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994e95a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994e95a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.911] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994e95a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994e95a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994e95a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.911] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317914\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994e95a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994e95a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994e95a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.911] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994e95a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994e95a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994e95a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.911] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994e95a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994e95a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994e95a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.911] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.911] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317914\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317914\\temporaryfile")) returned 1 [0248.911] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x994e95a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x994e95a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x994e95a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.911] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.911] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317914" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317914")) returned 1 [0248.912] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 0 [0248.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.912] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8800*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8800*, lpNumberOfBytesWritten=0x18fdd8*=0x3d80, lpOverlapped=0x0) returned 1 [0248.913] CloseHandle (hObject=0xdc) returned 1 [0248.914] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.914] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x32b6 [0248.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32be) returned 0x2b4a70 [0248.914] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x32b6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x32b6, lpOverlapped=0x0) returned 1 [0248.915] CloseHandle (hObject=0xdc) returned 1 [0248.915] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0248.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.917] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.917] GetTickCount () returned 0x4d9ea [0248.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.917] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.917] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930\\....\\temporaryfile")) returned 0 [0248.918] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930\\temporaryfile")) returned 1 [0248.919] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.919] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.919] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.919] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.919] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.919] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.919] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.919] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930\\temporaryfile")) returned 1 [0248.919] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.919] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.919] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930")) returned 1 [0248.920] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 0 [0248.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.920] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7d40*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7d40*, lpNumberOfBytesWritten=0x18fdd8*=0x32c0, lpOverlapped=0x0) returned 1 [0248.921] CloseHandle (hObject=0xdc) returned 1 [0248.922] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.923] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x25ee [0248.923] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25f6) returned 0x2b4a70 [0248.923] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x25ee, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x25ee, lpOverlapped=0x0) returned 1 [0248.924] CloseHandle (hObject=0xdc) returned 1 [0248.924] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0248.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.925] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.925] GetTickCount () returned 0x4d9ea [0248.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.925] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930\\....\\temporaryfile")) returned 0 [0248.926] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930\\temporaryfile")) returned 1 [0248.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.928] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.928] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.928] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930\\temporaryfile")) returned 1 [0248.928] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9950f700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9950f700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9950f700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.928] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317930" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317930")) returned 1 [0248.928] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 0 [0248.929] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.929] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7078*, nNumberOfBytesToWrite=0x25f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7078*, lpNumberOfBytesWritten=0x18fdd8*=0x25f8, lpOverlapped=0x0) returned 1 [0248.930] CloseHandle (hObject=0xdc) returned 1 [0248.930] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.931] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2244 [0248.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x224c) returned 0x2b4a70 [0248.931] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2244, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2244, lpOverlapped=0x0) returned 1 [0248.932] CloseHandle (hObject=0xdc) returned 1 [0248.933] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0248.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.933] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.933] GetTickCount () returned 0x4d9f9 [0248.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.934] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.934] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945\\....\\temporaryfile")) returned 0 [0248.935] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945\\temporaryfile")) returned 1 [0248.936] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.936] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.936] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.936] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.936] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.936] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.936] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.936] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945\\temporaryfile")) returned 1 [0248.936] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.936] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.936] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945")) returned 1 [0248.937] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 0 [0248.937] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.937] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6cd0*, nNumberOfBytesToWrite=0x2248, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6cd0*, lpNumberOfBytesWritten=0x18fdd8*=0x2248, lpOverlapped=0x0) returned 1 [0248.938] CloseHandle (hObject=0xdc) returned 1 [0248.938] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.939] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3896 [0248.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x389e) returned 0x2b4a70 [0248.939] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3896, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3896, lpOverlapped=0x0) returned 1 [0248.940] CloseHandle (hObject=0xdc) returned 1 [0248.941] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0248.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.941] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.942] GetTickCount () returned 0x4d9f9 [0248.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.942] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945\\....\\temporaryfile")) returned 0 [0248.943] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945\\temporaryfile")) returned 1 [0248.944] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.944] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.944] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.944] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.944] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.944] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.944] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945\\temporaryfile")) returned 1 [0248.944] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99535860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99535860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99535860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.945] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.945] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317945" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317945")) returned 1 [0248.945] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 0 [0248.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.946] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8320*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8320*, lpNumberOfBytesWritten=0x18fdd8*=0x38a0, lpOverlapped=0x0) returned 1 [0248.947] CloseHandle (hObject=0xdc) returned 1 [0248.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.947] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4780 [0248.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4788) returned 0x2b4a70 [0248.947] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4780, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4780, lpOverlapped=0x0) returned 1 [0248.949] CloseHandle (hObject=0xdc) returned 1 [0248.949] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0248.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.950] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.950] GetTickCount () returned 0x4da09 [0248.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.950] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961\\....\\temporaryfile")) returned 0 [0248.951] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961\\temporaryfile")) returned 1 [0248.952] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.952] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.952] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.952] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.952] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.952] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.952] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.952] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961\\temporaryfile")) returned 1 [0248.953] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.953] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.953] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961")) returned 1 [0248.953] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 0 [0248.953] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.954] WriteFile (in: hFile=0xdc, lpBuffer=0x2b9208*, nNumberOfBytesToWrite=0x4788, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b9208*, lpNumberOfBytesWritten=0x18fdd8*=0x4788, lpOverlapped=0x0) returned 1 [0248.955] CloseHandle (hObject=0xdc) returned 1 [0248.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.955] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2b32 [0248.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b3a) returned 0x2b4a70 [0248.956] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2b32, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2b32, lpOverlapped=0x0) returned 1 [0248.957] CloseHandle (hObject=0xdc) returned 1 [0248.957] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0248.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.958] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.958] GetTickCount () returned 0x4da09 [0248.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.958] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961\\....\\temporaryfile")) returned 0 [0248.959] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961\\temporaryfile")) returned 1 [0248.960] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.960] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.960] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.960] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.961] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.961] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.961] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.961] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961\\temporaryfile")) returned 1 [0248.961] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9955b9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9955b9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9955b9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.961] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.961] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317961" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317961")) returned 1 [0248.961] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 0 [0248.962] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.962] WriteFile (in: hFile=0xdc, lpBuffer=0x2b75c0*, nNumberOfBytesToWrite=0x2b38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b75c0*, lpNumberOfBytesWritten=0x18fdd8*=0x2b38, lpOverlapped=0x0) returned 1 [0248.963] CloseHandle (hObject=0xdc) returned 1 [0248.963] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.967] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30e8 [0248.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30f0) returned 0x2b4a70 [0248.967] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x30e8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x30e8, lpOverlapped=0x0) returned 1 [0248.968] CloseHandle (hObject=0xdc) returned 1 [0248.968] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0248.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.969] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.969] GetTickCount () returned 0x4da18 [0248.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.970] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976\\....\\temporaryfile")) returned 0 [0248.970] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976\\temporaryfile")) returned 1 [0248.972] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.972] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.972] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.972] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.972] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.972] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.972] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.972] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976\\temporaryfile")) returned 1 [0248.972] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.972] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.972] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976")) returned 1 [0248.972] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 0 [0248.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.973] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7b70*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7b70*, lpNumberOfBytesWritten=0x18fdd8*=0x30f0, lpOverlapped=0x0) returned 1 [0248.974] CloseHandle (hObject=0xdc) returned 1 [0248.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.976] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x265a [0248.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2662) returned 0x2b4a70 [0248.976] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x265a, lpOverlapped=0x0) returned 1 [0248.977] CloseHandle (hObject=0xdc) returned 1 [0248.977] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0248.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.978] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.978] GetTickCount () returned 0x4da18 [0248.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.978] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976\\....\\temporaryfile")) returned 0 [0248.979] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976\\temporaryfile")) returned 1 [0248.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995a7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995a7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.981] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995a7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995a7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.981] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.981] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.981] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.981] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.981] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.981] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976\\temporaryfile")) returned 1 [0248.981] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99581b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99581b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99581b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.981] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.981] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317976" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317976")) returned 1 [0248.981] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 0 [0248.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.982] WriteFile (in: hFile=0xdc, lpBuffer=0x2b70e8*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b70e8*, lpNumberOfBytesWritten=0x18fdd8*=0x2660, lpOverlapped=0x0) returned 1 [0248.983] CloseHandle (hObject=0xdc) returned 1 [0248.983] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.984] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1eb6 [0248.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ebe) returned 0x2b4a70 [0248.984] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1eb6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1eb6, lpOverlapped=0x0) returned 1 [0248.985] CloseHandle (hObject=0xdc) returned 1 [0248.985] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0248.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0248.986] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.986] GetTickCount () returned 0x4da28 [0248.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.987] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992\\...."), lpSecurityAttributes=0x256210) returned 1 [0248.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992\\....\\temporaryfile")) returned 0 [0248.987] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992\\temporaryfile")) returned 1 [0248.988] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995a7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995a7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995a7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.989] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995a7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995a7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995a7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.989] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995a7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995a7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995a7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.989] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995a7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995a7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995a7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.989] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995a7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995a7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995a7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.989] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995a7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995a7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995a7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.989] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.989] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992\\temporaryfile")) returned 1 [0248.989] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995a7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995a7c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995a7c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.989] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.989] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992")) returned 1 [0248.989] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 0 [0248.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.990] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6940*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6940*, lpNumberOfBytesWritten=0x18fdd8*=0x1ec0, lpOverlapped=0x0) returned 1 [0248.991] CloseHandle (hObject=0xdc) returned 1 [0248.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.992] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3f4 [0248.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3fc) returned 0x259e70 [0248.992] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x3f4, lpOverlapped=0x0) returned 1 [0248.993] CloseHandle (hObject=0xdc) returned 1 [0248.993] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0248.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0248.994] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0248.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0248.994] GetTickCount () returned 0x4da28 [0248.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0248.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0248.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0248.995] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992\\...."), lpSecurityAttributes=0x256228) returned 1 [0248.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992\\....\\temporaryfile")) returned 0 [0248.996] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992\\temporaryfile")) returned 1 [0248.997] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995a7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0248.997] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995a7c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.997] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0248.997] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0248.997] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.997] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0248.997] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0248.998] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992\\temporaryfile")) returned 1 [0248.998] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0248.998] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0248.998] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18317992" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18317992")) returned 1 [0248.998] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 0 [0248.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0248.999] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x3f8, lpOverlapped=0x0) returned 1 [0249.000] CloseHandle (hObject=0xdc) returned 1 [0249.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.001] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x370 [0249.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x378) returned 0x259e70 [0249.001] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x370, lpOverlapped=0x0) returned 1 [0249.002] CloseHandle (hObject=0xdc) returned 1 [0249.002] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0249.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.003] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.003] GetTickCount () returned 0x4da38 [0249.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.003] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318008\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318008\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318008\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318008\\....\\temporaryfile")) returned 0 [0249.004] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318008\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318008\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318008\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318008\\temporaryfile")) returned 1 [0249.005] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318008\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.005] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.005] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.005] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318008\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.005] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.006] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.006] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.006] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318008\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318008\\temporaryfile")) returned 1 [0249.006] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995cdde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995cdde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995cdde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.006] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.006] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318008" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318008")) returned 1 [0249.006] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 0 [0249.006] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.007] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x378, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x378, lpOverlapped=0x0) returned 1 [0249.008] CloseHandle (hObject=0xdc) returned 1 [0249.008] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.008] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x27a2 [0249.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x27aa) returned 0x2b4a70 [0249.008] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x27a2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x27a2, lpOverlapped=0x0) returned 1 [0249.010] CloseHandle (hObject=0xdc) returned 1 [0249.010] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0249.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.014] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.014] GetTickCount () returned 0x4da47 [0249.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.014] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023\\....\\temporaryfile")) returned 0 [0249.015] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023\\temporaryfile")) returned 1 [0249.016] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.016] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.016] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.016] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.016] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.016] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.016] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.016] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023\\temporaryfile")) returned 1 [0249.017] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.017] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.017] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023")) returned 1 [0249.017] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 0 [0249.017] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.018] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7230*, nNumberOfBytesToWrite=0x27a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7230*, lpNumberOfBytesWritten=0x18fdd8*=0x27a8, lpOverlapped=0x0) returned 1 [0249.018] CloseHandle (hObject=0xdc) returned 1 [0249.019] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.019] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5b8 [0249.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5c0) returned 0x259e70 [0249.019] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5b8, lpOverlapped=0x0) returned 1 [0249.020] CloseHandle (hObject=0xdc) returned 1 [0249.020] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0249.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.021] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.021] GetTickCount () returned 0x4da47 [0249.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.022] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023\\....\\temporaryfile")) returned 0 [0249.022] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023\\temporaryfile")) returned 1 [0249.024] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.024] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.024] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.024] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.024] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.024] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.024] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.024] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023\\temporaryfile")) returned 1 [0249.024] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x995f3f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x995f3f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x995f3f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.024] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.024] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318023" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318023")) returned 1 [0249.024] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 0 [0249.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.025] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x5c0, lpOverlapped=0x0) returned 1 [0249.026] CloseHandle (hObject=0xdc) returned 1 [0249.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.027] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6a0 [0249.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6a8) returned 0x259e70 [0249.027] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x6a0, lpOverlapped=0x0) returned 1 [0249.030] CloseHandle (hObject=0xdc) returned 1 [0249.030] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0249.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.031] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.031] GetTickCount () returned 0x4da57 [0249.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.031] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039\\....\\temporaryfile")) returned 0 [0249.032] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039\\temporaryfile")) returned 1 [0249.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.033] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.033] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.033] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.033] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.033] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.033] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039\\temporaryfile")) returned 1 [0249.033] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.033] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.033] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039")) returned 1 [0249.034] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 0 [0249.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.034] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x6a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x6a8, lpOverlapped=0x0) returned 1 [0249.035] CloseHandle (hObject=0xdc) returned 1 [0249.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.036] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5ec [0249.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5f4) returned 0x259e70 [0249.036] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5ec, lpOverlapped=0x0) returned 1 [0249.037] CloseHandle (hObject=0xdc) returned 1 [0249.037] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0249.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.038] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.038] GetTickCount () returned 0x4da57 [0249.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.039] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039\\....\\temporaryfile")) returned 0 [0249.039] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039\\temporaryfile")) returned 1 [0249.040] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.041] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.041] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.041] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.041] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.041] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.041] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.041] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039\\temporaryfile")) returned 1 [0249.041] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9961a0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9961a0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9961a0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.041] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.041] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318039" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318039")) returned 1 [0249.041] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 0 [0249.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.042] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x5f0, lpOverlapped=0x0) returned 1 [0249.043] CloseHandle (hObject=0xdc) returned 1 [0249.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.043] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf92 [0249.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf9a) returned 0x25f580 [0249.044] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xf92, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xf92, lpOverlapped=0x0) returned 1 [0249.045] CloseHandle (hObject=0xdc) returned 1 [0249.045] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0249.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.046] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.046] GetTickCount () returned 0x4da66 [0249.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.046] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054\\....\\temporaryfile")) returned 0 [0249.047] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054\\temporaryfile")) returned 1 [0249.048] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.048] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.048] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.048] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.048] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.048] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.048] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.048] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054\\temporaryfile")) returned 1 [0249.048] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.048] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.048] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054")) returned 1 [0249.049] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 0 [0249.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.049] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xf98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xf98, lpOverlapped=0x0) returned 1 [0249.050] CloseHandle (hObject=0xdc) returned 1 [0249.050] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.051] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f86 [0249.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f8e) returned 0x2b4a70 [0249.051] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1f86, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1f86, lpOverlapped=0x0) returned 1 [0249.053] CloseHandle (hObject=0xdc) returned 1 [0249.053] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0249.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.054] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.054] GetTickCount () returned 0x4da66 [0249.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.054] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.054] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054\\....\\temporaryfile")) returned 0 [0249.055] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054\\temporaryfile")) returned 1 [0249.056] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.056] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.056] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.056] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.056] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.056] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.056] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.056] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054\\temporaryfile")) returned 1 [0249.057] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99640200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99640200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99640200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.057] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.057] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318054" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318054")) returned 1 [0249.057] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 0 [0249.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.058] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6a10*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6a10*, lpNumberOfBytesWritten=0x18fdd8*=0x1f90, lpOverlapped=0x0) returned 1 [0249.059] CloseHandle (hObject=0xdc) returned 1 [0249.059] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.059] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2458 [0249.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2460) returned 0x2b4a70 [0249.059] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2458, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2458, lpOverlapped=0x0) returned 1 [0249.061] CloseHandle (hObject=0xdc) returned 1 [0249.061] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0249.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.062] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.062] GetTickCount () returned 0x4da76 [0249.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.062] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070\\....\\temporaryfile")) returned 0 [0249.063] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070\\temporaryfile")) returned 1 [0249.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.064] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.064] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.064] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.064] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070\\temporaryfile")) returned 1 [0249.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.065] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.065] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070")) returned 1 [0249.065] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 0 [0249.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.066] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6ee0*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6ee0*, lpNumberOfBytesWritten=0x18fdd8*=0x2460, lpOverlapped=0x0) returned 1 [0249.066] CloseHandle (hObject=0xdc) returned 1 [0249.067] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.067] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xfb8 [0249.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfc0) returned 0x25f580 [0249.067] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xfb8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xfb8, lpOverlapped=0x0) returned 1 [0249.068] CloseHandle (hObject=0xdc) returned 1 [0249.069] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0249.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.069] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.069] GetTickCount () returned 0x4da76 [0249.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.070] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070\\....\\temporaryfile")) returned 0 [0249.071] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070\\temporaryfile")) returned 1 [0249.072] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.072] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.072] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.072] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.072] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.072] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.072] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.072] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070\\temporaryfile")) returned 1 [0249.073] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99666360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99666360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99666360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.073] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.073] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318070" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318070")) returned 1 [0249.073] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 0 [0249.073] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.074] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xfc0, lpOverlapped=0x0) returned 1 [0249.074] CloseHandle (hObject=0xdc) returned 1 [0249.075] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.075] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x386c [0249.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3874) returned 0x2b4a70 [0249.075] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x386c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x386c, lpOverlapped=0x0) returned 1 [0249.076] CloseHandle (hObject=0xdc) returned 1 [0249.076] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0249.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.077] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.077] GetTickCount () returned 0x4da86 [0249.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.078] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086\\....\\temporaryfile")) returned 0 [0249.078] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086\\temporaryfile")) returned 1 [0249.079] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.080] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.080] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.080] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.080] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086\\temporaryfile")) returned 1 [0249.080] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.080] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086")) returned 1 [0249.080] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 0 [0249.081] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.081] WriteFile (in: hFile=0xdc, lpBuffer=0x2b82f8*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b82f8*, lpNumberOfBytesWritten=0x18fdd8*=0x3870, lpOverlapped=0x0) returned 1 [0249.082] CloseHandle (hObject=0xdc) returned 1 [0249.082] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.083] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x600 [0249.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x608) returned 0x259e70 [0249.083] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x600, lpOverlapped=0x0) returned 1 [0249.084] CloseHandle (hObject=0xdc) returned 1 [0249.084] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0249.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.085] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.085] GetTickCount () returned 0x4da86 [0249.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.086] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.086] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086\\....\\temporaryfile")) returned 0 [0249.086] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086\\temporaryfile")) returned 1 [0249.087] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.087] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.087] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.087] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.088] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.088] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.088] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.088] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086\\temporaryfile")) returned 1 [0249.088] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9968c4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9968c4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9968c4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.088] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.088] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318086" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318086")) returned 1 [0249.088] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 0 [0249.089] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.089] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x608, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x608, lpOverlapped=0x0) returned 1 [0249.090] CloseHandle (hObject=0xdc) returned 1 [0249.090] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.090] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1264 [0249.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x126c) returned 0x25b528 [0249.090] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1264, lpOverlapped=0x0) returned 1 [0249.094] CloseHandle (hObject=0xdc) returned 1 [0249.094] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0249.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.095] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.095] GetTickCount () returned 0x4da95 [0249.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.096] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101\\....\\temporaryfile")) returned 0 [0249.096] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101\\temporaryfile")) returned 1 [0249.097] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996b2620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996b2620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996b2620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.097] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996b2620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996b2620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996b2620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.097] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996b2620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996b2620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996b2620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.097] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996b2620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996b2620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996b2620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.097] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996b2620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996b2620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996b2620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.097] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996b2620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996b2620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996b2620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.098] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.098] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101\\temporaryfile")) returned 1 [0249.098] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996b2620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996b2620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996b2620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.098] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.098] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101")) returned 1 [0249.098] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 0 [0249.098] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.099] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1268, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1268, lpOverlapped=0x0) returned 1 [0249.100] CloseHandle (hObject=0xdc) returned 1 [0249.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.101] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6c8 [0249.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6d0) returned 0x2350048 [0249.101] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x6c8, lpOverlapped=0x0) returned 1 [0249.102] CloseHandle (hObject=0xdc) returned 1 [0249.102] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0249.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.103] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.103] GetTickCount () returned 0x4da95 [0249.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.104] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.104] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101\\....\\temporaryfile")) returned 0 [0249.104] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101\\temporaryfile")) returned 1 [0249.106] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996b2620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.106] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996b2620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.106] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.106] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.106] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.106] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.106] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.106] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101\\temporaryfile")) returned 1 [0249.106] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.106] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.106] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318101" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318101")) returned 1 [0249.106] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 0 [0249.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.107] WriteFile (in: hFile=0xdc, lpBuffer=0x2350728*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350728*, lpNumberOfBytesWritten=0x18fdd8*=0x6d0, lpOverlapped=0x0) returned 1 [0249.108] CloseHandle (hObject=0xdc) returned 1 [0249.108] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.109] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30c2 [0249.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30ca) returned 0x2b4a70 [0249.109] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x30c2, lpOverlapped=0x0) returned 1 [0249.110] CloseHandle (hObject=0xdc) returned 1 [0249.110] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0249.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.111] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.111] GetTickCount () returned 0x4daa5 [0249.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.111] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318117\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318117\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318117\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318117\\....\\temporaryfile")) returned 0 [0249.112] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318117\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318117\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318117\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318117\\temporaryfile")) returned 1 [0249.113] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318117\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.113] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.113] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.114] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318117\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.114] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.114] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.114] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.114] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318117\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318117\\temporaryfile")) returned 1 [0249.114] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996d8780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996d8780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996d8780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.114] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.114] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318117" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318117")) returned 1 [0249.114] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 0 [0249.115] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.115] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7b50*, nNumberOfBytesToWrite=0x30c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7b50*, lpNumberOfBytesWritten=0x18fdd8*=0x30c8, lpOverlapped=0x0) returned 1 [0249.116] CloseHandle (hObject=0xdc) returned 1 [0249.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.117] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9fc [0249.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa04) returned 0x2350048 [0249.117] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x9fc, lpOverlapped=0x0) returned 1 [0249.119] CloseHandle (hObject=0xdc) returned 1 [0249.119] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0249.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.120] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.120] GetTickCount () returned 0x4dab4 [0249.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.120] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132\\....\\temporaryfile")) returned 0 [0249.121] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132\\temporaryfile")) returned 1 [0249.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.122] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.122] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.122] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.122] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.122] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.122] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132\\temporaryfile")) returned 1 [0249.122] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.123] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.123] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132")) returned 1 [0249.123] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 0 [0249.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.123] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xa00, lpOverlapped=0x0) returned 1 [0249.124] CloseHandle (hObject=0xdc) returned 1 [0249.124] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.125] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1678 [0249.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1680) returned 0x2b4a70 [0249.125] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1678, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1678, lpOverlapped=0x0) returned 1 [0249.126] CloseHandle (hObject=0xdc) returned 1 [0249.126] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0249.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.127] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.127] GetTickCount () returned 0x4dab4 [0249.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.128] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132\\....\\temporaryfile")) returned 0 [0249.129] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132\\temporaryfile")) returned 1 [0249.130] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.130] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.130] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.130] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.130] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.130] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.130] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.130] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132\\temporaryfile")) returned 1 [0249.137] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x996fe8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x996fe8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x996fe8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.137] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.138] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318132" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318132")) returned 1 [0249.138] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 0 [0249.138] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.138] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6100*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6100*, lpNumberOfBytesWritten=0x18fdd8*=0x1680, lpOverlapped=0x0) returned 1 [0249.139] CloseHandle (hObject=0xdc) returned 1 [0249.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.140] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa54 [0249.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa5c) returned 0x2350048 [0249.140] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa54, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xa54, lpOverlapped=0x0) returned 1 [0249.141] CloseHandle (hObject=0xdc) returned 1 [0249.141] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0249.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.142] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.142] GetTickCount () returned 0x4dac4 [0249.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.143] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148\\....\\temporaryfile")) returned 0 [0249.143] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148\\temporaryfile")) returned 1 [0249.144] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99724a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99724a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99724a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.145] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99724a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99724a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99724a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.145] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99724a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99724a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99724a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.145] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99724a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99724a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99724a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.145] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99724a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99724a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99724a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.145] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99724a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99724a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99724a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.145] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.145] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148\\temporaryfile")) returned 1 [0249.145] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99724a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99724a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99724a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.145] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.145] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148")) returned 1 [0249.145] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 0 [0249.146] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.146] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xa58, lpOverlapped=0x0) returned 1 [0249.147] CloseHandle (hObject=0xdc) returned 1 [0249.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.148] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1498 [0249.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14a0) returned 0x29b460 [0249.148] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1498, lpOverlapped=0x0) returned 1 [0249.149] CloseHandle (hObject=0xdc) returned 1 [0249.149] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0249.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.150] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.150] GetTickCount () returned 0x4dac4 [0249.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.150] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148\\....\\temporaryfile")) returned 0 [0249.151] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148\\temporaryfile")) returned 1 [0249.152] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99724a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99724a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.153] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.153] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.153] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148\\temporaryfile")) returned 1 [0249.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.153] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318148" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318148")) returned 1 [0249.153] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 0 [0249.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.155] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a78*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x14a0, lpOverlapped=0x0) returned 1 [0249.155] CloseHandle (hObject=0xdc) returned 1 [0249.156] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.157] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbc8 [0249.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbd0) returned 0x2350048 [0249.157] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xbc8, lpOverlapped=0x0) returned 1 [0249.159] CloseHandle (hObject=0xdc) returned 1 [0249.159] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0249.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.160] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.160] GetTickCount () returned 0x4dad4 [0249.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.161] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318164\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318164\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318164\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318164\\....\\temporaryfile")) returned 0 [0249.162] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318164\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318164\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318164\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318164\\temporaryfile")) returned 1 [0249.163] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318164\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.163] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.163] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.163] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318164\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.163] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.163] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.163] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318164\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318164\\temporaryfile")) returned 1 [0249.163] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9974aba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9974aba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9974aba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.163] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318164" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318164")) returned 1 [0249.164] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 0 [0249.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.164] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xbd0, lpOverlapped=0x0) returned 1 [0249.165] CloseHandle (hObject=0xdc) returned 1 [0249.165] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.166] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xec4 [0249.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xecc) returned 0x2350048 [0249.166] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xec4, lpOverlapped=0x0) returned 1 [0249.167] CloseHandle (hObject=0xdc) returned 1 [0249.167] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0249.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.168] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.168] GetTickCount () returned 0x4dae3 [0249.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.169] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318179\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318179\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318179\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318179\\....\\temporaryfile")) returned 0 [0249.169] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318179\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318179\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318179\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318179\\temporaryfile")) returned 1 [0249.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318179\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99770d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99770d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99770d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.170] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99770d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99770d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99770d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.170] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99770d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99770d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99770d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318179\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99770d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99770d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99770d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.171] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99770d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99770d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99770d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.171] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99770d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99770d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99770d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.171] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.171] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318179\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318179\\temporaryfile")) returned 1 [0249.171] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99770d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99770d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99770d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.171] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.171] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318179" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318179")) returned 1 [0249.171] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 0 [0249.171] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.172] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xec8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xec8, lpOverlapped=0x0) returned 1 [0249.173] CloseHandle (hObject=0xdc) returned 1 [0249.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.173] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1044 [0249.173] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x104c) returned 0x25b528 [0249.173] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1044, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1044, lpOverlapped=0x0) returned 1 [0249.182] CloseHandle (hObject=0xdc) returned 1 [0249.182] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0249.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.183] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.183] GetTickCount () returned 0x4daf3 [0249.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.184] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.184] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.184] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195\\....\\temporaryfile")) returned 0 [0249.184] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195\\temporaryfile")) returned 1 [0249.185] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.186] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.186] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.186] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.186] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.186] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.186] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.186] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195\\temporaryfile")) returned 1 [0249.186] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.186] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.186] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195")) returned 1 [0249.186] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 0 [0249.187] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.187] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1048, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1048, lpOverlapped=0x0) returned 1 [0249.188] CloseHandle (hObject=0xdc) returned 1 [0249.188] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.189] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x32c [0249.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x334) returned 0x2a0a88 [0249.189] ReadFile (in: hFile=0xdc, lpBuffer=0x2a0a90, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a0a90*, lpNumberOfBytesRead=0x18fdf0*=0x32c, lpOverlapped=0x0) returned 1 [0249.190] CloseHandle (hObject=0xdc) returned 1 [0249.190] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0249.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.191] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.191] GetTickCount () returned 0x4daf3 [0249.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.192] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195\\....\\temporaryfile")) returned 0 [0249.192] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195\\temporaryfile")) returned 1 [0249.194] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.194] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.194] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.194] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.194] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.194] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.194] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195\\temporaryfile")) returned 1 [0249.194] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99796e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99796e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99796e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.194] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318195" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318195")) returned 1 [0249.194] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 0 [0249.195] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.195] WriteFile (in: hFile=0xdc, lpBuffer=0x2a0dd8*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a0dd8*, lpNumberOfBytesWritten=0x18fdd8*=0x330, lpOverlapped=0x0) returned 1 [0249.196] CloseHandle (hObject=0xdc) returned 1 [0249.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.197] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x332e [0249.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3336) returned 0x2b4a70 [0249.198] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x332e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x332e, lpOverlapped=0x0) returned 1 [0249.199] CloseHandle (hObject=0xdc) returned 1 [0249.199] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0249.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.200] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.200] GetTickCount () returned 0x4db02 [0249.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.201] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.201] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210\\....\\temporaryfile")) returned 0 [0249.201] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210\\temporaryfile")) returned 1 [0249.202] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.202] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.202] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.202] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.203] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.203] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210\\temporaryfile")) returned 1 [0249.203] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.203] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.203] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210")) returned 1 [0249.203] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 0 [0249.204] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.204] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7db8*, nNumberOfBytesToWrite=0x3338, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7db8*, lpNumberOfBytesWritten=0x18fdd8*=0x3338, lpOverlapped=0x0) returned 1 [0249.205] CloseHandle (hObject=0xdc) returned 1 [0249.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.206] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x69aa [0249.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x69b2) returned 0x2b4a70 [0249.206] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x69aa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x69aa, lpOverlapped=0x0) returned 1 [0249.207] CloseHandle (hObject=0xdc) returned 1 [0249.207] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0249.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.208] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.208] GetTickCount () returned 0x4db02 [0249.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.209] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210\\....\\temporaryfile")) returned 0 [0249.209] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210\\temporaryfile")) returned 1 [0249.210] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.211] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.211] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.211] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210\\temporaryfile")) returned 1 [0249.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997bcfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997bcfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997bcfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.211] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318210" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318210")) returned 1 [0249.211] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 0 [0249.212] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.214] WriteFile (in: hFile=0xdc, lpBuffer=0x2bb438*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bb438*, lpNumberOfBytesWritten=0x18fdd8*=0x69b0, lpOverlapped=0x0) returned 1 [0249.215] CloseHandle (hObject=0xdc) returned 1 [0249.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.215] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b54 [0249.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b5c) returned 0x2b4a70 [0249.215] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1b54, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b54, lpOverlapped=0x0) returned 1 [0249.217] CloseHandle (hObject=0xdc) returned 1 [0249.217] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0249.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.218] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.218] GetTickCount () returned 0x4db12 [0249.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.218] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226\\....\\temporaryfile")) returned 0 [0249.219] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226\\temporaryfile")) returned 1 [0249.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.220] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.220] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.220] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.220] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.220] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.220] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226\\temporaryfile")) returned 1 [0249.220] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.220] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.221] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226")) returned 1 [0249.221] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 0 [0249.221] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.221] WriteFile (in: hFile=0xdc, lpBuffer=0x2b65e0*, nNumberOfBytesToWrite=0x1b58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b65e0*, lpNumberOfBytesWritten=0x18fdd8*=0x1b58, lpOverlapped=0x0) returned 1 [0249.222] CloseHandle (hObject=0xdc) returned 1 [0249.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.225] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2576 [0249.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x257e) returned 0x2b4a70 [0249.225] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2576, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2576, lpOverlapped=0x0) returned 1 [0249.226] CloseHandle (hObject=0xdc) returned 1 [0249.226] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0249.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.227] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.227] GetTickCount () returned 0x4db12 [0249.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.228] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226\\....\\temporaryfile")) returned 0 [0249.229] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226\\temporaryfile")) returned 1 [0249.230] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99809280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99809280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.230] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99809280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99809280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.230] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.230] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.230] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.230] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.230] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.231] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226\\temporaryfile")) returned 1 [0249.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x997e3120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x997e3120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x997e3120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.231] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.231] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318226" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318226")) returned 1 [0249.231] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 0 [0249.231] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.232] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7000*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7000*, lpNumberOfBytesWritten=0x18fdd8*=0x2580, lpOverlapped=0x0) returned 1 [0249.233] CloseHandle (hObject=0xdc) returned 1 [0249.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.233] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6ba0 [0249.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6ba8) returned 0x2b4a70 [0249.233] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x6ba0, lpOverlapped=0x0) returned 1 [0249.235] CloseHandle (hObject=0xdc) returned 1 [0249.235] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0249.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.236] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.236] GetTickCount () returned 0x4db22 [0249.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.236] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318242\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.237] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318242\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318242\\....\\temporaryfile")) returned 0 [0249.237] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318242\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318242\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318242\\temporaryfile")) returned 1 [0249.238] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318242\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99809280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99809280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99809280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.238] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99809280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99809280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99809280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.238] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99809280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99809280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99809280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.238] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318242\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99809280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99809280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99809280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.239] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99809280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99809280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99809280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.239] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99809280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99809280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99809280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.239] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.239] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318242\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318242\\temporaryfile")) returned 1 [0249.239] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99809280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99809280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99809280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.239] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.239] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318242" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318242")) returned 1 [0249.239] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 0 [0249.240] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.240] WriteFile (in: hFile=0xdc, lpBuffer=0x2bb628*, nNumberOfBytesToWrite=0x6ba8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bb628*, lpNumberOfBytesWritten=0x18fdd8*=0x6ba8, lpOverlapped=0x0) returned 1 [0249.241] CloseHandle (hObject=0xdc) returned 1 [0249.241] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.242] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2cec [0249.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2cf4) returned 0x2b4a70 [0249.242] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x2cec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2cec, lpOverlapped=0x0) returned 1 [0249.243] CloseHandle (hObject=0xdc) returned 1 [0249.243] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0249.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.244] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.244] GetTickCount () returned 0x4db31 [0249.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.245] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257\\....\\temporaryfile")) returned 0 [0249.246] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257\\temporaryfile")) returned 1 [0249.247] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.247] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.247] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.247] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.247] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.247] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.247] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.247] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257\\temporaryfile")) returned 1 [0249.247] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.247] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.247] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257")) returned 1 [0249.248] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 0 [0249.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.248] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7778*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7778*, lpNumberOfBytesWritten=0x18fdd8*=0x2cf0, lpOverlapped=0x0) returned 1 [0249.249] CloseHandle (hObject=0xdc) returned 1 [0249.249] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.250] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1138 [0249.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1140) returned 0x25b528 [0249.251] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1138, lpOverlapped=0x0) returned 1 [0249.252] CloseHandle (hObject=0xdc) returned 1 [0249.252] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0249.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.253] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.253] GetTickCount () returned 0x4db31 [0249.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.253] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257\\....\\temporaryfile")) returned 0 [0249.254] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257\\temporaryfile")) returned 1 [0249.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.255] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.255] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.256] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.256] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.256] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.256] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257\\temporaryfile")) returned 1 [0249.256] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9982f3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9982f3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9982f3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.256] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.256] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318257" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318257")) returned 1 [0249.256] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 0 [0249.256] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.257] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1140, lpOverlapped=0x0) returned 1 [0249.258] CloseHandle (hObject=0xdc) returned 1 [0249.258] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.258] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1870 [0249.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1878) returned 0x2b4a70 [0249.258] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1870, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1870, lpOverlapped=0x0) returned 1 [0249.260] CloseHandle (hObject=0xdc) returned 1 [0249.260] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0249.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.261] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.261] GetTickCount () returned 0x4db41 [0249.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.261] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273\\....\\temporaryfile")) returned 0 [0249.262] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273\\temporaryfile")) returned 1 [0249.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.263] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.263] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.263] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273\\temporaryfile")) returned 1 [0249.264] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.264] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.264] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273")) returned 1 [0249.264] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 0 [0249.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.268] WriteFile (in: hFile=0xdc, lpBuffer=0x2b62f8*, nNumberOfBytesToWrite=0x1878, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b62f8*, lpNumberOfBytesWritten=0x18fdd8*=0x1878, lpOverlapped=0x0) returned 1 [0249.268] CloseHandle (hObject=0xdc) returned 1 [0249.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.269] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4c14 [0249.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c1c) returned 0x2b4a70 [0249.269] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x4c14, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4c14, lpOverlapped=0x0) returned 1 [0249.271] CloseHandle (hObject=0xdc) returned 1 [0249.271] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0249.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.272] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.272] GetTickCount () returned 0x4db41 [0249.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.272] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273\\....\\temporaryfile")) returned 0 [0249.273] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273\\temporaryfile")) returned 1 [0249.274] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.274] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.274] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.274] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.274] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.274] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.274] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.274] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273\\temporaryfile")) returned 1 [0249.275] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99855540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99855540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99855540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.275] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.275] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318273" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318273")) returned 1 [0249.275] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 0 [0249.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.276] WriteFile (in: hFile=0xdc, lpBuffer=0x2b96a0*, nNumberOfBytesToWrite=0x4c18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b96a0*, lpNumberOfBytesWritten=0x18fdd8*=0x4c18, lpOverlapped=0x0) returned 1 [0249.277] CloseHandle (hObject=0xdc) returned 1 [0249.277] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.278] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xeb8 [0249.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xec0) returned 0x2350048 [0249.278] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xeb8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xeb8, lpOverlapped=0x0) returned 1 [0249.279] CloseHandle (hObject=0xdc) returned 1 [0249.279] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0249.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.280] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.280] GetTickCount () returned 0x4db50 [0249.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.281] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288\\....\\temporaryfile")) returned 0 [0249.281] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288\\temporaryfile")) returned 1 [0249.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9987b6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9987b6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9987b6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9987b6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9987b6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9987b6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9987b6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9987b6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9987b6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.283] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9987b6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9987b6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9987b6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9987b6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9987b6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9987b6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9987b6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9987b6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9987b6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.283] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288\\temporaryfile")) returned 1 [0249.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9987b6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9987b6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9987b6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.283] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288")) returned 1 [0249.283] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 0 [0249.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.284] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xec0, lpOverlapped=0x0) returned 1 [0249.285] CloseHandle (hObject=0xdc) returned 1 [0249.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.285] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd16 [0249.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd1e) returned 0x2350048 [0249.285] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd16, lpOverlapped=0x0) returned 1 [0249.289] CloseHandle (hObject=0xdc) returned 1 [0249.289] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0249.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.290] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.290] GetTickCount () returned 0x4db50 [0249.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.291] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288\\....\\temporaryfile")) returned 0 [0249.292] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288\\temporaryfile")) returned 1 [0249.293] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9987b6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9987b6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.293] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.293] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.293] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.293] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.293] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288\\temporaryfile")) returned 1 [0249.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.293] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.293] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318288" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318288")) returned 1 [0249.293] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 0 [0249.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.294] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd20, lpOverlapped=0x0) returned 1 [0249.295] CloseHandle (hObject=0xdc) returned 1 [0249.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.296] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x714c [0249.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7154) returned 0x2b4a70 [0249.296] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x714c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x714c, lpOverlapped=0x0) returned 1 [0249.297] CloseHandle (hObject=0xdc) returned 1 [0249.297] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0249.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.298] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.298] GetTickCount () returned 0x4db60 [0249.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.299] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318304\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318304\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318304\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318304\\....\\temporaryfile")) returned 0 [0249.299] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318304\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318304\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318304\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318304\\temporaryfile")) returned 1 [0249.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318304\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318304\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.301] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318304\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318304\\temporaryfile")) returned 1 [0249.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998a1800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998a1800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998a1800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.301] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318304" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318304")) returned 1 [0249.302] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 0 [0249.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.303] WriteFile (in: hFile=0xdc, lpBuffer=0x2bbbd8*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2bbbd8*, lpNumberOfBytesWritten=0x18fdd8*=0x7150, lpOverlapped=0x0) returned 1 [0249.304] CloseHandle (hObject=0xdc) returned 1 [0249.304] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.305] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x532 [0249.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x53a) returned 0x259e70 [0249.305] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x532, lpOverlapped=0x0) returned 1 [0249.306] CloseHandle (hObject=0xdc) returned 1 [0249.306] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0249.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.307] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.307] GetTickCount () returned 0x4db70 [0249.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.308] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320\\....\\temporaryfile")) returned 0 [0249.308] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320\\temporaryfile")) returned 1 [0249.309] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.309] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.309] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.310] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.310] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.310] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.310] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.310] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320\\temporaryfile")) returned 1 [0249.310] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.310] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.310] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320")) returned 1 [0249.310] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 0 [0249.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.311] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x538, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x538, lpOverlapped=0x0) returned 1 [0249.312] CloseHandle (hObject=0xdc) returned 1 [0249.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.313] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5a4 [0249.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5ac) returned 0x259e70 [0249.313] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5a4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5a4, lpOverlapped=0x0) returned 1 [0249.314] CloseHandle (hObject=0xdc) returned 1 [0249.314] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0249.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.315] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.315] GetTickCount () returned 0x4db70 [0249.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.316] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320\\....\\temporaryfile")) returned 0 [0249.316] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320\\temporaryfile")) returned 1 [0249.317] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.318] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.318] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.318] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.318] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.318] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320\\temporaryfile")) returned 1 [0249.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998c7960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998c7960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998c7960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.318] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.318] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318320" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318320")) returned 1 [0249.318] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 0 [0249.319] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.319] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x5a8, lpOverlapped=0x0) returned 1 [0249.320] CloseHandle (hObject=0xdc) returned 1 [0249.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.320] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f26 [0249.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f2e) returned 0x2b4a70 [0249.321] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1f26, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1f26, lpOverlapped=0x0) returned 1 [0249.322] CloseHandle (hObject=0xdc) returned 1 [0249.322] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0249.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.323] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.323] GetTickCount () returned 0x4db7f [0249.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.323] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335\\....\\temporaryfile")) returned 0 [0249.324] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335\\temporaryfile")) returned 1 [0249.325] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.325] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.325] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335\\temporaryfile")) returned 1 [0249.326] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.326] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.326] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335")) returned 1 [0249.326] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 0 [0249.326] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.327] WriteFile (in: hFile=0xdc, lpBuffer=0x2b69b0*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b69b0*, lpNumberOfBytesWritten=0x18fdd8*=0x1f30, lpOverlapped=0x0) returned 1 [0249.327] CloseHandle (hObject=0xdc) returned 1 [0249.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.328] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x94a [0249.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x952) returned 0x2350048 [0249.328] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x94a, lpOverlapped=0x0) returned 1 [0249.329] CloseHandle (hObject=0xdc) returned 1 [0249.330] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0249.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.330] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.331] GetTickCount () returned 0x4db7f [0249.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.331] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335\\....\\temporaryfile")) returned 0 [0249.332] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335\\temporaryfile")) returned 1 [0249.333] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.333] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.333] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.333] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.333] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.333] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.333] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.333] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335\\temporaryfile")) returned 1 [0249.334] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x998edac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x998edac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x998edac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.334] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.334] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318335" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318335")) returned 1 [0249.334] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 0 [0249.334] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.334] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x950, lpOverlapped=0x0) returned 1 [0249.335] CloseHandle (hObject=0xdc) returned 1 [0249.335] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.336] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x414 [0249.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x41c) returned 0x259e70 [0249.336] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x414, lpOverlapped=0x0) returned 1 [0249.337] CloseHandle (hObject=0xdc) returned 1 [0249.337] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0249.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.338] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.338] GetTickCount () returned 0x4db8f [0249.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.339] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351\\....\\temporaryfile")) returned 0 [0249.339] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351\\temporaryfile")) returned 1 [0249.340] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.341] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.341] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.341] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.341] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.341] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.341] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.341] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351\\temporaryfile")) returned 1 [0249.341] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.341] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.341] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351")) returned 1 [0249.341] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 0 [0249.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.342] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x418, lpOverlapped=0x0) returned 1 [0249.343] CloseHandle (hObject=0xdc) returned 1 [0249.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.343] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x876 [0249.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x87e) returned 0x2350048 [0249.343] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x876, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x876, lpOverlapped=0x0) returned 1 [0249.345] CloseHandle (hObject=0xdc) returned 1 [0249.345] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0249.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.346] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.346] GetTickCount () returned 0x4db8f [0249.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.346] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351\\....\\temporaryfile")) returned 0 [0249.347] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351\\temporaryfile")) returned 1 [0249.348] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.348] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.348] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.348] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.348] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.348] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.348] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.349] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351\\temporaryfile")) returned 1 [0249.349] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99913c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99913c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99913c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.349] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.349] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318351" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318351")) returned 1 [0249.349] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 0 [0249.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.350] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x880, lpOverlapped=0x0) returned 1 [0249.350] CloseHandle (hObject=0xdc) returned 1 [0249.351] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.352] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6b0 [0249.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6b8) returned 0x2350048 [0249.352] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x6b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x6b0, lpOverlapped=0x0) returned 1 [0249.354] CloseHandle (hObject=0xdc) returned 1 [0249.355] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0249.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.355] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.355] GetTickCount () returned 0x4db9e [0249.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.356] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366\\....\\temporaryfile")) returned 0 [0249.357] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366\\temporaryfile")) returned 1 [0249.358] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.358] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.358] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.358] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.358] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.358] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.358] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.358] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366\\temporaryfile")) returned 1 [0249.358] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.358] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.358] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366")) returned 1 [0249.359] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 0 [0249.359] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.359] WriteFile (in: hFile=0xdc, lpBuffer=0x2350710*, nNumberOfBytesToWrite=0x6b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350710*, lpNumberOfBytesWritten=0x18fdd8*=0x6b8, lpOverlapped=0x0) returned 1 [0249.360] CloseHandle (hObject=0xdc) returned 1 [0249.360] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.361] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x20ae [0249.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20b6) returned 0x2b4a70 [0249.361] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x20ae, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x20ae, lpOverlapped=0x0) returned 1 [0249.362] CloseHandle (hObject=0xdc) returned 1 [0249.362] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0249.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.363] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.363] GetTickCount () returned 0x4db9e [0249.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.364] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.364] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366\\....\\temporaryfile")) returned 0 [0249.364] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366\\temporaryfile")) returned 1 [0249.366] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.366] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.366] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.366] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.366] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.366] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.366] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.366] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366\\temporaryfile")) returned 1 [0249.366] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99939d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99939d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99939d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.366] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.366] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318366" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318366")) returned 1 [0249.366] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 0 [0249.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.367] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6b38*, nNumberOfBytesToWrite=0x20b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6b38*, lpNumberOfBytesWritten=0x18fdd8*=0x20b8, lpOverlapped=0x0) returned 1 [0249.368] CloseHandle (hObject=0xdc) returned 1 [0249.368] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.369] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1370 [0249.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1378) returned 0x25b528 [0249.369] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1370, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1370, lpOverlapped=0x0) returned 1 [0249.370] CloseHandle (hObject=0xdc) returned 1 [0249.370] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0249.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.371] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.371] GetTickCount () returned 0x4dbae [0249.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.372] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382\\....\\temporaryfile")) returned 0 [0249.372] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382\\temporaryfile")) returned 1 [0249.373] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.373] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.373] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.373] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.374] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.374] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.374] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.374] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382\\temporaryfile")) returned 1 [0249.374] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.374] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.374] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382")) returned 1 [0249.374] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 0 [0249.374] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.375] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1378, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1378, lpOverlapped=0x0) returned 1 [0249.376] CloseHandle (hObject=0xdc) returned 1 [0249.376] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.377] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x31f4 [0249.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x31fc) returned 0x2b4a70 [0249.377] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x31f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x31f4, lpOverlapped=0x0) returned 1 [0249.378] CloseHandle (hObject=0xdc) returned 1 [0249.378] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0249.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.379] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.379] GetTickCount () returned 0x4dbae [0249.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.380] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382\\....\\temporaryfile")) returned 0 [0249.381] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382\\temporaryfile")) returned 1 [0249.382] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.382] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.382] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.382] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.382] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.382] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.382] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.382] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382\\temporaryfile")) returned 1 [0249.382] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9995fee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9995fee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9995fee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.382] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.382] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318382" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318382")) returned 1 [0249.382] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 0 [0249.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.383] WriteFile (in: hFile=0xdc, lpBuffer=0x2b7c80*, nNumberOfBytesToWrite=0x31f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b7c80*, lpNumberOfBytesWritten=0x18fdd8*=0x31f8, lpOverlapped=0x0) returned 1 [0249.384] CloseHandle (hObject=0xdc) returned 1 [0249.385] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.385] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc20 [0249.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc28) returned 0x2350048 [0249.385] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xc20, lpOverlapped=0x0) returned 1 [0249.386] CloseHandle (hObject=0xdc) returned 1 [0249.387] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0249.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.387] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.388] GetTickCount () returned 0x4dbbe [0249.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.388] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398\\....\\temporaryfile")) returned 0 [0249.389] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398\\temporaryfile")) returned 1 [0249.393] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.393] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.393] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.393] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.394] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.394] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.394] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.394] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398\\temporaryfile")) returned 1 [0249.394] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.394] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.394] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398")) returned 1 [0249.394] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 0 [0249.394] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.395] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xc28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xc28, lpOverlapped=0x0) returned 1 [0249.396] CloseHandle (hObject=0xdc) returned 1 [0249.396] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.396] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x634 [0249.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x63c) returned 0x259e70 [0249.396] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x634, lpOverlapped=0x0) returned 1 [0249.398] CloseHandle (hObject=0xdc) returned 1 [0249.398] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0249.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.399] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.399] GetTickCount () returned 0x4dbbe [0249.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.399] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.400] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398\\....\\temporaryfile")) returned 0 [0249.400] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398\\temporaryfile")) returned 1 [0249.401] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999ac1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999ac1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.401] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999ac1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999ac1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.401] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.402] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.402] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.402] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.402] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.402] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398\\temporaryfile")) returned 1 [0249.402] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99986040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99986040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99986040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.402] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.402] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318398" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318398")) returned 1 [0249.402] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 0 [0249.403] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.403] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x638, lpOverlapped=0x0) returned 1 [0249.404] CloseHandle (hObject=0xdc) returned 1 [0249.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.404] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4bc [0249.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c4) returned 0x259e70 [0249.404] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x4bc, lpOverlapped=0x0) returned 1 [0249.406] CloseHandle (hObject=0xdc) returned 1 [0249.406] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0249.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.407] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.407] GetTickCount () returned 0x4dbcd [0249.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.407] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413\\....\\temporaryfile")) returned 0 [0249.408] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413\\temporaryfile")) returned 1 [0249.409] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999ac1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999ac1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999ac1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.409] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999ac1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999ac1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999ac1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.409] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999ac1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999ac1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999ac1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.409] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999ac1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999ac1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999ac1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.409] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999ac1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999ac1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999ac1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.410] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999ac1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999ac1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999ac1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.410] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.410] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413\\temporaryfile")) returned 1 [0249.410] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999ac1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999ac1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999ac1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.410] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.410] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413")) returned 1 [0249.410] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 0 [0249.410] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.411] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x4c0, lpOverlapped=0x0) returned 1 [0249.412] CloseHandle (hObject=0xdc) returned 1 [0249.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.413] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x804 [0249.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80c) returned 0x2350048 [0249.413] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x804, lpOverlapped=0x0) returned 1 [0249.414] CloseHandle (hObject=0xdc) returned 1 [0249.414] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0249.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.415] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.415] GetTickCount () returned 0x4dbcd [0249.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.416] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413\\....\\temporaryfile")) returned 0 [0249.417] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413\\temporaryfile")) returned 1 [0249.418] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999ac1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999ac1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.418] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.418] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.418] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.418] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.418] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413\\temporaryfile")) returned 1 [0249.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.418] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.418] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318413" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318413")) returned 1 [0249.418] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 0 [0249.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.419] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x808, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x808, lpOverlapped=0x0) returned 1 [0249.420] CloseHandle (hObject=0xdc) returned 1 [0249.420] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.421] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15cc [0249.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15d4) returned 0x2b4a70 [0249.421] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x15cc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x15cc, lpOverlapped=0x0) returned 1 [0249.422] CloseHandle (hObject=0xdc) returned 1 [0249.422] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0249.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.423] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.423] GetTickCount () returned 0x4dbdd [0249.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.424] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429\\....\\temporaryfile")) returned 0 [0249.424] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429\\temporaryfile")) returned 1 [0249.425] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.426] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.426] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.426] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.426] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.426] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.426] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.426] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429\\temporaryfile")) returned 1 [0249.426] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999d2300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999d2300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.426] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.426] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429")) returned 1 [0249.426] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 0 [0249.427] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.427] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6058*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6058*, lpNumberOfBytesWritten=0x18fdd8*=0x15d0, lpOverlapped=0x0) returned 1 [0249.428] CloseHandle (hObject=0xdc) returned 1 [0249.428] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.429] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdc4 [0249.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdcc) returned 0x2350048 [0249.429] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xdc4, lpOverlapped=0x0) returned 1 [0249.430] CloseHandle (hObject=0xdc) returned 1 [0249.430] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0249.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.431] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.431] GetTickCount () returned 0x4dbdd [0249.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.432] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429\\....\\temporaryfile")) returned 0 [0249.432] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429\\temporaryfile")) returned 1 [0249.433] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.433] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999d2300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.433] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.433] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.434] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.434] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.434] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.434] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429\\temporaryfile")) returned 1 [0249.434] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.434] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.434] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318429" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318429")) returned 1 [0249.434] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 0 [0249.434] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.435] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xdc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xdc8, lpOverlapped=0x0) returned 1 [0249.436] CloseHandle (hObject=0xdc) returned 1 [0249.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.436] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9b8 [0249.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9c0) returned 0x2350048 [0249.436] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x9b8, lpOverlapped=0x0) returned 1 [0249.438] CloseHandle (hObject=0xdc) returned 1 [0249.438] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0249.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.439] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.439] GetTickCount () returned 0x4dbec [0249.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.439] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444\\....\\temporaryfile")) returned 0 [0249.440] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444\\temporaryfile")) returned 1 [0249.441] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.441] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.441] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.441] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.441] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.441] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.441] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.441] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444\\temporaryfile")) returned 1 [0249.442] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x999f8460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x999f8460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.442] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.442] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444")) returned 1 [0249.442] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 0 [0249.442] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.443] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x9c0, lpOverlapped=0x0) returned 1 [0249.443] CloseHandle (hObject=0xdc) returned 1 [0249.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.444] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x68c [0249.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x694) returned 0x259e70 [0249.444] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x68c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x68c, lpOverlapped=0x0) returned 1 [0249.445] CloseHandle (hObject=0xdc) returned 1 [0249.445] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0249.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.446] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.446] GetTickCount () returned 0x4dbec [0249.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.447] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.448] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444\\....\\temporaryfile")) returned 0 [0249.448] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444\\temporaryfile")) returned 1 [0249.449] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a1e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a1e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.449] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x999f8460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a1e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a1e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.449] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a1e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a1e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a1e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.449] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a1e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a1e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a1e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.449] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a1e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a1e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a1e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.449] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a1e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a1e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a1e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.449] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.449] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444\\temporaryfile")) returned 1 [0249.449] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a1e5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a1e5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a1e5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.449] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.450] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318444" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318444")) returned 1 [0249.450] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 0 [0249.450] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.451] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x690, lpOverlapped=0x0) returned 1 [0249.451] CloseHandle (hObject=0xdc) returned 1 [0249.452] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.468] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf38 [0249.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf40) returned 0x2350048 [0249.468] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xf38, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xf38, lpOverlapped=0x0) returned 1 [0249.469] CloseHandle (hObject=0xdc) returned 1 [0249.469] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0249.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.470] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.470] GetTickCount () returned 0x4dc0c [0249.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.472] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318476\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318476\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318476\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318476\\....\\temporaryfile")) returned 0 [0249.472] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318476\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318476\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318476\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318476\\temporaryfile")) returned 1 [0249.473] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318476\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a44720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a44720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a44720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a44720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a44720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a44720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a44720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a44720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a44720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.474] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318476\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a44720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a44720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a44720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.474] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a44720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a44720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a44720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.474] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a44720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a44720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a44720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.474] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.474] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318476\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318476\\temporaryfile")) returned 1 [0249.474] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a44720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a44720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a44720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.474] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.474] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318476" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318476")) returned 1 [0249.474] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 0 [0249.474] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.475] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xf40, lpOverlapped=0x0) returned 1 [0249.476] CloseHandle (hObject=0xdc) returned 1 [0249.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.476] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xed4 [0249.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xedc) returned 0x2350048 [0249.476] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xed4, lpOverlapped=0x0) returned 1 [0249.478] CloseHandle (hObject=0xdc) returned 1 [0249.478] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0249.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.479] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.479] GetTickCount () returned 0x4dc1b [0249.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.479] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491\\....\\temporaryfile")) returned 0 [0249.480] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491\\temporaryfile")) returned 1 [0249.481] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.481] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.481] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.481] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.481] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.481] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.481] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.481] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491\\temporaryfile")) returned 1 [0249.482] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.482] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.482] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491")) returned 1 [0249.482] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 0 [0249.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.483] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xed8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xed8, lpOverlapped=0x0) returned 1 [0249.483] CloseHandle (hObject=0xdc) returned 1 [0249.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.484] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x984 [0249.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x98c) returned 0x2350048 [0249.484] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x984, lpOverlapped=0x0) returned 1 [0249.485] CloseHandle (hObject=0xdc) returned 1 [0249.485] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0249.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.486] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.486] GetTickCount () returned 0x4dc1b [0249.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.487] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491\\....\\temporaryfile")) returned 0 [0249.488] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491\\temporaryfile")) returned 1 [0249.489] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.489] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.489] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.489] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.489] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.489] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.489] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491\\temporaryfile")) returned 1 [0249.489] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a6a880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a6a880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a6a880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.489] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318491" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318491")) returned 1 [0249.489] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 0 [0249.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.490] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x988, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x988, lpOverlapped=0x0) returned 1 [0249.491] CloseHandle (hObject=0xdc) returned 1 [0249.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.492] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaac [0249.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xab4) returned 0x2350048 [0249.492] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xaac, lpOverlapped=0x0) returned 1 [0249.493] CloseHandle (hObject=0xdc) returned 1 [0249.493] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0249.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.494] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.494] GetTickCount () returned 0x4dc2b [0249.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.495] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507\\....\\temporaryfile")) returned 0 [0249.495] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507\\temporaryfile")) returned 1 [0249.496] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.496] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.496] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.496] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.497] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507\\temporaryfile")) returned 1 [0249.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.497] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507")) returned 1 [0249.497] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 0 [0249.497] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.498] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xab0, lpOverlapped=0x0) returned 1 [0249.499] CloseHandle (hObject=0xdc) returned 1 [0249.499] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.500] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c08 [0249.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c10) returned 0x2b4a70 [0249.500] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x1c08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1c08, lpOverlapped=0x0) returned 1 [0249.501] CloseHandle (hObject=0xdc) returned 1 [0249.501] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0249.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.502] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.502] GetTickCount () returned 0x4dc2b [0249.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.503] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.503] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507\\....\\temporaryfile")) returned 0 [0249.503] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507\\temporaryfile")) returned 1 [0249.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.505] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.505] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.505] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.505] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.505] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.505] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507\\temporaryfile")) returned 1 [0249.505] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99a909e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99a909e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99a909e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.505] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.505] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318507" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318507")) returned 1 [0249.505] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 0 [0249.506] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.506] WriteFile (in: hFile=0xdc, lpBuffer=0x2b6690*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b6690*, lpNumberOfBytesWritten=0x18fdd8*=0x1c10, lpOverlapped=0x0) returned 1 [0249.507] CloseHandle (hObject=0xdc) returned 1 [0249.507] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.508] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xda6 [0249.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdae) returned 0x2350048 [0249.508] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xda6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xda6, lpOverlapped=0x0) returned 1 [0249.509] CloseHandle (hObject=0xdc) returned 1 [0249.509] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0249.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.510] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.510] GetTickCount () returned 0x4dc3a [0249.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.511] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522\\....\\temporaryfile")) returned 0 [0249.511] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522\\temporaryfile")) returned 1 [0249.512] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.513] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.513] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.513] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.513] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.513] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.513] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.513] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522\\temporaryfile")) returned 1 [0249.513] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.513] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.513] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522")) returned 1 [0249.513] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 0 [0249.514] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.514] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xdb0, lpOverlapped=0x0) returned 1 [0249.515] CloseHandle (hObject=0xdc) returned 1 [0249.515] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.516] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3a94 [0249.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3a9c) returned 0x2b4a70 [0249.516] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a78, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3a94, lpOverlapped=0x0) returned 1 [0249.517] CloseHandle (hObject=0xdc) returned 1 [0249.517] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0249.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.518] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.518] GetTickCount () returned 0x4dc3a [0249.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.519] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522\\....\\temporaryfile")) returned 0 [0249.520] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522\\temporaryfile")) returned 1 [0249.521] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.521] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.521] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.521] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.521] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.521] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.521] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.521] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522\\temporaryfile")) returned 1 [0249.521] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ab6b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ab6b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ab6b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.521] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.521] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318522" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318522")) returned 1 [0249.522] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 0 [0249.522] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.526] WriteFile (in: hFile=0xdc, lpBuffer=0x2b8520*, nNumberOfBytesToWrite=0x3a98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b8520*, lpNumberOfBytesWritten=0x18fdd8*=0x3a98, lpOverlapped=0x0) returned 1 [0249.527] CloseHandle (hObject=0xdc) returned 1 [0249.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.528] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x752 [0249.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x75a) returned 0x2350048 [0249.528] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x752, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x752, lpOverlapped=0x0) returned 1 [0249.530] CloseHandle (hObject=0xdc) returned 1 [0249.530] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0249.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.531] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.531] GetTickCount () returned 0x4dc4a [0249.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.531] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538\\....\\temporaryfile")) returned 0 [0249.532] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538\\temporaryfile")) returned 1 [0249.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.533] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538\\temporaryfile")) returned 1 [0249.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.533] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538")) returned 1 [0249.534] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 0 [0249.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.534] WriteFile (in: hFile=0xdc, lpBuffer=0x23507b8*, nNumberOfBytesToWrite=0x758, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23507b8*, lpNumberOfBytesWritten=0x18fdd8*=0x758, lpOverlapped=0x0) returned 1 [0249.535] CloseHandle (hObject=0xdc) returned 1 [0249.535] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.536] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf6c [0249.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf74) returned 0x2350048 [0249.536] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xf6c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xf6c, lpOverlapped=0x0) returned 1 [0249.537] CloseHandle (hObject=0xdc) returned 1 [0249.537] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0249.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.538] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.538] GetTickCount () returned 0x4dc4a [0249.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.539] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538\\....\\temporaryfile")) returned 0 [0249.539] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538\\temporaryfile")) returned 1 [0249.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.541] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.541] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.541] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538\\temporaryfile")) returned 1 [0249.541] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99adcca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99adcca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99adcca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.541] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318538" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318538")) returned 1 [0249.542] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 0 [0249.542] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.542] WriteFile (in: hFile=0xdc, lpBuffer=0x2b4a90*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b4a90*, lpNumberOfBytesWritten=0x18fdd8*=0xf70, lpOverlapped=0x0) returned 1 [0249.543] CloseHandle (hObject=0xdc) returned 1 [0249.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.544] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x292a [0249.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2932) returned 0x2c4a70 [0249.544] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x292a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x292a, lpOverlapped=0x0) returned 1 [0249.545] CloseHandle (hObject=0xdc) returned 1 [0249.545] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0249.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.546] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.546] GetTickCount () returned 0x4dc5a [0249.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.547] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554\\....\\temporaryfile")) returned 0 [0249.547] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554\\temporaryfile")) returned 1 [0249.548] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.548] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.548] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.548] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.549] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.549] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.549] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.549] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554\\temporaryfile")) returned 1 [0249.549] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.549] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.549] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554")) returned 1 [0249.549] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 0 [0249.550] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.550] WriteFile (in: hFile=0xdc, lpBuffer=0x2c73b8*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c73b8*, lpNumberOfBytesWritten=0x18fdd8*=0x2930, lpOverlapped=0x0) returned 1 [0249.551] CloseHandle (hObject=0xdc) returned 1 [0249.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.551] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x108c [0249.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1094) returned 0x25b528 [0249.552] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x108c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x108c, lpOverlapped=0x0) returned 1 [0249.553] CloseHandle (hObject=0xdc) returned 1 [0249.553] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0249.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.554] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.554] GetTickCount () returned 0x4dc5a [0249.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.554] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.555] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554\\....\\temporaryfile")) returned 0 [0249.555] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554\\temporaryfile")) returned 1 [0249.556] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.557] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.557] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.557] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.557] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.557] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.557] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.557] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554\\temporaryfile")) returned 1 [0249.557] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b02e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b02e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b02e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.557] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.557] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318554" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318554")) returned 1 [0249.557] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 0 [0249.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.558] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1090, lpOverlapped=0x0) returned 1 [0249.559] CloseHandle (hObject=0xdc) returned 1 [0249.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.560] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x246a [0249.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2472) returned 0x2c4a70 [0249.560] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x246a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x246a, lpOverlapped=0x0) returned 1 [0249.561] CloseHandle (hObject=0xdc) returned 1 [0249.561] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0249.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.562] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.562] GetTickCount () returned 0x4dc69 [0249.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.563] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569\\....\\temporaryfile")) returned 0 [0249.563] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569\\temporaryfile")) returned 1 [0249.564] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.564] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.564] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.564] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.564] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.564] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.565] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.565] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569\\temporaryfile")) returned 1 [0249.565] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.565] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.565] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569")) returned 1 [0249.565] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 0 [0249.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.566] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6ef8*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6ef8*, lpNumberOfBytesWritten=0x18fdd8*=0x2470, lpOverlapped=0x0) returned 1 [0249.567] CloseHandle (hObject=0xdc) returned 1 [0249.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.568] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdec [0249.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdf4) returned 0x2350048 [0249.568] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xdec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xdec, lpOverlapped=0x0) returned 1 [0249.569] CloseHandle (hObject=0xdc) returned 1 [0249.569] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0249.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.570] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.570] GetTickCount () returned 0x4dc69 [0249.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.571] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569\\....\\temporaryfile")) returned 0 [0249.571] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569\\temporaryfile")) returned 1 [0249.573] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.573] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.573] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.573] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.573] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.573] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.573] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.573] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569\\temporaryfile")) returned 1 [0249.573] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b28f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b28f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b28f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.573] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.573] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318569" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318569")) returned 1 [0249.573] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 0 [0249.574] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.574] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xdf0, lpOverlapped=0x0) returned 1 [0249.584] CloseHandle (hObject=0xdc) returned 1 [0249.584] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.585] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x976 [0249.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x97e) returned 0x2350048 [0249.585] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x976, lpOverlapped=0x0) returned 1 [0249.586] CloseHandle (hObject=0xdc) returned 1 [0249.587] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0249.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.591] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.592] GetTickCount () returned 0x4dc88 [0249.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.592] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.592] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600\\....\\temporaryfile")) returned 0 [0249.593] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600\\temporaryfile")) returned 1 [0249.594] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.594] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.594] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.594] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.594] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.594] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.594] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.594] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600\\temporaryfile")) returned 1 [0249.594] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.594] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.594] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600")) returned 1 [0249.595] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 0 [0249.595] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.595] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x980, lpOverlapped=0x0) returned 1 [0249.596] CloseHandle (hObject=0xdc) returned 1 [0249.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.597] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8d6 [0249.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8de) returned 0x2350048 [0249.598] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x8d6, lpOverlapped=0x0) returned 1 [0249.599] CloseHandle (hObject=0xdc) returned 1 [0249.599] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0249.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.600] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.600] GetTickCount () returned 0x4dc88 [0249.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.601] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600\\....\\temporaryfile")) returned 0 [0249.601] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600\\temporaryfile")) returned 1 [0249.602] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.602] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.602] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.602] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.603] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.603] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.603] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.603] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600\\temporaryfile")) returned 1 [0249.603] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b75220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b75220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b75220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.603] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.603] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318600" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318600")) returned 1 [0249.603] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 0 [0249.604] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.604] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x8e0, lpOverlapped=0x0) returned 1 [0249.605] CloseHandle (hObject=0xdc) returned 1 [0249.606] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.607] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8d6 [0249.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8de) returned 0x2350048 [0249.607] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8d6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x8d6, lpOverlapped=0x0) returned 1 [0249.608] CloseHandle (hObject=0xdc) returned 1 [0249.608] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0249.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.609] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.609] GetTickCount () returned 0x4dc98 [0249.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.609] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616\\....\\temporaryfile")) returned 0 [0249.610] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616\\temporaryfile")) returned 1 [0249.611] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.611] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.611] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.611] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.611] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.611] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.611] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.612] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616\\temporaryfile")) returned 1 [0249.612] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.612] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.612] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616")) returned 1 [0249.612] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 0 [0249.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.613] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x8e0, lpOverlapped=0x0) returned 1 [0249.614] CloseHandle (hObject=0xdc) returned 1 [0249.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.615] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b3a [0249.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b42) returned 0x2c4a70 [0249.615] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b3a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b3a, lpOverlapped=0x0) returned 1 [0249.616] CloseHandle (hObject=0xdc) returned 1 [0249.616] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0249.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.617] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.617] GetTickCount () returned 0x4dc98 [0249.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.618] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616\\....\\temporaryfile")) returned 0 [0249.619] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616\\temporaryfile")) returned 1 [0249.620] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99bc14e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99bc14e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.620] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99bc14e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99bc14e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.620] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.620] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.620] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.620] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.620] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.620] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616\\temporaryfile")) returned 1 [0249.620] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99b9b380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99b9b380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99b9b380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.620] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.621] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318616" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318616")) returned 1 [0249.621] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 0 [0249.621] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.621] WriteFile (in: hFile=0xdc, lpBuffer=0x2c65c8*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c65c8*, lpNumberOfBytesWritten=0x18fdd8*=0x1b40, lpOverlapped=0x0) returned 1 [0249.622] CloseHandle (hObject=0xdc) returned 1 [0249.622] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.623] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1496 [0249.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x149e) returned 0x29b460 [0249.623] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1496, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1496, lpOverlapped=0x0) returned 1 [0249.625] CloseHandle (hObject=0xdc) returned 1 [0249.625] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0249.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.626] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.626] GetTickCount () returned 0x4dca8 [0249.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.626] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318632\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318632\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318632\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318632\\....\\temporaryfile")) returned 0 [0249.627] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318632\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318632\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318632\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318632\\temporaryfile")) returned 1 [0249.628] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318632\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99bc14e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99bc14e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99bc14e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.628] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99bc14e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99bc14e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99bc14e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.628] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99bc14e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99bc14e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99bc14e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.628] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318632\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99bc14e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99bc14e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99bc14e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.628] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99bc14e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99bc14e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99bc14e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.628] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99bc14e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99bc14e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99bc14e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.629] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.629] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318632\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318632\\temporaryfile")) returned 1 [0249.629] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99bc14e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99bc14e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99bc14e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.629] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.629] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318632" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318632")) returned 1 [0249.629] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 0 [0249.629] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.630] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x14a0, lpOverlapped=0x0) returned 1 [0249.631] CloseHandle (hObject=0xdc) returned 1 [0249.631] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.632] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc18a [0249.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc192) returned 0x2c4a70 [0249.632] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0xc18a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0xc18a, lpOverlapped=0x0) returned 1 [0249.634] CloseHandle (hObject=0xdc) returned 1 [0249.634] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0249.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.635] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.635] GetTickCount () returned 0x4dcb7 [0249.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.636] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647\\....\\temporaryfile")) returned 0 [0249.637] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647\\temporaryfile")) returned 1 [0249.638] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.638] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.638] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.638] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.639] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.639] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.639] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.639] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647\\temporaryfile")) returned 1 [0249.639] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.639] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.639] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647")) returned 1 [0249.639] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 0 [0249.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.641] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0c18*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0c18*, lpNumberOfBytesWritten=0x18fdd8*=0xc190, lpOverlapped=0x0) returned 1 [0249.643] CloseHandle (hObject=0xdc) returned 1 [0249.643] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.644] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb96 [0249.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb9e) returned 0x2350048 [0249.644] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xb96, lpOverlapped=0x0) returned 1 [0249.645] CloseHandle (hObject=0xdc) returned 1 [0249.645] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0249.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.646] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.646] GetTickCount () returned 0x4dcb7 [0249.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256210 [0249.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.647] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.647] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647\\....\\temporaryfile")) returned 0 [0249.648] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647\\temporaryfile")) returned 1 [0249.649] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.649] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.649] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.649] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.649] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.649] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.649] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.649] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647\\temporaryfile")) returned 1 [0249.649] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99be7640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99be7640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99be7640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.649] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.649] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318647" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318647")) returned 1 [0249.649] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 0 [0249.650] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.650] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xba0, lpOverlapped=0x0) returned 1 [0249.651] CloseHandle (hObject=0xdc) returned 1 [0249.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.652] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2856 [0249.652] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x285e) returned 0x2c4a70 [0249.652] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2856, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2856, lpOverlapped=0x0) returned 1 [0249.654] CloseHandle (hObject=0xdc) returned 1 [0249.654] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0249.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.655] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.655] GetTickCount () returned 0x4dcc7 [0249.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.655] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663\\....\\temporaryfile")) returned 0 [0249.656] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663\\temporaryfile")) returned 1 [0249.657] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c0d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c0d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c0d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.657] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c0d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c0d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c0d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.657] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c0d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c0d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c0d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.657] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c0d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c0d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c0d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.657] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c0d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c0d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c0d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.657] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c0d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c0d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c0d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.657] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.657] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663\\temporaryfile")) returned 1 [0249.658] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c0d7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c0d7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c0d7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.658] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.658] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663")) returned 1 [0249.658] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 0 [0249.658] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.659] WriteFile (in: hFile=0xdc, lpBuffer=0x2c72e0*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c72e0*, lpNumberOfBytesWritten=0x18fdd8*=0x2860, lpOverlapped=0x0) returned 1 [0249.660] CloseHandle (hObject=0xdc) returned 1 [0249.660] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.661] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7992 [0249.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x799a) returned 0x2c4a70 [0249.661] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x7992, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x7992, lpOverlapped=0x0) returned 1 [0249.662] CloseHandle (hObject=0xdc) returned 1 [0249.663] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0249.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.664] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.664] GetTickCount () returned 0x4dcc7 [0249.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.668] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663\\....\\temporaryfile")) returned 0 [0249.668] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663\\temporaryfile")) returned 1 [0249.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.670] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.670] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.670] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.670] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.670] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.670] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663\\temporaryfile")) returned 1 [0249.670] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.670] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318663" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318663")) returned 1 [0249.670] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 0 [0249.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.671] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc420*, nNumberOfBytesToWrite=0x7998, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc420*, lpNumberOfBytesWritten=0x18fdd8*=0x7998, lpOverlapped=0x0) returned 1 [0249.673] CloseHandle (hObject=0xdc) returned 1 [0249.673] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.674] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2040 [0249.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2048) returned 0x2c4a70 [0249.674] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2040, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2040, lpOverlapped=0x0) returned 1 [0249.675] CloseHandle (hObject=0xdc) returned 1 [0249.675] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0249.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.676] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.676] GetTickCount () returned 0x4dcd6 [0249.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.677] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318678\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318678\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318678\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318678\\....\\temporaryfile")) returned 0 [0249.678] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318678\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318678\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318678\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318678\\temporaryfile")) returned 1 [0249.679] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318678\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.679] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.679] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.679] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318678\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.679] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.679] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.679] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318678\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318678\\temporaryfile")) returned 1 [0249.679] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c33900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c33900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c33900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.679] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.680] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318678" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318678")) returned 1 [0249.680] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 0 [0249.680] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.681] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6ac8*, nNumberOfBytesToWrite=0x2048, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6ac8*, lpNumberOfBytesWritten=0x18fdd8*=0x2048, lpOverlapped=0x0) returned 1 [0249.682] CloseHandle (hObject=0xdc) returned 1 [0249.682] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.682] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x73bc [0249.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x73c4) returned 0x2c4a70 [0249.682] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x73bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x73bc, lpOverlapped=0x0) returned 1 [0249.684] CloseHandle (hObject=0xdc) returned 1 [0249.684] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0249.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.685] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.685] GetTickCount () returned 0x4dce6 [0249.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.685] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694\\....\\temporaryfile")) returned 0 [0249.686] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694\\temporaryfile")) returned 1 [0249.687] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.687] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.687] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.687] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.687] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.687] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694\\temporaryfile")) returned 1 [0249.688] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.688] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.688] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694")) returned 1 [0249.688] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 0 [0249.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.689] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbe48*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbe48*, lpNumberOfBytesWritten=0x18fdd8*=0x73c0, lpOverlapped=0x0) returned 1 [0249.690] CloseHandle (hObject=0xdc) returned 1 [0249.690] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.691] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa82 [0249.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa8a) returned 0x2350048 [0249.691] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa82, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xa82, lpOverlapped=0x0) returned 1 [0249.693] CloseHandle (hObject=0xdc) returned 1 [0249.693] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0249.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.693] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.694] GetTickCount () returned 0x4dce6 [0249.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.694] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694\\....\\temporaryfile")) returned 0 [0249.695] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694\\temporaryfile")) returned 1 [0249.696] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.696] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.696] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.696] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.696] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.696] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.696] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.696] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694\\temporaryfile")) returned 1 [0249.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c59a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c59a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c59a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.697] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318694" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318694")) returned 1 [0249.697] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 0 [0249.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.698] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xa88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xa88, lpOverlapped=0x0) returned 1 [0249.699] CloseHandle (hObject=0xdc) returned 1 [0249.699] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.699] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb10 [0249.699] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb18) returned 0x2350048 [0249.699] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xb10, lpOverlapped=0x0) returned 1 [0249.701] CloseHandle (hObject=0xdc) returned 1 [0249.701] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0249.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.702] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.702] GetTickCount () returned 0x4dcf6 [0249.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.702] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710\\....\\temporaryfile")) returned 0 [0249.703] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710\\temporaryfile")) returned 1 [0249.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.704] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.704] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.704] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710\\temporaryfile")) returned 1 [0249.705] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.705] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.705] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710")) returned 1 [0249.705] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 0 [0249.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.705] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xb18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xb18, lpOverlapped=0x0) returned 1 [0249.706] CloseHandle (hObject=0xdc) returned 1 [0249.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.707] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9456 [0249.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x945e) returned 0x2c4a70 [0249.707] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x9456, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x9456, lpOverlapped=0x0) returned 1 [0249.708] CloseHandle (hObject=0xdc) returned 1 [0249.708] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0249.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.710] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.710] GetTickCount () returned 0x4dcf6 [0249.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.711] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.712] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710\\....\\temporaryfile")) returned 0 [0249.712] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710\\temporaryfile")) returned 1 [0249.714] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ca5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ca5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ca5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ca5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.714] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.714] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.714] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.714] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.714] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710\\temporaryfile")) returned 1 [0249.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99c7fbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99c7fbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99c7fbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.715] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.715] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318710" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318710")) returned 1 [0249.715] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 0 [0249.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.716] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdee0*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdee0*, lpNumberOfBytesWritten=0x18fdd8*=0x9460, lpOverlapped=0x0) returned 1 [0249.718] CloseHandle (hObject=0xdc) returned 1 [0249.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.719] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9c5e [0249.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9c66) returned 0x2c4a70 [0249.719] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x9c5e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x9c5e, lpOverlapped=0x0) returned 1 [0249.720] CloseHandle (hObject=0xdc) returned 1 [0249.720] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0249.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.721] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.721] GetTickCount () returned 0x4dd05 [0249.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.722] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318725\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318725\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318725\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318725\\....\\temporaryfile")) returned 0 [0249.722] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318725\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318725\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318725\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318725\\temporaryfile")) returned 1 [0249.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318725\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ca5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ca5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ca5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ca5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ca5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ca5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ca5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ca5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ca5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318725\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ca5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ca5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ca5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.724] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ca5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ca5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ca5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.724] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ca5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ca5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ca5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.724] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.724] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318725\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318725\\temporaryfile")) returned 1 [0249.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ca5d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ca5d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ca5d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.724] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.724] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318725" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318725")) returned 1 [0249.724] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 0 [0249.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.726] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce6e8*, nNumberOfBytesToWrite=0x9c68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce6e8*, lpNumberOfBytesWritten=0x18fdd8*=0x9c68, lpOverlapped=0x0) returned 1 [0249.727] CloseHandle (hObject=0xdc) returned 1 [0249.727] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.728] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x318 [0249.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x320) returned 0x259e70 [0249.728] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x318, lpOverlapped=0x0) returned 1 [0249.729] CloseHandle (hObject=0xdc) returned 1 [0249.729] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0249.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.730] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.730] GetTickCount () returned 0x4dd15 [0249.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.731] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741\\....\\temporaryfile")) returned 0 [0249.731] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741\\temporaryfile")) returned 1 [0249.733] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.733] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.733] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.733] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.733] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.733] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741\\temporaryfile")) returned 1 [0249.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.733] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.733] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741")) returned 1 [0249.733] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 0 [0249.734] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.734] WriteFile (in: hFile=0xdc, lpBuffer=0x25a1a0*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a1a0*, lpNumberOfBytesWritten=0x18fdd8*=0x320, lpOverlapped=0x0) returned 1 [0249.735] CloseHandle (hObject=0xdc) returned 1 [0249.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.736] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x44b0 [0249.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x44b8) returned 0x2c4a70 [0249.736] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x44b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x44b0, lpOverlapped=0x0) returned 1 [0249.737] CloseHandle (hObject=0xdc) returned 1 [0249.737] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0249.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.738] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.738] GetTickCount () returned 0x4dd15 [0249.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.739] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.739] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741\\....\\temporaryfile")) returned 0 [0249.739] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741\\temporaryfile")) returned 1 [0249.740] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.740] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.740] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.741] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.741] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.741] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.741] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.741] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741\\temporaryfile")) returned 1 [0249.741] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ccbe80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ccbe80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ccbe80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.741] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.741] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318741" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318741")) returned 1 [0249.741] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 0 [0249.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.742] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8f38*, nNumberOfBytesToWrite=0x44b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8f38*, lpNumberOfBytesWritten=0x18fdd8*=0x44b8, lpOverlapped=0x0) returned 1 [0249.743] CloseHandle (hObject=0xdc) returned 1 [0249.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.744] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e94 [0249.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e9c) returned 0x2c4a70 [0249.744] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1e94, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1e94, lpOverlapped=0x0) returned 1 [0249.745] CloseHandle (hObject=0xdc) returned 1 [0249.745] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0249.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.746] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.746] GetTickCount () returned 0x4dd24 [0249.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.747] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.747] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756\\....\\temporaryfile")) returned 0 [0249.747] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756\\temporaryfile")) returned 1 [0249.749] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.749] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.749] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.749] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.749] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.749] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.749] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.749] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756\\temporaryfile")) returned 1 [0249.749] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.749] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.749] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756")) returned 1 [0249.749] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 0 [0249.750] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.750] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6920*, nNumberOfBytesToWrite=0x1e98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6920*, lpNumberOfBytesWritten=0x18fdd8*=0x1e98, lpOverlapped=0x0) returned 1 [0249.751] CloseHandle (hObject=0xdc) returned 1 [0249.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.752] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa7f0 [0249.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa7f8) returned 0x2c4a70 [0249.752] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0xa7f0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0xa7f0, lpOverlapped=0x0) returned 1 [0249.754] CloseHandle (hObject=0xdc) returned 1 [0249.754] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0249.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.755] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.755] GetTickCount () returned 0x4dd24 [0249.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.756] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756\\....\\temporaryfile")) returned 0 [0249.756] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756\\temporaryfile")) returned 1 [0249.757] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.758] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.758] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.758] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.758] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.758] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.758] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.758] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756\\temporaryfile")) returned 1 [0249.758] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99cf1fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99cf1fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99cf1fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.758] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.758] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318756" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318756")) returned 1 [0249.758] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 0 [0249.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.760] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf278*, nNumberOfBytesToWrite=0xa7f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf278*, lpNumberOfBytesWritten=0x18fdd8*=0xa7f8, lpOverlapped=0x0) returned 1 [0249.761] CloseHandle (hObject=0xdc) returned 1 [0249.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.762] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa79c [0249.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa7a4) returned 0x2c4a70 [0249.762] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0xa79c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0xa79c, lpOverlapped=0x0) returned 1 [0249.763] CloseHandle (hObject=0xdc) returned 1 [0249.763] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0249.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.764] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.764] GetTickCount () returned 0x4dd34 [0249.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.765] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772\\....\\temporaryfile")) returned 0 [0249.765] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772\\temporaryfile")) returned 1 [0249.766] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.767] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.767] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.767] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.767] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.767] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.767] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.767] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772\\temporaryfile")) returned 1 [0249.767] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.767] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.767] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772")) returned 1 [0249.767] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 0 [0249.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.769] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf228*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf228*, lpNumberOfBytesWritten=0x18fdd8*=0xa7a0, lpOverlapped=0x0) returned 1 [0249.770] CloseHandle (hObject=0xdc) returned 1 [0249.770] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.771] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2c8 [0249.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d0) returned 0x259e70 [0249.771] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2c8, lpOverlapped=0x0) returned 1 [0249.771] CloseHandle (hObject=0xdc) returned 1 [0249.772] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0249.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.772] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.772] GetTickCount () returned 0x4dd34 [0249.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.773] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772\\....\\temporaryfile")) returned 0 [0249.774] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772\\temporaryfile")) returned 1 [0249.775] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.775] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.775] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.775] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.775] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.775] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.775] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.775] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772\\temporaryfile")) returned 1 [0249.775] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d18140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d18140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d18140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.775] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.776] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318772" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318772")) returned 1 [0249.776] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 0 [0249.776] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.776] WriteFile (in: hFile=0xdc, lpBuffer=0x25a150*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a150*, lpNumberOfBytesWritten=0x18fdd8*=0x2d0, lpOverlapped=0x0) returned 1 [0249.777] CloseHandle (hObject=0xdc) returned 1 [0249.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.778] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x78c [0249.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x794) returned 0x2350048 [0249.778] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x78c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x78c, lpOverlapped=0x0) returned 1 [0249.779] CloseHandle (hObject=0xdc) returned 1 [0249.779] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0249.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.780] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.780] GetTickCount () returned 0x4dd44 [0249.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.781] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318788\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318788\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318788\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318788\\....\\temporaryfile")) returned 0 [0249.782] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318788\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318788\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318788\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318788\\temporaryfile")) returned 1 [0249.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318788\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d3e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d3e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d3e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.783] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d3e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d3e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d3e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.783] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d3e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d3e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d3e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.784] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318788\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d3e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d3e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d3e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.784] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d3e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d3e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d3e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.784] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d3e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d3e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d3e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.784] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.784] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318788\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318788\\temporaryfile")) returned 1 [0249.784] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d3e2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d3e2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d3e2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.784] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.784] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318788" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318788")) returned 1 [0249.785] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 0 [0249.785] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.785] WriteFile (in: hFile=0xdc, lpBuffer=0x23507f0*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23507f0*, lpNumberOfBytesWritten=0x18fdd8*=0x790, lpOverlapped=0x0) returned 1 [0249.786] CloseHandle (hObject=0xdc) returned 1 [0249.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.788] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb88 [0249.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb90) returned 0x2350048 [0249.788] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xb88, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xb88, lpOverlapped=0x0) returned 1 [0249.789] CloseHandle (hObject=0xdc) returned 1 [0249.789] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0249.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.790] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.790] GetTickCount () returned 0x4dd53 [0249.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.791] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803\\....\\temporaryfile")) returned 0 [0249.791] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803\\temporaryfile")) returned 1 [0249.796] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.796] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.796] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.796] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.796] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.796] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.796] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.796] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803\\temporaryfile")) returned 1 [0249.796] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.796] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.796] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803")) returned 1 [0249.797] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 0 [0249.797] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.797] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xb90, lpOverlapped=0x0) returned 1 [0249.798] CloseHandle (hObject=0xdc) returned 1 [0249.798] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.799] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2708 [0249.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2710) returned 0x2c4a70 [0249.799] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2708, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2708, lpOverlapped=0x0) returned 1 [0249.800] CloseHandle (hObject=0xdc) returned 1 [0249.800] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0249.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.801] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.801] GetTickCount () returned 0x4dd53 [0249.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.802] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803\\....\\temporaryfile")) returned 0 [0249.803] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803\\temporaryfile")) returned 1 [0249.804] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.804] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.804] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.804] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.804] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.804] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.804] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803\\temporaryfile")) returned 1 [0249.804] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d64400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d64400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d64400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.804] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318803" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318803")) returned 1 [0249.805] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 0 [0249.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.805] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7190*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7190*, lpNumberOfBytesWritten=0x18fdd8*=0x2710, lpOverlapped=0x0) returned 1 [0249.806] CloseHandle (hObject=0xdc) returned 1 [0249.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.807] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5130 [0249.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5138) returned 0x2c4a70 [0249.807] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x5130, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x5130, lpOverlapped=0x0) returned 1 [0249.810] CloseHandle (hObject=0xdc) returned 1 [0249.810] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0249.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.811] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.811] GetTickCount () returned 0x4dd63 [0249.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.812] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.812] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819\\....\\temporaryfile")) returned 0 [0249.812] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819\\temporaryfile")) returned 1 [0249.813] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.813] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.814] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.814] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.814] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.814] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.814] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.814] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819\\temporaryfile")) returned 1 [0249.814] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.814] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.814] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819")) returned 1 [0249.814] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 0 [0249.815] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.815] WriteFile (in: hFile=0xdc, lpBuffer=0x2c9bb8*, nNumberOfBytesToWrite=0x5138, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c9bb8*, lpNumberOfBytesWritten=0x18fdd8*=0x5138, lpOverlapped=0x0) returned 1 [0249.816] CloseHandle (hObject=0xdc) returned 1 [0249.816] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.817] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x600c [0249.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6014) returned 0x2c4a70 [0249.817] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x600c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x600c, lpOverlapped=0x0) returned 1 [0249.819] CloseHandle (hObject=0xdc) returned 1 [0249.819] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0249.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.820] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.820] GetTickCount () returned 0x4dd63 [0249.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.821] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.822] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819\\....\\temporaryfile")) returned 0 [0249.822] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819\\temporaryfile")) returned 1 [0249.824] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99db06c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99db06c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.824] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99db06c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99db06c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.824] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.824] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.824] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.824] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819\\temporaryfile")) returned 1 [0249.824] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99d8a560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99d8a560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99d8a560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.824] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.824] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318819" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318819")) returned 1 [0249.825] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 0 [0249.825] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.826] WriteFile (in: hFile=0xdc, lpBuffer=0x2caa98*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caa98*, lpNumberOfBytesWritten=0x18fdd8*=0x6010, lpOverlapped=0x0) returned 1 [0249.827] CloseHandle (hObject=0xdc) returned 1 [0249.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.828] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8b2 [0249.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8ba) returned 0x2350048 [0249.828] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8b2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x8b2, lpOverlapped=0x0) returned 1 [0249.829] CloseHandle (hObject=0xdc) returned 1 [0249.830] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0249.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.830] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.831] GetTickCount () returned 0x4dd72 [0249.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.831] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318834\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318834\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318834\\....\\temporaryfile")) returned 0 [0249.832] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318834\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318834\\temporaryfile")) returned 1 [0249.833] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318834\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99db06c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99db06c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99db06c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99db06c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99db06c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99db06c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99db06c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99db06c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99db06c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.833] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318834\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99db06c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99db06c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99db06c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.833] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99db06c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99db06c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99db06c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.833] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99db06c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99db06c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99db06c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.833] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318834\\temporaryfile")) returned 1 [0249.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99db06c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99db06c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99db06c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.834] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318834" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318834")) returned 1 [0249.834] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 0 [0249.834] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.835] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x8b8, lpOverlapped=0x0) returned 1 [0249.836] CloseHandle (hObject=0xdc) returned 1 [0249.836] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.836] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x39e4 [0249.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x39ec) returned 0x2c4a70 [0249.836] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x39e4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x39e4, lpOverlapped=0x0) returned 1 [0249.838] CloseHandle (hObject=0xdc) returned 1 [0249.838] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0249.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.839] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.839] GetTickCount () returned 0x4dd82 [0249.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.839] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850\\....\\temporaryfile")) returned 0 [0249.840] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850\\temporaryfile")) returned 1 [0249.841] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.841] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.841] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.841] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.841] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.841] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.842] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.842] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850\\temporaryfile")) returned 1 [0249.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.842] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.842] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850")) returned 1 [0249.842] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 0 [0249.842] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.843] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8470*, nNumberOfBytesToWrite=0x39e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8470*, lpNumberOfBytesWritten=0x18fdd8*=0x39e8, lpOverlapped=0x0) returned 1 [0249.844] CloseHandle (hObject=0xdc) returned 1 [0249.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.845] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe6c [0249.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe74) returned 0x2350048 [0249.845] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe6c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe6c, lpOverlapped=0x0) returned 1 [0249.847] CloseHandle (hObject=0xdc) returned 1 [0249.847] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0249.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.847] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.847] GetTickCount () returned 0x4dd82 [0249.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.848] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850\\....\\temporaryfile")) returned 0 [0249.849] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850\\temporaryfile")) returned 1 [0249.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.850] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.850] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.850] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850\\temporaryfile")) returned 1 [0249.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dd6820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dd6820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dd6820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.851] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.851] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318850" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318850")) returned 1 [0249.851] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 0 [0249.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.852] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe70, lpOverlapped=0x0) returned 1 [0249.853] CloseHandle (hObject=0xdc) returned 1 [0249.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.854] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe30 [0249.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe38) returned 0x2350048 [0249.854] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe30, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe30, lpOverlapped=0x0) returned 1 [0249.855] CloseHandle (hObject=0xdc) returned 1 [0249.855] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0249.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.856] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.856] GetTickCount () returned 0x4dd92 [0249.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.857] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.857] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866\\....\\temporaryfile")) returned 0 [0249.857] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866\\temporaryfile")) returned 1 [0249.858] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.858] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.859] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.859] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.859] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.859] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866\\temporaryfile")) returned 1 [0249.859] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.859] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.859] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866")) returned 1 [0249.859] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 0 [0249.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.860] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe38, lpOverlapped=0x0) returned 1 [0249.861] CloseHandle (hObject=0xdc) returned 1 [0249.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.862] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe20 [0249.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe28) returned 0x2350048 [0249.862] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe20, lpOverlapped=0x0) returned 1 [0249.863] CloseHandle (hObject=0xdc) returned 1 [0249.863] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0249.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.864] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.864] GetTickCount () returned 0x4dd92 [0249.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.865] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866\\....\\temporaryfile")) returned 0 [0249.866] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866\\temporaryfile")) returned 1 [0249.867] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.867] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.867] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.867] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.867] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.867] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.867] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.867] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866\\temporaryfile")) returned 1 [0249.868] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99dfc980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99dfc980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99dfc980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.868] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.868] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318866" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318866")) returned 1 [0249.868] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 0 [0249.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.869] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe28, lpOverlapped=0x0) returned 1 [0249.870] CloseHandle (hObject=0xdc) returned 1 [0249.870] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.870] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x85c [0249.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x864) returned 0x2350048 [0249.870] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x85c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x85c, lpOverlapped=0x0) returned 1 [0249.872] CloseHandle (hObject=0xdc) returned 1 [0249.872] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0249.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.872] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.873] GetTickCount () returned 0x4dda1 [0249.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.873] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881\\....\\temporaryfile")) returned 0 [0249.874] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881\\temporaryfile")) returned 1 [0249.875] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.875] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.875] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.875] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.875] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.875] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.875] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.875] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881\\temporaryfile")) returned 1 [0249.875] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.875] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.876] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881")) returned 1 [0249.876] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 0 [0249.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.877] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x860, lpOverlapped=0x0) returned 1 [0249.877] CloseHandle (hObject=0xdc) returned 1 [0249.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.878] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xadc [0249.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xae4) returned 0x2350048 [0249.878] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xadc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xadc, lpOverlapped=0x0) returned 1 [0249.879] CloseHandle (hObject=0xdc) returned 1 [0249.880] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0249.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.880] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.880] GetTickCount () returned 0x4dda1 [0249.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.881] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881\\....\\temporaryfile")) returned 0 [0249.882] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881\\temporaryfile")) returned 1 [0249.883] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.883] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.883] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.883] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.883] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.883] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.883] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.884] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881\\temporaryfile")) returned 1 [0249.884] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e22ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e22ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e22ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.884] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.884] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318881" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318881")) returned 1 [0249.884] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 0 [0249.884] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.885] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xae0, lpOverlapped=0x0) returned 1 [0249.886] CloseHandle (hObject=0xdc) returned 1 [0249.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.886] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaec [0249.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaf4) returned 0x2350048 [0249.886] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xaec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xaec, lpOverlapped=0x0) returned 1 [0249.888] CloseHandle (hObject=0xdc) returned 1 [0249.888] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0249.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.889] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.889] GetTickCount () returned 0x4ddb1 [0249.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.890] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897\\....\\temporaryfile")) returned 0 [0249.891] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897\\temporaryfile")) returned 1 [0249.892] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e48c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e48c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e48c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e48c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e48c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e48c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e48c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e48c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e48c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.892] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e48c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e48c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e48c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.892] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e48c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e48c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e48c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.893] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e48c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e48c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e48c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.893] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.893] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897\\temporaryfile")) returned 1 [0249.893] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e48c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e48c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e48c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.893] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.893] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897")) returned 1 [0249.893] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 0 [0249.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.894] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xaf0, lpOverlapped=0x0) returned 1 [0249.895] CloseHandle (hObject=0xdc) returned 1 [0249.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.896] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb90 [0249.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb98) returned 0x2350048 [0249.896] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xb90, lpOverlapped=0x0) returned 1 [0249.898] CloseHandle (hObject=0xdc) returned 1 [0249.898] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0249.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.898] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.899] GetTickCount () returned 0x4ddb1 [0249.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.899] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897\\....\\temporaryfile")) returned 0 [0249.900] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897\\temporaryfile")) returned 1 [0249.901] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e48c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.901] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e48c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.901] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.901] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.902] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.902] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.902] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.902] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897\\temporaryfile")) returned 1 [0249.902] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.902] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.902] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318897" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318897")) returned 1 [0249.902] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 0 [0249.902] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.903] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xb98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xb98, lpOverlapped=0x0) returned 1 [0249.904] CloseHandle (hObject=0xdc) returned 1 [0249.904] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.904] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb90 [0249.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb98) returned 0x2350048 [0249.904] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xb90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xb90, lpOverlapped=0x0) returned 1 [0249.906] CloseHandle (hObject=0xdc) returned 1 [0249.906] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0249.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.907] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.907] GetTickCount () returned 0x4ddc0 [0249.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.907] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318912\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318912\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318912\\....\\temporaryfile")) returned 0 [0249.908] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318912\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318912\\temporaryfile")) returned 1 [0249.909] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318912\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.910] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318912\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.910] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.910] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.910] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.910] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318912\\temporaryfile")) returned 1 [0249.910] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e6eda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e6eda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e6eda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.910] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.910] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318912" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318912")) returned 1 [0249.910] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 0 [0249.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.911] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xb98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xb98, lpOverlapped=0x0) returned 1 [0249.912] CloseHandle (hObject=0xdc) returned 1 [0249.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.913] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe04 [0249.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe0c) returned 0x2350048 [0249.913] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe04, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe04, lpOverlapped=0x0) returned 1 [0249.914] CloseHandle (hObject=0xdc) returned 1 [0249.914] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0249.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.915] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.916] GetTickCount () returned 0x4ddd0 [0249.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.916] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928\\....\\temporaryfile")) returned 0 [0249.917] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928\\temporaryfile")) returned 1 [0249.918] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.918] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.918] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.918] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.918] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928\\temporaryfile")) returned 1 [0249.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.918] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928")) returned 1 [0249.919] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 0 [0249.919] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.923] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe08, lpOverlapped=0x0) returned 1 [0249.924] CloseHandle (hObject=0xdc) returned 1 [0249.924] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.924] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8b4 [0249.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8bc) returned 0x2350048 [0249.924] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x8b4, lpOverlapped=0x0) returned 1 [0249.926] CloseHandle (hObject=0xdc) returned 1 [0249.926] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0249.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.927] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.927] GetTickCount () returned 0x4ddd0 [0249.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.928] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928\\....\\temporaryfile")) returned 0 [0249.929] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928\\temporaryfile")) returned 1 [0249.931] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.931] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.931] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.931] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.931] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.931] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.931] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.931] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928\\temporaryfile")) returned 1 [0249.931] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99e94f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99e94f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99e94f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.931] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.932] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318928" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318928")) returned 1 [0249.932] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 0 [0249.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.933] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x8b8, lpOverlapped=0x0) returned 1 [0249.934] CloseHandle (hObject=0xdc) returned 1 [0249.934] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.935] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8fc [0249.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x904) returned 0x2350048 [0249.935] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x8fc, lpOverlapped=0x0) returned 1 [0249.936] CloseHandle (hObject=0xdc) returned 1 [0249.936] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0249.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.937] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.937] GetTickCount () returned 0x4dde0 [0249.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.938] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944\\....\\temporaryfile")) returned 0 [0249.938] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944\\temporaryfile")) returned 1 [0249.939] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.939] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.939] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.939] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.940] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.940] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.940] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.940] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944\\temporaryfile")) returned 1 [0249.940] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.940] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.940] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944")) returned 1 [0249.940] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 0 [0249.940] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.941] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x900, lpOverlapped=0x0) returned 1 [0249.942] CloseHandle (hObject=0xdc) returned 1 [0249.942] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.942] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8fc [0249.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x904) returned 0x2350048 [0249.943] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x8fc, lpOverlapped=0x0) returned 1 [0249.944] CloseHandle (hObject=0xdc) returned 1 [0249.944] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0249.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.945] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.945] GetTickCount () returned 0x4dde0 [0249.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.945] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944\\....\\temporaryfile")) returned 0 [0249.947] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944\\temporaryfile")) returned 1 [0249.948] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ee11c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ee11c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.948] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ee11c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ee11c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.948] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.948] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.948] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.948] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.948] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.948] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944\\temporaryfile")) returned 1 [0249.948] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ebb060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ebb060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ebb060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.948] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.949] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318944" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318944")) returned 1 [0249.949] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 0 [0249.949] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.949] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x900, lpOverlapped=0x0) returned 1 [0249.950] CloseHandle (hObject=0xdc) returned 1 [0249.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.951] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x820 [0249.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x828) returned 0x2350048 [0249.952] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x820, lpOverlapped=0x0) returned 1 [0249.953] CloseHandle (hObject=0xdc) returned 1 [0249.953] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0249.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.954] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.954] GetTickCount () returned 0x4ddef [0249.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.954] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318959\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.955] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318959\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318959\\....\\temporaryfile")) returned 0 [0249.955] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318959\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318959\\temporaryfile")) returned 1 [0249.956] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318959\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ee11c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ee11c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ee11c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.956] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ee11c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ee11c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ee11c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.956] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ee11c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ee11c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ee11c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.956] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318959\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ee11c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ee11c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ee11c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.957] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ee11c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ee11c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ee11c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.957] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ee11c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ee11c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ee11c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.957] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.957] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318959\\temporaryfile")) returned 1 [0249.957] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99ee11c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99ee11c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99ee11c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.957] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.957] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318959" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318959")) returned 1 [0249.957] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 0 [0249.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.958] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x828, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x828, lpOverlapped=0x0) returned 1 [0249.959] CloseHandle (hObject=0xdc) returned 1 [0249.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.959] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x820 [0249.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x828) returned 0x2350048 [0249.959] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x820, lpOverlapped=0x0) returned 1 [0249.961] CloseHandle (hObject=0xdc) returned 1 [0249.961] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0249.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.962] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.962] GetTickCount () returned 0x4ddff [0249.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.963] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975\\....\\temporaryfile")) returned 0 [0249.964] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975\\temporaryfile")) returned 1 [0249.965] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.965] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.965] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.966] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.966] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.966] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.966] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.966] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975\\temporaryfile")) returned 1 [0249.966] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.966] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.966] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975")) returned 1 [0249.967] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 0 [0249.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.968] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x828, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x828, lpOverlapped=0x0) returned 1 [0249.969] CloseHandle (hObject=0xdc) returned 1 [0249.969] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.969] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7d4 [0249.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc) returned 0x2350048 [0249.969] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7d4, lpOverlapped=0x0) returned 1 [0249.971] CloseHandle (hObject=0xdc) returned 1 [0249.971] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0249.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.972] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.972] GetTickCount () returned 0x4ddff [0249.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.972] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.973] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975\\....\\temporaryfile")) returned 0 [0249.973] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975\\temporaryfile")) returned 1 [0249.974] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.974] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.974] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.974] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.975] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.975] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.975] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.975] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975\\temporaryfile")) returned 1 [0249.975] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f07320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f07320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f07320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.975] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.975] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318975" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318975")) returned 1 [0249.975] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 0 [0249.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.976] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x7d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x7d8, lpOverlapped=0x0) returned 1 [0249.977] CloseHandle (hObject=0xdc) returned 1 [0249.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.978] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7e4 [0249.978] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ec) returned 0x2350048 [0249.978] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7e4, lpOverlapped=0x0) returned 1 [0249.979] CloseHandle (hObject=0xdc) returned 1 [0249.979] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0249.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0249.980] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.980] GetTickCount () returned 0x4de0e [0249.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.981] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990\\...."), lpSecurityAttributes=0x256210) returned 1 [0249.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990\\....\\temporaryfile")) returned 0 [0249.981] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990\\temporaryfile")) returned 1 [0249.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.983] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.983] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.983] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990\\temporaryfile")) returned 1 [0249.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.983] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990")) returned 1 [0249.984] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 0 [0249.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.984] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x7e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x7e8, lpOverlapped=0x0) returned 1 [0249.985] CloseHandle (hObject=0xdc) returned 1 [0249.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.986] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x964 [0249.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x96c) returned 0x2350048 [0249.986] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x964, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x964, lpOverlapped=0x0) returned 1 [0249.987] CloseHandle (hObject=0xdc) returned 1 [0249.987] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0249.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0249.988] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0249.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0249.988] GetTickCount () returned 0x4de0e [0249.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0249.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0249.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0249.989] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990\\...."), lpSecurityAttributes=0x256228) returned 1 [0249.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990\\....\\temporaryfile")) returned 0 [0249.989] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990\\temporaryfile")) returned 1 [0249.991] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0249.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0249.991] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0249.991] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.991] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.991] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0249.991] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990\\temporaryfile")) returned 1 [0249.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f2d480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f2d480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f2d480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0249.991] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0249.991] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18318990" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18318990")) returned 1 [0249.991] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 0 [0249.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.993] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x968, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x968, lpOverlapped=0x0) returned 1 [0249.994] CloseHandle (hObject=0xdc) returned 1 [0249.994] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0249.995] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x804 [0249.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80c) returned 0x2350048 [0249.995] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x804, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x804, lpOverlapped=0x0) returned 1 [0250.032] CloseHandle (hObject=0xdc) returned 1 [0250.032] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0250.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.033] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.033] GetTickCount () returned 0x4de3d [0250.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.034] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319037\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319037\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319037\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319037\\....\\temporaryfile")) returned 0 [0250.034] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319037\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319037\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319037\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319037\\temporaryfile")) returned 1 [0250.036] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319037\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f9f8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f9f8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f9f8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.036] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f9f8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f9f8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f9f8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.036] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f9f8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f9f8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f9f8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.036] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319037\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f9f8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f9f8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f9f8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.036] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f9f8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f9f8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f9f8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.036] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f9f8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f9f8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f9f8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.036] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.036] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319037\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319037\\temporaryfile")) returned 1 [0250.036] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99f9f8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99f9f8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99f9f8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.036] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.037] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319037" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319037")) returned 1 [0250.037] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 0 [0250.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.038] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x808, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x808, lpOverlapped=0x0) returned 1 [0250.039] CloseHandle (hObject=0xdc) returned 1 [0250.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.039] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8b8 [0250.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8c0) returned 0x2350048 [0250.039] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x8b8, lpOverlapped=0x0) returned 1 [0250.041] CloseHandle (hObject=0xdc) returned 1 [0250.041] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0250.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.042] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.042] GetTickCount () returned 0x4de4d [0250.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.042] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053\\....\\temporaryfile")) returned 0 [0250.043] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053\\temporaryfile")) returned 1 [0250.044] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.044] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.044] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.044] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.044] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.044] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.045] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.045] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053\\temporaryfile")) returned 1 [0250.045] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.045] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.045] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053")) returned 1 [0250.045] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 0 [0250.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.046] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x8c0, lpOverlapped=0x0) returned 1 [0250.047] CloseHandle (hObject=0xdc) returned 1 [0250.047] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.048] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x70c [0250.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x714) returned 0x2350048 [0250.048] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x70c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x70c, lpOverlapped=0x0) returned 1 [0250.049] CloseHandle (hObject=0xdc) returned 1 [0250.049] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0250.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.050] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.050] GetTickCount () returned 0x4de4d [0250.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.051] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053\\....\\temporaryfile")) returned 0 [0250.051] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053\\temporaryfile")) returned 1 [0250.053] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.053] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.053] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.053] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.053] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.053] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.053] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.053] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053\\temporaryfile")) returned 1 [0250.053] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99fc5a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99fc5a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99fc5a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.053] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.053] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319053" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319053")) returned 1 [0250.053] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 0 [0250.054] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.054] WriteFile (in: hFile=0xdc, lpBuffer=0x2350770*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350770*, lpNumberOfBytesWritten=0x18fdd8*=0x710, lpOverlapped=0x0) returned 1 [0250.055] CloseHandle (hObject=0xdc) returned 1 [0250.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.056] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x760 [0250.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x768) returned 0x2350048 [0250.056] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x760, lpOverlapped=0x0) returned 1 [0250.057] CloseHandle (hObject=0xdc) returned 1 [0250.057] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0250.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.058] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.058] GetTickCount () returned 0x4de5c [0250.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.059] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319068\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319068\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319068\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319068\\....\\temporaryfile")) returned 0 [0250.059] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319068\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319068\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319068\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319068\\temporaryfile")) returned 1 [0250.060] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319068\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99febb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99febb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99febb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.060] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99febb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99febb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99febb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.061] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99febb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99febb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99febb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.061] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319068\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99febb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99febb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99febb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.061] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99febb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99febb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99febb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.061] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99febb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99febb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99febb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.061] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.061] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319068\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319068\\temporaryfile")) returned 1 [0250.061] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x99febb60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x99febb60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x99febb60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.061] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.061] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319068" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319068")) returned 1 [0250.061] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 0 [0250.062] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.062] WriteFile (in: hFile=0xdc, lpBuffer=0x23507c0*, nNumberOfBytesToWrite=0x768, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23507c0*, lpNumberOfBytesWritten=0x18fdd8*=0x768, lpOverlapped=0x0) returned 1 [0250.063] CloseHandle (hObject=0xdc) returned 1 [0250.063] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.063] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xed4 [0250.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xedc) returned 0x2350048 [0250.063] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xed4, lpOverlapped=0x0) returned 1 [0250.070] CloseHandle (hObject=0xdc) returned 1 [0250.070] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0250.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.072] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.072] GetTickCount () returned 0x4de6c [0250.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.073] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084\\....\\temporaryfile")) returned 0 [0250.073] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084\\temporaryfile")) returned 1 [0250.074] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.074] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.074] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.074] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.075] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.075] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.075] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.075] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084\\temporaryfile")) returned 1 [0250.075] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.075] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.075] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084")) returned 1 [0250.075] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 0 [0250.075] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.076] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xed8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xed8, lpOverlapped=0x0) returned 1 [0250.077] CloseHandle (hObject=0xdc) returned 1 [0250.077] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.077] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7e8 [0250.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7f0) returned 0x2350048 [0250.078] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7e8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7e8, lpOverlapped=0x0) returned 1 [0250.079] CloseHandle (hObject=0xdc) returned 1 [0250.079] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0250.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.080] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.080] GetTickCount () returned 0x4de6c [0250.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.080] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084\\....\\temporaryfile")) returned 0 [0250.081] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084\\temporaryfile")) returned 1 [0250.082] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.082] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.082] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.082] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.083] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.083] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.083] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.083] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084\\temporaryfile")) returned 1 [0250.083] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a011cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a011cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a011cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.083] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.083] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319084" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319084")) returned 1 [0250.083] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 0 [0250.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.084] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x7f0, lpOverlapped=0x0) returned 1 [0250.085] CloseHandle (hObject=0xdc) returned 1 [0250.085] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.085] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x824 [0250.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x82c) returned 0x2350048 [0250.085] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x824, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x824, lpOverlapped=0x0) returned 1 [0250.087] CloseHandle (hObject=0xdc) returned 1 [0250.087] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0250.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.088] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.088] GetTickCount () returned 0x4de7c [0250.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.089] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100\\....\\temporaryfile")) returned 0 [0250.092] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100\\temporaryfile")) returned 1 [0250.094] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.094] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.094] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.094] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.094] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100\\temporaryfile")) returned 1 [0250.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.094] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100")) returned 1 [0250.095] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 0 [0250.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.095] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x828, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x828, lpOverlapped=0x0) returned 1 [0250.096] CloseHandle (hObject=0xdc) returned 1 [0250.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.098] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5a8 [0250.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b0) returned 0x259e70 [0250.098] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5a8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5a8, lpOverlapped=0x0) returned 1 [0250.099] CloseHandle (hObject=0xdc) returned 1 [0250.099] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0250.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.100] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.100] GetTickCount () returned 0x4de7c [0250.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.101] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100\\....\\temporaryfile")) returned 0 [0250.102] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100\\temporaryfile")) returned 1 [0250.103] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.103] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.103] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.103] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.103] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.103] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.103] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.103] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100\\temporaryfile")) returned 1 [0250.103] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a037e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a037e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a037e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.103] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319100" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319100")) returned 1 [0250.104] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 0 [0250.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.104] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x5b0, lpOverlapped=0x0) returned 1 [0250.105] CloseHandle (hObject=0xdc) returned 1 [0250.105] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.106] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbb4 [0250.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbbc) returned 0x2350048 [0250.106] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xbb4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xbb4, lpOverlapped=0x0) returned 1 [0250.110] CloseHandle (hObject=0xdc) returned 1 [0250.110] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0250.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.111] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.111] GetTickCount () returned 0x4de8b [0250.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.111] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319115\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319115\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319115\\....\\temporaryfile")) returned 0 [0250.112] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319115\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319115\\temporaryfile")) returned 1 [0250.113] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319115\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a05df80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a05df80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a05df80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.113] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a05df80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a05df80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a05df80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.113] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a05df80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a05df80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a05df80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.113] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319115\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a05df80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a05df80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a05df80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.113] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a05df80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a05df80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a05df80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.113] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a05df80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a05df80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a05df80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.113] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.114] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319115\\temporaryfile")) returned 1 [0250.114] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a05df80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a05df80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a05df80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.114] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.114] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319115" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319115")) returned 1 [0250.114] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 0 [0250.114] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.115] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xbb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xbb8, lpOverlapped=0x0) returned 1 [0250.116] CloseHandle (hObject=0xdc) returned 1 [0250.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.116] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8f8 [0250.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x900) returned 0x2350048 [0250.116] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x8f8, lpOverlapped=0x0) returned 1 [0250.118] CloseHandle (hObject=0xdc) returned 1 [0250.118] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0250.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.119] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.119] GetTickCount () returned 0x4de9b [0250.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.119] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131\\....\\temporaryfile")) returned 0 [0250.120] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131\\temporaryfile")) returned 1 [0250.121] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.121] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.121] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.121] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.121] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.121] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.121] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.121] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131\\temporaryfile")) returned 1 [0250.122] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.122] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.122] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131")) returned 1 [0250.122] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 0 [0250.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.123] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x900, lpOverlapped=0x0) returned 1 [0250.123] CloseHandle (hObject=0xdc) returned 1 [0250.124] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.124] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2174 [0250.124] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x217c) returned 0x2c4a70 [0250.124] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2174, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2174, lpOverlapped=0x0) returned 1 [0250.126] CloseHandle (hObject=0xdc) returned 1 [0250.126] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0250.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.127] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.127] GetTickCount () returned 0x4de9b [0250.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.127] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131\\....\\temporaryfile")) returned 0 [0250.128] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131\\temporaryfile")) returned 1 [0250.129] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.129] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.129] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.129] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.129] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.129] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.129] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.129] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131\\temporaryfile")) returned 1 [0250.130] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0840e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0840e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0840e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.130] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.130] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319131" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319131")) returned 1 [0250.130] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 0 [0250.130] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.131] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6c00*, nNumberOfBytesToWrite=0x2178, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6c00*, lpNumberOfBytesWritten=0x18fdd8*=0x2178, lpOverlapped=0x0) returned 1 [0250.132] CloseHandle (hObject=0xdc) returned 1 [0250.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.133] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6e8 [0250.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6f0) returned 0x2350048 [0250.133] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x6e8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x6e8, lpOverlapped=0x0) returned 1 [0250.134] CloseHandle (hObject=0xdc) returned 1 [0250.134] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0250.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.135] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.135] GetTickCount () returned 0x4deaa [0250.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.136] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146\\....\\temporaryfile")) returned 0 [0250.137] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146\\temporaryfile")) returned 1 [0250.138] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.138] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.138] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.138] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.138] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.138] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.138] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.138] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146\\temporaryfile")) returned 1 [0250.138] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.138] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.138] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146")) returned 1 [0250.139] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 0 [0250.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.139] WriteFile (in: hFile=0xdc, lpBuffer=0x2350748*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350748*, lpNumberOfBytesWritten=0x18fdd8*=0x6f0, lpOverlapped=0x0) returned 1 [0250.140] CloseHandle (hObject=0xdc) returned 1 [0250.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.141] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x384 [0250.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x38c) returned 0x259e70 [0250.141] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x384, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x384, lpOverlapped=0x0) returned 1 [0250.143] CloseHandle (hObject=0xdc) returned 1 [0250.143] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0250.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.144] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.144] GetTickCount () returned 0x4deaa [0250.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.144] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146\\....\\temporaryfile")) returned 0 [0250.145] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146\\temporaryfile")) returned 1 [0250.146] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.146] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.146] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.146] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.146] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.146] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.147] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.147] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146\\temporaryfile")) returned 1 [0250.147] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0aa240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0aa240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0aa240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.147] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.147] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319146" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319146")) returned 1 [0250.147] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 0 [0250.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.148] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x388, lpOverlapped=0x0) returned 1 [0250.149] CloseHandle (hObject=0xdc) returned 1 [0250.149] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.149] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9dc [0250.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9e4) returned 0x2350048 [0250.150] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x9dc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x9dc, lpOverlapped=0x0) returned 1 [0250.151] CloseHandle (hObject=0xdc) returned 1 [0250.151] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0250.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.152] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.152] GetTickCount () returned 0x4deba [0250.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.152] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162\\....\\temporaryfile")) returned 0 [0250.153] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162\\temporaryfile")) returned 1 [0250.154] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.154] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.154] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.154] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.154] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.154] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.154] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.155] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162\\temporaryfile")) returned 1 [0250.155] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.155] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.155] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162")) returned 1 [0250.155] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 0 [0250.155] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.156] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x9e0, lpOverlapped=0x0) returned 1 [0250.157] CloseHandle (hObject=0xdc) returned 1 [0250.157] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.157] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x914 [0250.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x91c) returned 0x2350048 [0250.157] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x914, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x914, lpOverlapped=0x0) returned 1 [0250.158] CloseHandle (hObject=0xdc) returned 1 [0250.159] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0250.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.159] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.159] GetTickCount () returned 0x4deba [0250.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.160] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162\\....\\temporaryfile")) returned 0 [0250.161] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162\\temporaryfile")) returned 1 [0250.162] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.162] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.162] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.162] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.162] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.162] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.162] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.162] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162\\temporaryfile")) returned 1 [0250.163] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0d03a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0d03a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0d03a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.163] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319162" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319162")) returned 1 [0250.163] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 0 [0250.163] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.164] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x918, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x918, lpOverlapped=0x0) returned 1 [0250.165] CloseHandle (hObject=0xdc) returned 1 [0250.165] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.165] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4a7c [0250.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4a84) returned 0x2c4a70 [0250.165] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x4a7c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4a7c, lpOverlapped=0x0) returned 1 [0250.167] CloseHandle (hObject=0xdc) returned 1 [0250.167] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0250.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.168] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.168] GetTickCount () returned 0x4deca [0250.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.168] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178\\....\\temporaryfile")) returned 0 [0250.169] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178\\temporaryfile")) returned 1 [0250.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.170] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.170] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.170] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.170] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.170] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.171] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178\\temporaryfile")) returned 1 [0250.171] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.171] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.171] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178")) returned 1 [0250.171] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 0 [0250.172] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.172] WriteFile (in: hFile=0xdc, lpBuffer=0x2c9508*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c9508*, lpNumberOfBytesWritten=0x18fdd8*=0x4a80, lpOverlapped=0x0) returned 1 [0250.173] CloseHandle (hObject=0xdc) returned 1 [0250.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.174] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x244 [0250.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24c) returned 0x28f1f8 [0250.174] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x244, lpOverlapped=0x0) returned 1 [0250.175] CloseHandle (hObject=0xdc) returned 1 [0250.175] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0250.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.175] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.175] GetTickCount () returned 0x4deca [0250.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.176] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.177] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178\\....\\temporaryfile")) returned 0 [0250.177] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178\\temporaryfile")) returned 1 [0250.178] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.178] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.178] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.178] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.178] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.178] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.178] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.178] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178\\temporaryfile")) returned 1 [0250.179] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a0f6500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a0f6500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a0f6500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.179] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.179] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319178" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319178")) returned 1 [0250.179] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 0 [0250.179] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.180] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x248, lpOverlapped=0x0) returned 1 [0250.181] CloseHandle (hObject=0xdc) returned 1 [0250.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.190] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x128 [0250.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x130) returned 0x28f1f8 [0250.190] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x128, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x128, lpOverlapped=0x0) returned 1 [0250.191] CloseHandle (hObject=0xdc) returned 1 [0250.191] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0250.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.192] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.192] GetTickCount () returned 0x4ded9 [0250.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.193] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319193\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319193\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319193\\....\\temporaryfile")) returned 0 [0250.193] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319193\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319193\\temporaryfile")) returned 1 [0250.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319193\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a11c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a11c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a11c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a11c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a11c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a11c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a11c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a11c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a11c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319193\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a11c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a11c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a11c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.195] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a11c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a11c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a11c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.195] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a11c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a11c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a11c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.195] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.195] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319193\\temporaryfile")) returned 1 [0250.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a11c660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a11c660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a11c660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.195] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.195] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319193" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319193")) returned 1 [0250.196] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 0 [0250.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.197] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x130, lpOverlapped=0x0) returned 1 [0250.197] CloseHandle (hObject=0xdc) returned 1 [0250.198] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.198] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x228 [0250.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x230) returned 0x28f1f8 [0250.198] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x228, lpOverlapped=0x0) returned 1 [0250.199] CloseHandle (hObject=0xdc) returned 1 [0250.199] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0250.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.200] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.200] GetTickCount () returned 0x4dee9 [0250.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.201] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.201] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209\\....\\temporaryfile")) returned 0 [0250.201] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209\\temporaryfile")) returned 1 [0250.202] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.202] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.203] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.203] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.203] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.203] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209\\temporaryfile")) returned 1 [0250.203] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.203] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.203] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209")) returned 1 [0250.203] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 0 [0250.204] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.204] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x230, lpOverlapped=0x0) returned 1 [0250.205] CloseHandle (hObject=0xdc) returned 1 [0250.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.205] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1034 [0250.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x103c) returned 0x25b528 [0250.205] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1034, lpOverlapped=0x0) returned 1 [0250.207] CloseHandle (hObject=0xdc) returned 1 [0250.207] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0250.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.208] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.208] GetTickCount () returned 0x4dee9 [0250.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.208] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209\\....\\temporaryfile")) returned 0 [0250.209] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209\\temporaryfile")) returned 1 [0250.210] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.210] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.210] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.210] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.210] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.211] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.211] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209\\temporaryfile")) returned 1 [0250.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1427c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1427c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1427c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.211] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319209" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319209")) returned 1 [0250.211] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 0 [0250.212] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.212] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1038, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1038, lpOverlapped=0x0) returned 1 [0250.213] CloseHandle (hObject=0xdc) returned 1 [0250.213] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.214] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8fc [0250.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x904) returned 0x2350048 [0250.214] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x8fc, lpOverlapped=0x0) returned 1 [0250.216] CloseHandle (hObject=0xdc) returned 1 [0250.216] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0250.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.217] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.217] GetTickCount () returned 0x4def8 [0250.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319224\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319224\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.218] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319224\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319224\\....\\temporaryfile")) returned 0 [0250.218] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319224\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319224\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319224\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319224\\temporaryfile")) returned 1 [0250.219] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319224\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a168920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a168920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a168920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.219] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a168920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a168920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a168920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.219] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a168920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a168920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a168920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.219] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319224\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a168920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a168920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a168920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.219] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a168920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a168920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a168920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.219] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a168920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a168920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a168920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.219] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319224\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319224\\temporaryfile")) returned 1 [0250.220] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a168920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a168920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a168920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.220] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.220] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319224" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319224")) returned 1 [0250.223] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 0 [0250.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.224] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x900, lpOverlapped=0x0) returned 1 [0250.225] CloseHandle (hObject=0xdc) returned 1 [0250.225] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.226] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcb4 [0250.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcbc) returned 0x2350048 [0250.226] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xcb4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xcb4, lpOverlapped=0x0) returned 1 [0250.227] CloseHandle (hObject=0xdc) returned 1 [0250.227] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0250.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.228] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.228] GetTickCount () returned 0x4df08 [0250.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.229] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240\\....\\temporaryfile")) returned 0 [0250.230] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240\\temporaryfile")) returned 1 [0250.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.231] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.231] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.231] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.231] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240\\temporaryfile")) returned 1 [0250.232] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.232] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.232] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240")) returned 1 [0250.232] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 0 [0250.232] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.233] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xcb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xcb8, lpOverlapped=0x0) returned 1 [0250.233] CloseHandle (hObject=0xdc) returned 1 [0250.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.234] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1815 [0250.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x181d) returned 0x2c4a70 [0250.234] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1815, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1815, lpOverlapped=0x0) returned 1 [0250.235] CloseHandle (hObject=0xdc) returned 1 [0250.235] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1 [0250.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.236] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.236] GetTickCount () returned 0x4df08 [0250.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.237] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240\\....\\temporaryfile")) returned 0 [0250.238] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240\\temporaryfile")) returned 1 [0250.239] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.239] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.239] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.239] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.239] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.239] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.239] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.239] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240\\temporaryfile")) returned 1 [0250.240] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a18ea80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a18ea80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a18ea80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.240] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.240] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319240" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319240")) returned 1 [0250.240] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 0 [0250.240] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.241] WriteFile (in: hFile=0xdc, lpBuffer=0x2c62a0*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c62a0*, lpNumberOfBytesWritten=0x18fdd8*=0x1820, lpOverlapped=0x0) returned 1 [0250.241] CloseHandle (hObject=0xdc) returned 1 [0250.242] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.242] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x566 [0250.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x56e) returned 0x259e70 [0250.242] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x566, lpOverlapped=0x0) returned 1 [0250.244] CloseHandle (hObject=0xdc) returned 1 [0250.244] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0250.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.245] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.245] GetTickCount () returned 0x4df18 [0250.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.245] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.246] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256\\....\\temporaryfile")) returned 0 [0250.246] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256\\temporaryfile")) returned 1 [0250.247] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.247] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.247] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.247] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.247] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.247] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.247] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.247] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256\\temporaryfile")) returned 1 [0250.248] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.248] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.248] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256")) returned 1 [0250.248] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 0 [0250.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.249] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x570, lpOverlapped=0x0) returned 1 [0250.249] CloseHandle (hObject=0xdc) returned 1 [0250.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.250] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x32f2 [0250.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32fa) returned 0x2c4a70 [0250.250] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x32f2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x32f2, lpOverlapped=0x0) returned 1 [0250.251] CloseHandle (hObject=0xdc) returned 1 [0250.251] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0250.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.252] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.252] GetTickCount () returned 0x4df18 [0250.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.253] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256\\....\\temporaryfile")) returned 0 [0250.254] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256\\temporaryfile")) returned 1 [0250.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.255] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.255] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.255] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.255] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.255] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.255] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256\\temporaryfile")) returned 1 [0250.256] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1b4be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1b4be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1b4be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.256] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.256] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319256" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319256")) returned 1 [0250.256] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 0 [0250.256] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.257] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7d80*, nNumberOfBytesToWrite=0x32f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7d80*, lpNumberOfBytesWritten=0x18fdd8*=0x32f8, lpOverlapped=0x0) returned 1 [0250.258] CloseHandle (hObject=0xdc) returned 1 [0250.258] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.258] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa8c [0250.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa94) returned 0x2350048 [0250.259] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa8c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xa8c, lpOverlapped=0x0) returned 1 [0250.260] CloseHandle (hObject=0xdc) returned 1 [0250.260] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0250.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.261] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.261] GetTickCount () returned 0x4df27 [0250.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.262] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271\\....\\temporaryfile")) returned 0 [0250.262] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271\\temporaryfile")) returned 1 [0250.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.264] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.264] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.264] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.264] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271\\temporaryfile")) returned 1 [0250.264] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.264] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.264] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271")) returned 1 [0250.264] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 0 [0250.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.265] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xa90, lpOverlapped=0x0) returned 1 [0250.266] CloseHandle (hObject=0xdc) returned 1 [0250.266] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.266] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b2e [0250.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b36) returned 0x2c4a70 [0250.266] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b2e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b2e, lpOverlapped=0x0) returned 1 [0250.268] CloseHandle (hObject=0xdc) returned 1 [0250.268] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0250.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.269] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.269] GetTickCount () returned 0x4df27 [0250.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.270] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271\\....\\temporaryfile")) returned 0 [0250.270] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271\\temporaryfile")) returned 1 [0250.272] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.272] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.272] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.272] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.272] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271\\temporaryfile")) returned 1 [0250.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a1dad40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a1dad40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a1dad40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.272] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319271" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319271")) returned 1 [0250.273] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 0 [0250.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.273] WriteFile (in: hFile=0xdc, lpBuffer=0x2c65b8*, nNumberOfBytesToWrite=0x1b38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c65b8*, lpNumberOfBytesWritten=0x18fdd8*=0x1b38, lpOverlapped=0x0) returned 1 [0250.274] CloseHandle (hObject=0xdc) returned 1 [0250.275] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.276] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3670 [0250.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3678) returned 0x2c4a70 [0250.276] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x3670, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3670, lpOverlapped=0x0) returned 1 [0250.277] CloseHandle (hObject=0xdc) returned 1 [0250.277] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0250.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.278] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.278] GetTickCount () returned 0x4df37 [0250.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.279] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287\\....\\temporaryfile")) returned 0 [0250.279] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287\\temporaryfile")) returned 1 [0250.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.281] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.281] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.281] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.281] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287\\temporaryfile")) returned 1 [0250.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.281] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.281] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287")) returned 1 [0250.281] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 0 [0250.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.282] WriteFile (in: hFile=0xdc, lpBuffer=0x2c80f8*, nNumberOfBytesToWrite=0x3678, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c80f8*, lpNumberOfBytesWritten=0x18fdd8*=0x3678, lpOverlapped=0x0) returned 1 [0250.283] CloseHandle (hObject=0xdc) returned 1 [0250.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.285] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b1a [0250.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b22) returned 0x2c4a70 [0250.285] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b1a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b1a, lpOverlapped=0x0) returned 1 [0250.286] CloseHandle (hObject=0xdc) returned 1 [0250.286] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0250.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.287] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.287] GetTickCount () returned 0x4df37 [0250.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.288] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.288] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287\\....\\temporaryfile")) returned 0 [0250.288] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287\\temporaryfile")) returned 1 [0250.289] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.289] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.290] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.290] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.290] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.290] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.290] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.290] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287\\temporaryfile")) returned 1 [0250.290] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a200ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a200ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a200ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.290] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.290] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319287" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319287")) returned 1 [0250.290] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 0 [0250.291] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.291] WriteFile (in: hFile=0xdc, lpBuffer=0x2c65a8*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c65a8*, lpNumberOfBytesWritten=0x18fdd8*=0x1b20, lpOverlapped=0x0) returned 1 [0250.292] CloseHandle (hObject=0xdc) returned 1 [0250.292] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.293] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3044 [0250.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x304c) returned 0x2c4a70 [0250.293] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x3044, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3044, lpOverlapped=0x0) returned 1 [0250.294] CloseHandle (hObject=0xdc) returned 1 [0250.294] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0250.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.295] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.295] GetTickCount () returned 0x4df46 [0250.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.296] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302\\....\\temporaryfile")) returned 0 [0250.296] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302\\temporaryfile")) returned 1 [0250.297] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.297] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.297] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.297] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.298] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.298] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.298] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.298] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302\\temporaryfile")) returned 1 [0250.298] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.298] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.298] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302")) returned 1 [0250.298] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 0 [0250.299] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.299] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7ad0*, nNumberOfBytesToWrite=0x3048, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7ad0*, lpNumberOfBytesWritten=0x18fdd8*=0x3048, lpOverlapped=0x0) returned 1 [0250.300] CloseHandle (hObject=0xdc) returned 1 [0250.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.301] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a7c [0250.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a84) returned 0x2c4a70 [0250.301] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1a7c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a7c, lpOverlapped=0x0) returned 1 [0250.302] CloseHandle (hObject=0xdc) returned 1 [0250.303] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0250.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.303] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.303] GetTickCount () returned 0x4df46 [0250.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.304] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.305] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302\\....\\temporaryfile")) returned 0 [0250.305] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302\\temporaryfile")) returned 1 [0250.306] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.306] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.306] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.306] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.306] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.306] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.306] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.307] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302\\temporaryfile")) returned 1 [0250.307] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a227000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a227000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a227000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.307] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.307] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319302" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319302")) returned 1 [0250.307] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 0 [0250.307] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.308] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6508*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6508*, lpNumberOfBytesWritten=0x18fdd8*=0x1a80, lpOverlapped=0x0) returned 1 [0250.309] CloseHandle (hObject=0xdc) returned 1 [0250.309] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.309] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8e8 [0250.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8f0) returned 0x2350048 [0250.309] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8e8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x8e8, lpOverlapped=0x0) returned 1 [0250.311] CloseHandle (hObject=0xdc) returned 1 [0250.311] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0250.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.311] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.312] GetTickCount () returned 0x4df56 [0250.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.312] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.313] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318\\....\\temporaryfile")) returned 0 [0250.313] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318\\temporaryfile")) returned 1 [0250.314] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.314] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.314] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.314] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.314] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.314] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.314] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.314] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318\\temporaryfile")) returned 1 [0250.315] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.315] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.315] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318")) returned 1 [0250.315] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 0 [0250.315] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.316] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x8f0, lpOverlapped=0x0) returned 1 [0250.316] CloseHandle (hObject=0xdc) returned 1 [0250.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.317] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2e0 [0250.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e8) returned 0x259e70 [0250.317] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2e0, lpOverlapped=0x0) returned 1 [0250.318] CloseHandle (hObject=0xdc) returned 1 [0250.318] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0250.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.319] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.319] GetTickCount () returned 0x4df56 [0250.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.320] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318\\....\\temporaryfile")) returned 0 [0250.321] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318\\temporaryfile")) returned 1 [0250.322] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2732c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2732c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.322] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2732c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2732c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.322] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.322] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.322] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.322] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.323] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.323] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318\\temporaryfile")) returned 1 [0250.323] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a24d160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a24d160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a24d160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.323] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.323] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319318" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319318")) returned 1 [0250.323] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 0 [0250.323] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.324] WriteFile (in: hFile=0xdc, lpBuffer=0x25a168*, nNumberOfBytesToWrite=0x2e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a168*, lpNumberOfBytesWritten=0x18fdd8*=0x2e8, lpOverlapped=0x0) returned 1 [0250.325] CloseHandle (hObject=0xdc) returned 1 [0250.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.325] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x439c [0250.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x43a4) returned 0x2c4a70 [0250.325] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x439c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x439c, lpOverlapped=0x0) returned 1 [0250.327] CloseHandle (hObject=0xdc) returned 1 [0250.327] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0250.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.328] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.328] GetTickCount () returned 0x4df66 [0250.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.328] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319334\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319334\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319334\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319334\\....\\temporaryfile")) returned 0 [0250.329] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319334\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319334\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319334\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319334\\temporaryfile")) returned 1 [0250.330] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319334\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2732c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2732c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2732c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2732c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2732c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2732c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2732c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2732c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2732c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.330] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319334\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2732c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2732c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2732c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.331] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2732c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2732c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2732c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.331] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2732c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2732c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2732c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.331] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.331] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319334\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319334\\temporaryfile")) returned 1 [0250.331] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2732c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2732c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2732c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.331] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.331] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319334" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319334")) returned 1 [0250.331] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 0 [0250.332] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.332] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8e28*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8e28*, lpNumberOfBytesWritten=0x18fdd8*=0x43a0, lpOverlapped=0x0) returned 1 [0250.333] CloseHandle (hObject=0xdc) returned 1 [0250.333] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.334] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f08 [0250.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f10) returned 0x2c4a70 [0250.334] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1f08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1f08, lpOverlapped=0x0) returned 1 [0250.336] CloseHandle (hObject=0xdc) returned 1 [0250.336] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0250.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.337] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.337] GetTickCount () returned 0x4df75 [0250.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.337] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349\\....\\temporaryfile")) returned 0 [0250.338] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349\\temporaryfile")) returned 1 [0250.339] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.339] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.339] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.339] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.339] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.339] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.339] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.339] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349\\temporaryfile")) returned 1 [0250.340] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.340] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.340] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349")) returned 1 [0250.340] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 0 [0250.340] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.341] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6990*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6990*, lpNumberOfBytesWritten=0x18fdd8*=0x1f10, lpOverlapped=0x0) returned 1 [0250.342] CloseHandle (hObject=0xdc) returned 1 [0250.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.342] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2942 [0250.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x294a) returned 0x2c4a70 [0250.342] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2942, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2942, lpOverlapped=0x0) returned 1 [0250.344] CloseHandle (hObject=0xdc) returned 1 [0250.344] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0250.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.345] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.345] GetTickCount () returned 0x4df75 [0250.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.349] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349\\....\\temporaryfile")) returned 0 [0250.350] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349\\temporaryfile")) returned 1 [0250.351] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.351] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.351] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.351] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.351] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.351] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.351] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.351] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349\\temporaryfile")) returned 1 [0250.351] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a299420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a299420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a299420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.351] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.351] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319349" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319349")) returned 1 [0250.352] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 0 [0250.352] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.352] WriteFile (in: hFile=0xdc, lpBuffer=0x2c73d0*, nNumberOfBytesToWrite=0x2948, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c73d0*, lpNumberOfBytesWritten=0x18fdd8*=0x2948, lpOverlapped=0x0) returned 1 [0250.353] CloseHandle (hObject=0xdc) returned 1 [0250.354] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.355] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x12ee [0250.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12f6) returned 0x25b528 [0250.355] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12ee, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x12ee, lpOverlapped=0x0) returned 1 [0250.356] CloseHandle (hObject=0xdc) returned 1 [0250.356] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0250.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.357] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.357] GetTickCount () returned 0x4df85 [0250.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.358] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.358] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365\\....\\temporaryfile")) returned 0 [0250.358] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365\\temporaryfile")) returned 1 [0250.359] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.359] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.359] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.359] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.360] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.360] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.360] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.360] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365\\temporaryfile")) returned 1 [0250.360] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.360] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.360] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365")) returned 1 [0250.360] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 0 [0250.360] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.361] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x12f8, lpOverlapped=0x0) returned 1 [0250.362] CloseHandle (hObject=0xdc) returned 1 [0250.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.363] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x45ba [0250.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x45c2) returned 0x2c4a70 [0250.363] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x45ba, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x45ba, lpOverlapped=0x0) returned 1 [0250.364] CloseHandle (hObject=0xdc) returned 1 [0250.364] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0250.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.365] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.365] GetTickCount () returned 0x4df85 [0250.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.366] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365\\....\\temporaryfile")) returned 0 [0250.366] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365\\temporaryfile")) returned 1 [0250.367] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.368] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.368] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.368] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.368] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.368] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.368] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.368] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365\\temporaryfile")) returned 1 [0250.368] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2bf580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2bf580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2bf580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.368] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.368] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319365" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319365")) returned 1 [0250.368] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 0 [0250.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.369] WriteFile (in: hFile=0xdc, lpBuffer=0x2c9048*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c9048*, lpNumberOfBytesWritten=0x18fdd8*=0x45c0, lpOverlapped=0x0) returned 1 [0250.370] CloseHandle (hObject=0xdc) returned 1 [0250.371] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.371] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2eda [0250.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ee2) returned 0x2c4a70 [0250.371] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2eda, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2eda, lpOverlapped=0x0) returned 1 [0250.372] CloseHandle (hObject=0xdc) returned 1 [0250.372] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0250.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.373] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.373] GetTickCount () returned 0x4df94 [0250.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.374] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380\\....\\temporaryfile")) returned 0 [0250.374] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380\\temporaryfile")) returned 1 [0250.375] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.376] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.376] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.376] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.376] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.376] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.376] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.376] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380\\temporaryfile")) returned 1 [0250.376] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.376] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.376] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380")) returned 1 [0250.376] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 0 [0250.377] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.377] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7968*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7968*, lpNumberOfBytesWritten=0x18fdd8*=0x2ee0, lpOverlapped=0x0) returned 1 [0250.378] CloseHandle (hObject=0xdc) returned 1 [0250.378] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.379] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7620 [0250.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7628) returned 0x2c4a70 [0250.380] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x7620, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x7620, lpOverlapped=0x0) returned 1 [0250.381] CloseHandle (hObject=0xdc) returned 1 [0250.381] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0250.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.382] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.382] GetTickCount () returned 0x4df94 [0250.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.383] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.383] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380\\....\\temporaryfile")) returned 0 [0250.384] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380\\temporaryfile")) returned 1 [0250.385] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a30b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a30b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.385] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a30b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a30b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.385] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.385] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.385] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.385] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.385] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.385] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380\\temporaryfile")) returned 1 [0250.385] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a2e56e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a2e56e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a2e56e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.385] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.385] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319380" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319380")) returned 1 [0250.386] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 0 [0250.386] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.387] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc0a8*, nNumberOfBytesToWrite=0x7628, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc0a8*, lpNumberOfBytesWritten=0x18fdd8*=0x7628, lpOverlapped=0x0) returned 1 [0250.388] CloseHandle (hObject=0xdc) returned 1 [0250.388] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.389] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x721c [0250.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7224) returned 0x2c4a70 [0250.389] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x721c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x721c, lpOverlapped=0x0) returned 1 [0250.390] CloseHandle (hObject=0xdc) returned 1 [0250.390] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0250.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.391] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.392] GetTickCount () returned 0x4dfa4 [0250.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.392] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319396\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319396\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319396\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319396\\....\\temporaryfile")) returned 0 [0250.393] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319396\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319396\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319396\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319396\\temporaryfile")) returned 1 [0250.394] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319396\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a30b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a30b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a30b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.394] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a30b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a30b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a30b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.394] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a30b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a30b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a30b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.394] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319396\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a30b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a30b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a30b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.394] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a30b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a30b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a30b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.394] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a30b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a30b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a30b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.394] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.394] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319396\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319396\\temporaryfile")) returned 1 [0250.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a30b840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a30b840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a30b840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.395] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.395] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319396" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319396")) returned 1 [0250.395] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 0 [0250.395] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.396] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbca8*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbca8*, lpNumberOfBytesWritten=0x18fdd8*=0x7220, lpOverlapped=0x0) returned 1 [0250.397] CloseHandle (hObject=0xdc) returned 1 [0250.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.398] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3772 [0250.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x377a) returned 0x2c4a70 [0250.398] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x3772, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3772, lpOverlapped=0x0) returned 1 [0250.400] CloseHandle (hObject=0xdc) returned 1 [0250.400] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0250.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.401] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.401] GetTickCount () returned 0x4dfb4 [0250.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.401] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.401] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412\\....\\temporaryfile")) returned 0 [0250.402] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412\\temporaryfile")) returned 1 [0250.403] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.403] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.403] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.403] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.403] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.403] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.403] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.403] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412\\temporaryfile")) returned 1 [0250.403] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.403] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.403] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412")) returned 1 [0250.404] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 0 [0250.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.404] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8200*, nNumberOfBytesToWrite=0x3778, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8200*, lpNumberOfBytesWritten=0x18fdd8*=0x3778, lpOverlapped=0x0) returned 1 [0250.405] CloseHandle (hObject=0xdc) returned 1 [0250.406] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.406] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x920e [0250.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9216) returned 0x2c4a70 [0250.406] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x920e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x920e, lpOverlapped=0x0) returned 1 [0250.408] CloseHandle (hObject=0xdc) returned 1 [0250.408] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0250.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.409] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.409] GetTickCount () returned 0x4dfb4 [0250.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.409] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.410] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412\\....\\temporaryfile")) returned 0 [0250.410] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412\\temporaryfile")) returned 1 [0250.411] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.411] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.411] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.411] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.411] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.412] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.412] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.412] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412\\temporaryfile")) returned 1 [0250.412] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3319a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3319a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3319a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.412] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.412] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319412" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319412")) returned 1 [0250.412] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 0 [0250.413] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.413] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdc98*, nNumberOfBytesToWrite=0x9218, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdc98*, lpNumberOfBytesWritten=0x18fdd8*=0x9218, lpOverlapped=0x0) returned 1 [0250.415] CloseHandle (hObject=0xdc) returned 1 [0250.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.415] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3df0 [0250.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3df8) returned 0x2c4a70 [0250.416] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x3df0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3df0, lpOverlapped=0x0) returned 1 [0250.417] CloseHandle (hObject=0xdc) returned 1 [0250.417] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0250.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.418] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.418] GetTickCount () returned 0x4dfc3 [0250.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.419] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427\\....\\temporaryfile")) returned 0 [0250.419] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427\\temporaryfile")) returned 1 [0250.420] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.420] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.420] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.420] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.421] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.421] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.421] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.421] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427\\temporaryfile")) returned 1 [0250.421] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.421] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.421] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427")) returned 1 [0250.421] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 0 [0250.422] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.422] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8878*, nNumberOfBytesToWrite=0x3df8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8878*, lpNumberOfBytesWritten=0x18fdd8*=0x3df8, lpOverlapped=0x0) returned 1 [0250.423] CloseHandle (hObject=0xdc) returned 1 [0250.423] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.424] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4712 [0250.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x471a) returned 0x2c4a70 [0250.424] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x4712, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4712, lpOverlapped=0x0) returned 1 [0250.426] CloseHandle (hObject=0xdc) returned 1 [0250.426] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0250.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.427] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.427] GetTickCount () returned 0x4dfc3 [0250.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.428] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427\\....\\temporaryfile")) returned 0 [0250.428] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427\\temporaryfile")) returned 1 [0250.429] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.429] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.430] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.430] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.430] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.430] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.430] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.430] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427\\temporaryfile")) returned 1 [0250.430] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a357b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a357b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a357b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.430] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.430] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319427" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319427")) returned 1 [0250.431] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 0 [0250.431] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.432] WriteFile (in: hFile=0xdc, lpBuffer=0x2c91a0*, nNumberOfBytesToWrite=0x4718, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c91a0*, lpNumberOfBytesWritten=0x18fdd8*=0x4718, lpOverlapped=0x0) returned 1 [0250.433] CloseHandle (hObject=0xdc) returned 1 [0250.433] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.433] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb6de [0250.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb6e6) returned 0x2c4a70 [0250.433] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0xb6de, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0xb6de, lpOverlapped=0x0) returned 1 [0250.435] CloseHandle (hObject=0xdc) returned 1 [0250.435] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0250.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.436] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.436] GetTickCount () returned 0x4dfd3 [0250.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.437] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443\\....\\temporaryfile")) returned 0 [0250.437] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443\\temporaryfile")) returned 1 [0250.438] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a37dc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a37dc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a37dc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.438] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a37dc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a37dc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a37dc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.438] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a37dc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a37dc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a37dc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.438] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a37dc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a37dc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a37dc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.438] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a37dc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a37dc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a37dc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.438] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a37dc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a37dc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a37dc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.438] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.439] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443\\temporaryfile")) returned 1 [0250.439] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a37dc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a37dc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a37dc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.439] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.439] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443")) returned 1 [0250.439] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 0 [0250.440] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.440] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0168*, nNumberOfBytesToWrite=0xb6e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0168*, lpNumberOfBytesWritten=0x18fdd8*=0xb6e8, lpOverlapped=0x0) returned 1 [0250.442] CloseHandle (hObject=0xdc) returned 1 [0250.442] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.442] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17b4 [0250.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17bc) returned 0x2c4a70 [0250.443] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x17b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x17b4, lpOverlapped=0x0) returned 1 [0250.444] CloseHandle (hObject=0xdc) returned 1 [0250.444] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0250.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.445] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.445] GetTickCount () returned 0x4dfd3 [0250.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.445] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.446] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443\\....\\temporaryfile")) returned 0 [0250.446] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443\\temporaryfile")) returned 1 [0250.447] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a37dc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.447] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a37dc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.447] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.447] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.448] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.448] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.448] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.448] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443\\temporaryfile")) returned 1 [0250.448] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.448] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.448] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319443" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319443")) returned 1 [0250.448] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 0 [0250.449] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.449] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6240*, nNumberOfBytesToWrite=0x17b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6240*, lpNumberOfBytesWritten=0x18fdd8*=0x17b8, lpOverlapped=0x0) returned 1 [0250.450] CloseHandle (hObject=0xdc) returned 1 [0250.450] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.451] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xfea [0250.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xff2) returned 0x25f580 [0250.451] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xfea, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xfea, lpOverlapped=0x0) returned 1 [0250.452] CloseHandle (hObject=0xdc) returned 1 [0250.452] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0250.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.453] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.453] GetTickCount () returned 0x4dfe2 [0250.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.453] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.453] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319458\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319458\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319458\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319458\\....\\temporaryfile")) returned 0 [0250.455] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319458\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319458\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319458\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319458\\temporaryfile")) returned 1 [0250.456] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319458\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.456] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.456] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.456] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319458\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.456] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.456] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.456] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.456] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319458\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319458\\temporaryfile")) returned 1 [0250.456] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3a3dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3a3dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3a3dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.456] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.456] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319458" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319458")) returned 1 [0250.457] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 0 [0250.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.457] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xff0, lpOverlapped=0x0) returned 1 [0250.458] CloseHandle (hObject=0xdc) returned 1 [0250.458] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.459] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2168 [0250.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2170) returned 0x2c4a70 [0250.459] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2168, lpOverlapped=0x0) returned 1 [0250.462] CloseHandle (hObject=0xdc) returned 1 [0250.463] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0250.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.463] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.464] GetTickCount () returned 0x4dff2 [0250.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.464] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474\\....\\temporaryfile")) returned 0 [0250.465] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474\\temporaryfile")) returned 1 [0250.466] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.466] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.466] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.466] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.466] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.466] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.466] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.466] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474\\temporaryfile")) returned 1 [0250.466] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.466] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.466] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474")) returned 1 [0250.467] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 0 [0250.467] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.467] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6bf0*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6bf0*, lpNumberOfBytesWritten=0x18fdd8*=0x2170, lpOverlapped=0x0) returned 1 [0250.468] CloseHandle (hObject=0xdc) returned 1 [0250.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.469] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x20e8 [0250.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20f0) returned 0x2c4a70 [0250.469] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x20e8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x20e8, lpOverlapped=0x0) returned 1 [0250.471] CloseHandle (hObject=0xdc) returned 1 [0250.471] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0250.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.472] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.472] GetTickCount () returned 0x4dff2 [0250.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.472] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.473] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474\\....\\temporaryfile")) returned 0 [0250.473] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474\\temporaryfile")) returned 1 [0250.474] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.474] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.474] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.474] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.474] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.474] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.474] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.474] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474\\temporaryfile")) returned 1 [0250.475] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3c9f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3c9f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3c9f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.475] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.475] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319474" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319474")) returned 1 [0250.479] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 0 [0250.479] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.480] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6b70*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6b70*, lpNumberOfBytesWritten=0x18fdd8*=0x20f0, lpOverlapped=0x0) returned 1 [0250.481] CloseHandle (hObject=0xdc) returned 1 [0250.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.481] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a40 [0250.481] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a48) returned 0x2c4a70 [0250.481] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2a40, lpOverlapped=0x0) returned 1 [0250.483] CloseHandle (hObject=0xdc) returned 1 [0250.483] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0250.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.484] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.484] GetTickCount () returned 0x4e002 [0250.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.484] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319490\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319490\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319490\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319490\\....\\temporaryfile")) returned 0 [0250.485] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319490\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319490\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319490\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319490\\temporaryfile")) returned 1 [0250.486] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319490\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3f0080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3f0080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3f0080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.486] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3f0080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3f0080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3f0080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.486] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3f0080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3f0080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3f0080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.486] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319490\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3f0080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3f0080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3f0080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.486] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3f0080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3f0080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3f0080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.486] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3f0080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3f0080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3f0080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.486] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319490\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319490\\temporaryfile")) returned 1 [0250.486] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a3f0080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a3f0080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a3f0080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.486] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.487] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319490" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319490")) returned 1 [0250.487] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 0 [0250.487] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.488] WriteFile (in: hFile=0xdc, lpBuffer=0x2c74c8*, nNumberOfBytesToWrite=0x2a48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c74c8*, lpNumberOfBytesWritten=0x18fdd8*=0x2a48, lpOverlapped=0x0) returned 1 [0250.488] CloseHandle (hObject=0xdc) returned 1 [0250.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.490] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ec6 [0250.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ece) returned 0x2c4a70 [0250.490] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1ec6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1ec6, lpOverlapped=0x0) returned 1 [0250.491] CloseHandle (hObject=0xdc) returned 1 [0250.492] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0250.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.493] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.493] GetTickCount () returned 0x4e011 [0250.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.493] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505\\....\\temporaryfile")) returned 0 [0250.494] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505\\temporaryfile")) returned 1 [0250.495] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.495] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.495] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.495] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.495] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.495] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.495] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.495] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505\\temporaryfile")) returned 1 [0250.495] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.495] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.496] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505")) returned 1 [0250.496] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 0 [0250.496] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.497] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6950*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6950*, lpNumberOfBytesWritten=0x18fdd8*=0x1ed0, lpOverlapped=0x0) returned 1 [0250.497] CloseHandle (hObject=0xdc) returned 1 [0250.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.499] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2afa [0250.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b02) returned 0x2c4a70 [0250.499] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2afa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2afa, lpOverlapped=0x0) returned 1 [0250.500] CloseHandle (hObject=0xdc) returned 1 [0250.500] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0250.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.501] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.501] GetTickCount () returned 0x4e011 [0250.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.502] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505\\....\\temporaryfile")) returned 0 [0250.502] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505\\temporaryfile")) returned 1 [0250.503] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.503] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.503] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.503] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.504] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.504] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.504] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.504] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505\\temporaryfile")) returned 1 [0250.504] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4161e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4161e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4161e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.504] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.504] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319505" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319505")) returned 1 [0250.504] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 0 [0250.505] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.505] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7588*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7588*, lpNumberOfBytesWritten=0x18fdd8*=0x2b00, lpOverlapped=0x0) returned 1 [0250.506] CloseHandle (hObject=0xdc) returned 1 [0250.506] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.506] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x400c [0250.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4014) returned 0x2c4a70 [0250.507] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x400c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x400c, lpOverlapped=0x0) returned 1 [0250.508] CloseHandle (hObject=0xdc) returned 1 [0250.508] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0250.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.509] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.509] GetTickCount () returned 0x4e021 [0250.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.510] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319521\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319521\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.510] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319521\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319521\\....\\temporaryfile")) returned 0 [0250.510] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319521\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319521\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319521\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319521\\temporaryfile")) returned 1 [0250.511] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319521\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a43c340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a43c340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a43c340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.511] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a43c340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a43c340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a43c340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.511] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a43c340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a43c340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a43c340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.511] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319521\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a43c340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a43c340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a43c340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.512] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a43c340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a43c340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a43c340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.512] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a43c340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a43c340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a43c340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.512] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.512] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319521\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319521\\temporaryfile")) returned 1 [0250.512] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a43c340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a43c340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a43c340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.512] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.512] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319521" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319521")) returned 1 [0250.512] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 0 [0250.513] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.513] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8a98*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8a98*, lpNumberOfBytesWritten=0x18fdd8*=0x4010, lpOverlapped=0x0) returned 1 [0250.514] CloseHandle (hObject=0xdc) returned 1 [0250.514] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.515] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x12bc [0250.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12c4) returned 0x25b528 [0250.515] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x12bc, lpOverlapped=0x0) returned 1 [0250.516] CloseHandle (hObject=0xdc) returned 1 [0250.516] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0250.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.526] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.526] GetTickCount () returned 0x4e030 [0250.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.527] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536\\....\\temporaryfile")) returned 0 [0250.528] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536\\temporaryfile")) returned 1 [0250.529] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.529] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.529] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.529] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.529] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.529] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.529] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.529] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536\\temporaryfile")) returned 1 [0250.530] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.530] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.530] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536")) returned 1 [0250.530] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 0 [0250.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.531] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x12c0, lpOverlapped=0x0) returned 1 [0250.532] CloseHandle (hObject=0xdc) returned 1 [0250.532] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.533] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x83c [0250.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x844) returned 0x2350048 [0250.533] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x83c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x83c, lpOverlapped=0x0) returned 1 [0250.534] CloseHandle (hObject=0xdc) returned 1 [0250.534] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0250.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.535] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.535] GetTickCount () returned 0x4e030 [0250.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.536] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536\\....\\temporaryfile")) returned 0 [0250.537] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536\\temporaryfile")) returned 1 [0250.538] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.538] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.538] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.538] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.538] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.538] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.538] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.538] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536\\temporaryfile")) returned 1 [0250.538] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4624a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4624a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4624a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.538] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.538] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319536" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319536")) returned 1 [0250.538] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 0 [0250.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.539] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x840, lpOverlapped=0x0) returned 1 [0250.540] CloseHandle (hObject=0xdc) returned 1 [0250.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.541] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13ea [0250.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13f2) returned 0x25b528 [0250.541] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13ea, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13ea, lpOverlapped=0x0) returned 1 [0250.542] CloseHandle (hObject=0xdc) returned 1 [0250.542] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0250.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.543] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.543] GetTickCount () returned 0x4e040 [0250.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.544] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552\\....\\temporaryfile")) returned 0 [0250.544] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552\\temporaryfile")) returned 1 [0250.545] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.545] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.545] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.545] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.546] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.546] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.546] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.546] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552\\temporaryfile")) returned 1 [0250.546] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.546] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.546] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552")) returned 1 [0250.546] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 0 [0250.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.547] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x13f0, lpOverlapped=0x0) returned 1 [0250.548] CloseHandle (hObject=0xdc) returned 1 [0250.548] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.548] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x22de [0250.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22e6) returned 0x2c4a70 [0250.548] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x22de, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x22de, lpOverlapped=0x0) returned 1 [0250.550] CloseHandle (hObject=0xdc) returned 1 [0250.550] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0250.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.551] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.551] GetTickCount () returned 0x4e040 [0250.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.551] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552\\....\\temporaryfile")) returned 0 [0250.552] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552\\temporaryfile")) returned 1 [0250.553] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.553] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.553] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.553] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.553] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.553] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552\\temporaryfile")) returned 1 [0250.554] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a488600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a488600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a488600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.554] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.554] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319552" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319552")) returned 1 [0250.554] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 0 [0250.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.555] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6d68*, nNumberOfBytesToWrite=0x22e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6d68*, lpNumberOfBytesWritten=0x18fdd8*=0x22e8, lpOverlapped=0x0) returned 1 [0250.556] CloseHandle (hObject=0xdc) returned 1 [0250.556] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.556] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x43fe [0250.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4406) returned 0x2c4a70 [0250.556] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x43fe, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x43fe, lpOverlapped=0x0) returned 1 [0250.558] CloseHandle (hObject=0xdc) returned 1 [0250.558] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0250.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.559] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.559] GetTickCount () returned 0x4e050 [0250.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.559] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568\\....\\temporaryfile")) returned 0 [0250.560] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568\\temporaryfile")) returned 1 [0250.561] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.561] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.561] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.561] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.561] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.561] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.561] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568\\temporaryfile")) returned 1 [0250.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.562] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.562] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568")) returned 1 [0250.562] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 0 [0250.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.563] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8e88*, nNumberOfBytesToWrite=0x4408, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8e88*, lpNumberOfBytesWritten=0x18fdd8*=0x4408, lpOverlapped=0x0) returned 1 [0250.564] CloseHandle (hObject=0xdc) returned 1 [0250.564] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.564] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5c0 [0250.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5c8) returned 0x259e70 [0250.564] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5c0, lpOverlapped=0x0) returned 1 [0250.566] CloseHandle (hObject=0xdc) returned 1 [0250.566] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0250.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.567] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.567] GetTickCount () returned 0x4e050 [0250.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.567] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.567] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568\\....\\temporaryfile")) returned 0 [0250.568] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568\\temporaryfile")) returned 1 [0250.569] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.569] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.569] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.569] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.569] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.569] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.569] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.569] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568\\temporaryfile")) returned 1 [0250.570] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4ae760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4ae760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4ae760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.570] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.570] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319568" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319568")) returned 1 [0250.570] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 0 [0250.570] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.571] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x5c8, lpOverlapped=0x0) returned 1 [0250.572] CloseHandle (hObject=0xdc) returned 1 [0250.572] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.573] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x148c [0250.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1494) returned 0x29b460 [0250.573] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x148c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x148c, lpOverlapped=0x0) returned 1 [0250.574] CloseHandle (hObject=0xdc) returned 1 [0250.574] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0250.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.575] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.575] GetTickCount () returned 0x4e05f [0250.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.576] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583\\....\\temporaryfile")) returned 0 [0250.576] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583\\temporaryfile")) returned 1 [0250.577] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.577] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.577] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.577] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.577] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.577] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.578] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583\\temporaryfile")) returned 1 [0250.578] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.578] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583")) returned 1 [0250.578] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 0 [0250.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.579] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1490, lpOverlapped=0x0) returned 1 [0250.580] CloseHandle (hObject=0xdc) returned 1 [0250.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.580] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x380 [0250.580] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x388) returned 0x259e70 [0250.580] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x380, lpOverlapped=0x0) returned 1 [0250.582] CloseHandle (hObject=0xdc) returned 1 [0250.582] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0250.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.582] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.582] GetTickCount () returned 0x4e05f [0250.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.583] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583\\....\\temporaryfile")) returned 0 [0250.584] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583\\temporaryfile")) returned 1 [0250.585] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.585] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.585] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.585] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.585] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.585] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.585] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.585] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583\\temporaryfile")) returned 1 [0250.586] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4d48c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4d48c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4d48c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.586] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.586] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319583" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319583")) returned 1 [0250.586] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 0 [0250.586] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.587] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x388, lpOverlapped=0x0) returned 1 [0250.587] CloseHandle (hObject=0xdc) returned 1 [0250.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.588] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2f0 [0250.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2f8) returned 0x259e70 [0250.588] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2f0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2f0, lpOverlapped=0x0) returned 1 [0250.589] CloseHandle (hObject=0xdc) returned 1 [0250.589] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0250.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.590] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.590] GetTickCount () returned 0x4e06f [0250.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.591] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599\\....\\temporaryfile")) returned 0 [0250.591] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599\\temporaryfile")) returned 1 [0250.592] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.593] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.593] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.593] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.593] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.593] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599\\temporaryfile")) returned 1 [0250.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.593] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.593] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599")) returned 1 [0250.593] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 0 [0250.594] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.594] WriteFile (in: hFile=0xdc, lpBuffer=0x25a178*, nNumberOfBytesToWrite=0x2f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a178*, lpNumberOfBytesWritten=0x18fdd8*=0x2f8, lpOverlapped=0x0) returned 1 [0250.595] CloseHandle (hObject=0xdc) returned 1 [0250.595] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.595] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2b90 [0250.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b98) returned 0x2c4a70 [0250.595] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2b90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2b90, lpOverlapped=0x0) returned 1 [0250.597] CloseHandle (hObject=0xdc) returned 1 [0250.597] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0250.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.598] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.598] GetTickCount () returned 0x4e06f [0250.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.598] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.599] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599\\....\\temporaryfile")) returned 0 [0250.599] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599\\temporaryfile")) returned 1 [0250.600] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.600] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.600] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.600] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.600] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.600] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.601] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599\\temporaryfile")) returned 1 [0250.601] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a4faa20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a4faa20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a4faa20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.601] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319599" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319599")) returned 1 [0250.601] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 0 [0250.649] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.650] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7618*, nNumberOfBytesToWrite=0x2b98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7618*, lpNumberOfBytesWritten=0x18fdd8*=0x2b98, lpOverlapped=0x0) returned 1 [0250.650] CloseHandle (hObject=0xdc) returned 1 [0250.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.652] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2332 [0250.652] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x233a) returned 0x2c4a70 [0250.652] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2332, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2332, lpOverlapped=0x0) returned 1 [0250.653] CloseHandle (hObject=0xdc) returned 1 [0250.653] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0250.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.654] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.654] GetTickCount () returned 0x4e0ad [0250.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.658] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319661\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319661\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319661\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319661\\....\\temporaryfile")) returned 0 [0250.659] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319661\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319661\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319661\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319661\\temporaryfile")) returned 1 [0250.660] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319661\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a592fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a592fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a592fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.661] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a592fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a592fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a592fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.661] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a592fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a592fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a592fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.661] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319661\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a592fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a592fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a592fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.661] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a592fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a592fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a592fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.661] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a592fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a592fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a592fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.661] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.661] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319661\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319661\\temporaryfile")) returned 1 [0250.661] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a592fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a592fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a592fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.661] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.661] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319661" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319661")) returned 1 [0250.661] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 0 [0250.662] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.662] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6dc0*, nNumberOfBytesToWrite=0x2338, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6dc0*, lpNumberOfBytesWritten=0x18fdd8*=0x2338, lpOverlapped=0x0) returned 1 [0250.663] CloseHandle (hObject=0xdc) returned 1 [0250.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.664] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3690 [0250.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3698) returned 0x2c4a70 [0250.664] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x3690, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3690, lpOverlapped=0x0) returned 1 [0250.666] CloseHandle (hObject=0xdc) returned 1 [0250.666] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0250.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.667] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.667] GetTickCount () returned 0x4e0bd [0250.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.667] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677\\....\\temporaryfile")) returned 0 [0250.668] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677\\temporaryfile")) returned 1 [0250.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.669] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.669] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.670] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.670] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.670] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677\\temporaryfile")) returned 1 [0250.670] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.670] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677")) returned 1 [0250.670] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 0 [0250.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.671] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8118*, nNumberOfBytesToWrite=0x3698, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8118*, lpNumberOfBytesWritten=0x18fdd8*=0x3698, lpOverlapped=0x0) returned 1 [0250.672] CloseHandle (hObject=0xdc) returned 1 [0250.672] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.673] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa6d0 [0250.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa6d8) returned 0x2c4a70 [0250.673] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0xa6d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0xa6d0, lpOverlapped=0x0) returned 1 [0250.674] CloseHandle (hObject=0xdc) returned 1 [0250.674] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0250.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.676] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.676] GetTickCount () returned 0x4e0bd [0250.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.676] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677\\....\\temporaryfile")) returned 0 [0250.677] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677\\temporaryfile")) returned 1 [0250.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.678] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.678] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.678] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.678] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677\\temporaryfile")) returned 1 [0250.679] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5b9100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5b9100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5b9100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.679] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319677" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319677")) returned 1 [0250.679] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 0 [0250.681] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.681] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf158*, nNumberOfBytesToWrite=0xa6d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf158*, lpNumberOfBytesWritten=0x18fdd8*=0xa6d8, lpOverlapped=0x0) returned 1 [0250.683] CloseHandle (hObject=0xdc) returned 1 [0250.683] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.684] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3b3c [0250.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3b44) returned 0x2c4a70 [0250.684] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x3b3c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3b3c, lpOverlapped=0x0) returned 1 [0250.685] CloseHandle (hObject=0xdc) returned 1 [0250.685] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0250.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.686] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.686] GetTickCount () returned 0x4e0cc [0250.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.687] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692\\....\\temporaryfile")) returned 0 [0250.688] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692\\temporaryfile")) returned 1 [0250.689] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5df260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5df260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5df260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.689] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5df260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5df260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5df260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.689] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5df260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5df260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5df260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.689] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5df260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5df260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5df260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.689] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5df260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5df260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5df260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.689] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5df260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5df260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5df260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.689] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.689] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692\\temporaryfile")) returned 1 [0250.689] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5df260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a5df260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a5df260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.689] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.689] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692")) returned 1 [0250.690] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 0 [0250.690] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.691] WriteFile (in: hFile=0xdc, lpBuffer=0x2c85c8*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c85c8*, lpNumberOfBytesWritten=0x18fdd8*=0x3b40, lpOverlapped=0x0) returned 1 [0250.691] CloseHandle (hObject=0xdc) returned 1 [0250.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.692] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x121a [0250.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1222) returned 0x25b528 [0250.692] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x121a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x121a, lpOverlapped=0x0) returned 1 [0250.693] CloseHandle (hObject=0xdc) returned 1 [0250.693] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0250.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.694] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.694] GetTickCount () returned 0x4e0cc [0250.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.695] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692\\....\\temporaryfile")) returned 0 [0250.696] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692\\temporaryfile")) returned 1 [0250.697] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5df260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a5df260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.697] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.697] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.697] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.697] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692\\temporaryfile")) returned 1 [0250.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.697] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.698] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319692" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319692")) returned 1 [0250.698] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 0 [0250.698] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.699] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1220, lpOverlapped=0x0) returned 1 [0250.699] CloseHandle (hObject=0xdc) returned 1 [0250.700] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.700] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x96c [0250.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x974) returned 0x2350048 [0250.700] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x96c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x96c, lpOverlapped=0x0) returned 1 [0250.701] CloseHandle (hObject=0xdc) returned 1 [0250.701] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0250.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.702] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.702] GetTickCount () returned 0x4e0dc [0250.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.703] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708\\....\\temporaryfile")) returned 0 [0250.704] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708\\temporaryfile")) returned 1 [0250.705] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.705] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.705] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.705] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.705] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.705] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.705] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.705] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708\\temporaryfile")) returned 1 [0250.705] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6053c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6053c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.705] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.705] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708")) returned 1 [0250.706] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 0 [0250.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.706] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x970, lpOverlapped=0x0) returned 1 [0250.707] CloseHandle (hObject=0xdc) returned 1 [0250.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.708] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1378 [0250.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1380) returned 0x25b528 [0250.708] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1378, lpOverlapped=0x0) returned 1 [0250.709] CloseHandle (hObject=0xdc) returned 1 [0250.709] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0250.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.710] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.710] GetTickCount () returned 0x4e0dc [0250.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.711] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.711] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708\\....\\temporaryfile")) returned 0 [0250.711] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708\\temporaryfile")) returned 1 [0250.713] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.713] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6053c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.713] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.713] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.713] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.713] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.713] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.713] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708\\temporaryfile")) returned 1 [0250.713] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.713] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.713] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319708" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319708")) returned 1 [0250.713] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 0 [0250.714] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.714] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1380, lpOverlapped=0x0) returned 1 [0250.715] CloseHandle (hObject=0xdc) returned 1 [0250.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.716] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf7c [0250.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf84) returned 0x2350048 [0250.716] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xf7c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xf7c, lpOverlapped=0x0) returned 1 [0250.718] CloseHandle (hObject=0xdc) returned 1 [0250.718] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0250.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.719] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.719] GetTickCount () returned 0x4e0ec [0250.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.719] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319724\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319724\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319724\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319724\\....\\temporaryfile")) returned 0 [0250.720] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319724\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319724\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319724\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319724\\temporaryfile")) returned 1 [0250.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319724\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.721] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.721] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319724\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.721] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.721] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.721] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.721] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319724\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319724\\temporaryfile")) returned 1 [0250.722] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a62b520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a62b520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a62b520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.722] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.722] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319724" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319724")) returned 1 [0250.722] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 0 [0250.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.723] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xf80, lpOverlapped=0x0) returned 1 [0250.723] CloseHandle (hObject=0xdc) returned 1 [0250.724] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.724] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x488 [0250.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x490) returned 0x259e70 [0250.724] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x488, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x488, lpOverlapped=0x0) returned 1 [0250.735] CloseHandle (hObject=0xdc) returned 1 [0250.735] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0250.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.736] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.736] GetTickCount () returned 0x4e0fb [0250.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.737] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319739\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319739\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.737] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319739\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319739\\....\\temporaryfile")) returned 0 [0250.737] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319739\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319739\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319739\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319739\\temporaryfile")) returned 1 [0250.738] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319739\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a651680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a651680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a651680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.739] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a651680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a651680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a651680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.739] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a651680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a651680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a651680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.739] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319739\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a651680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a651680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a651680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.739] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a651680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a651680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a651680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.739] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a651680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a651680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a651680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.739] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.739] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319739\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319739\\temporaryfile")) returned 1 [0250.739] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a651680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a651680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a651680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.739] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.739] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319739" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319739")) returned 1 [0250.739] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 0 [0250.740] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.740] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x490, lpOverlapped=0x0) returned 1 [0250.741] CloseHandle (hObject=0xdc) returned 1 [0250.741] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.741] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x91c [0250.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x924) returned 0x2350048 [0250.741] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x91c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x91c, lpOverlapped=0x0) returned 1 [0250.743] CloseHandle (hObject=0xdc) returned 1 [0250.743] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0250.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.744] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.744] GetTickCount () returned 0x4e10b [0250.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.744] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755\\....\\temporaryfile")) returned 0 [0250.745] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755\\temporaryfile")) returned 1 [0250.746] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.746] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.746] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.746] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.746] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.746] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.746] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.746] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755\\temporaryfile")) returned 1 [0250.747] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.747] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.747] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755")) returned 1 [0250.747] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 0 [0250.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.748] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x920, lpOverlapped=0x0) returned 1 [0250.748] CloseHandle (hObject=0xdc) returned 1 [0250.749] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.749] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x284c [0250.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2854) returned 0x2c4a70 [0250.749] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x284c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x284c, lpOverlapped=0x0) returned 1 [0250.750] CloseHandle (hObject=0xdc) returned 1 [0250.750] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0250.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.751] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.751] GetTickCount () returned 0x4e10b [0250.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.752] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755\\....\\temporaryfile")) returned 0 [0250.753] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755\\temporaryfile")) returned 1 [0250.754] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.754] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.754] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.754] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.754] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.754] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.754] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755\\temporaryfile")) returned 1 [0250.755] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6777e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6777e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6777e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.755] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319755" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319755")) returned 1 [0250.755] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 0 [0250.755] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.756] WriteFile (in: hFile=0xdc, lpBuffer=0x2c72d8*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c72d8*, lpNumberOfBytesWritten=0x18fdd8*=0x2850, lpOverlapped=0x0) returned 1 [0250.757] CloseHandle (hObject=0xdc) returned 1 [0250.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.757] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x76ce [0250.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x76d6) returned 0x2c4a70 [0250.757] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x76ce, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x76ce, lpOverlapped=0x0) returned 1 [0250.759] CloseHandle (hObject=0xdc) returned 1 [0250.759] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0250.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.760] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.760] GetTickCount () returned 0x4e11a [0250.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.761] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770\\....\\temporaryfile")) returned 0 [0250.761] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770\\temporaryfile")) returned 1 [0250.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.762] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.762] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.763] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.763] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.763] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770\\temporaryfile")) returned 1 [0250.763] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.763] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770")) returned 1 [0250.763] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 0 [0250.764] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.764] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc158*, nNumberOfBytesToWrite=0x76d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc158*, lpNumberOfBytesWritten=0x18fdd8*=0x76d8, lpOverlapped=0x0) returned 1 [0250.765] CloseHandle (hObject=0xdc) returned 1 [0250.766] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.767] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4604 [0250.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x460c) returned 0x2c4a70 [0250.767] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x4604, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x4604, lpOverlapped=0x0) returned 1 [0250.768] CloseHandle (hObject=0xdc) returned 1 [0250.768] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0250.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.769] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.769] GetTickCount () returned 0x4e11a [0250.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.770] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770\\....\\temporaryfile")) returned 0 [0250.770] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770\\temporaryfile")) returned 1 [0250.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.772] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.772] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.772] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.772] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770\\temporaryfile")) returned 1 [0250.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a69d940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a69d940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a69d940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.772] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319770" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319770")) returned 1 [0250.772] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 0 [0250.773] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.773] WriteFile (in: hFile=0xdc, lpBuffer=0x2c9090*, nNumberOfBytesToWrite=0x4608, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c9090*, lpNumberOfBytesWritten=0x18fdd8*=0x4608, lpOverlapped=0x0) returned 1 [0250.774] CloseHandle (hObject=0xdc) returned 1 [0250.775] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.776] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x79cc [0250.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x79d4) returned 0x2c4a70 [0250.776] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x79cc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x79cc, lpOverlapped=0x0) returned 1 [0250.777] CloseHandle (hObject=0xdc) returned 1 [0250.777] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0250.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.778] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.778] GetTickCount () returned 0x4e12a [0250.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.779] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319786\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319786\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.779] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319786\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319786\\....\\temporaryfile")) returned 0 [0250.779] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319786\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319786\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319786\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319786\\temporaryfile")) returned 1 [0250.780] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319786\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6c3aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6c3aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6c3aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6c3aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6c3aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6c3aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6c3aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6c3aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6c3aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.781] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319786\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6c3aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6c3aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6c3aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.781] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6c3aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6c3aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6c3aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.781] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6c3aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6c3aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6c3aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.781] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.781] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319786\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319786\\temporaryfile")) returned 1 [0250.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6c3aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6c3aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6c3aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.781] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.781] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319786" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319786")) returned 1 [0250.781] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 0 [0250.782] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.782] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc458*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc458*, lpNumberOfBytesWritten=0x18fdd8*=0x79d0, lpOverlapped=0x0) returned 1 [0250.784] CloseHandle (hObject=0xdc) returned 1 [0250.784] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.784] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x329e [0250.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32a6) returned 0x2c4a70 [0250.784] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x329e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x329e, lpOverlapped=0x0) returned 1 [0250.788] CloseHandle (hObject=0xdc) returned 1 [0250.788] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0250.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.789] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.789] GetTickCount () returned 0x4e13a [0250.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.790] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.790] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802\\....\\temporaryfile")) returned 0 [0250.790] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802\\temporaryfile")) returned 1 [0250.794] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.794] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.794] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.794] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.795] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.795] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.795] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.795] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802\\temporaryfile")) returned 1 [0250.795] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.795] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.795] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802")) returned 1 [0250.795] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 0 [0250.796] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.796] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7d28*, nNumberOfBytesToWrite=0x32a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7d28*, lpNumberOfBytesWritten=0x18fdd8*=0x32a8, lpOverlapped=0x0) returned 1 [0250.797] CloseHandle (hObject=0xdc) returned 1 [0250.797] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.798] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9b8 [0250.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9c0) returned 0x2350048 [0250.798] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x9b8, lpOverlapped=0x0) returned 1 [0250.799] CloseHandle (hObject=0xdc) returned 1 [0250.799] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0250.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.800] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.800] GetTickCount () returned 0x4e13a [0250.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.800] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802\\....\\temporaryfile")) returned 0 [0250.801] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802\\temporaryfile")) returned 1 [0250.802] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.802] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.802] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.802] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.803] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.803] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.803] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.803] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802\\temporaryfile")) returned 1 [0250.803] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a6e9c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a6e9c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a6e9c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.803] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.803] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319802" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319802")) returned 1 [0250.803] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 0 [0250.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.804] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x9c0, lpOverlapped=0x0) returned 1 [0250.805] CloseHandle (hObject=0xdc) returned 1 [0250.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.806] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x88c [0250.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x894) returned 0x2350048 [0250.806] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x88c, lpOverlapped=0x0) returned 1 [0250.807] CloseHandle (hObject=0xdc) returned 1 [0250.807] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0250.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.808] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.808] GetTickCount () returned 0x4e149 [0250.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.809] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817\\....\\temporaryfile")) returned 0 [0250.809] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817\\temporaryfile")) returned 1 [0250.810] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.810] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.810] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.810] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.810] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.811] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817\\temporaryfile")) returned 1 [0250.811] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.811] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.811] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817")) returned 1 [0250.811] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 0 [0250.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.812] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x890, lpOverlapped=0x0) returned 1 [0250.813] CloseHandle (hObject=0xdc) returned 1 [0250.813] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.813] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x112c [0250.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1134) returned 0x25b528 [0250.813] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x112c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x112c, lpOverlapped=0x0) returned 1 [0250.815] CloseHandle (hObject=0xdc) returned 1 [0250.815] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0250.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.816] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.816] GetTickCount () returned 0x4e149 [0250.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.816] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817\\....\\temporaryfile")) returned 0 [0250.817] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817\\temporaryfile")) returned 1 [0250.818] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.818] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.818] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.818] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.818] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.818] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.818] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.818] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817\\temporaryfile")) returned 1 [0250.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a70fd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a70fd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a70fd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.819] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.819] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319817" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319817")) returned 1 [0250.819] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 0 [0250.819] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.820] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1130, lpOverlapped=0x0) returned 1 [0250.821] CloseHandle (hObject=0xdc) returned 1 [0250.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.821] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe70 [0250.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe78) returned 0x2350048 [0250.821] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe70, lpOverlapped=0x0) returned 1 [0250.823] CloseHandle (hObject=0xdc) returned 1 [0250.823] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0250.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.824] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.824] GetTickCount () returned 0x4e159 [0250.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.824] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833\\....\\temporaryfile")) returned 0 [0250.825] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833\\temporaryfile")) returned 1 [0250.826] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.826] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.826] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.826] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.826] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.826] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.826] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.826] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833\\temporaryfile")) returned 1 [0250.827] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.827] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.827] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833")) returned 1 [0250.827] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 0 [0250.827] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.828] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe78, lpOverlapped=0x0) returned 1 [0250.828] CloseHandle (hObject=0xdc) returned 1 [0250.829] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.829] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x61c [0250.829] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x624) returned 0x259e70 [0250.829] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x61c, lpOverlapped=0x0) returned 1 [0250.830] CloseHandle (hObject=0xdc) returned 1 [0250.830] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0250.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.831] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.831] GetTickCount () returned 0x4e159 [0250.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.832] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.833] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833\\....\\temporaryfile")) returned 0 [0250.833] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833\\temporaryfile")) returned 1 [0250.834] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.834] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.834] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.834] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.834] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833\\temporaryfile")) returned 1 [0250.835] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a735ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a735ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a735ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.835] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.835] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319833" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319833")) returned 1 [0250.835] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 0 [0250.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.836] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x620, lpOverlapped=0x0) returned 1 [0250.837] CloseHandle (hObject=0xdc) returned 1 [0250.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.838] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1234 [0250.838] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x123c) returned 0x25b528 [0250.838] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1234, lpOverlapped=0x0) returned 1 [0250.839] CloseHandle (hObject=0xdc) returned 1 [0250.839] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0250.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.840] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.840] GetTickCount () returned 0x4e168 [0250.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.841] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848\\....\\temporaryfile")) returned 0 [0250.841] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848\\temporaryfile")) returned 1 [0250.842] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.843] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.843] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.843] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.843] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.843] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848\\temporaryfile")) returned 1 [0250.843] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.843] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.843] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848")) returned 1 [0250.843] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 0 [0250.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.844] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1238, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1238, lpOverlapped=0x0) returned 1 [0250.845] CloseHandle (hObject=0xdc) returned 1 [0250.846] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.847] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf94 [0250.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf9c) returned 0x25f580 [0250.847] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xf94, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xf94, lpOverlapped=0x0) returned 1 [0250.848] CloseHandle (hObject=0xdc) returned 1 [0250.848] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0250.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.849] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.849] GetTickCount () returned 0x4e168 [0250.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.850] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848\\....\\temporaryfile")) returned 0 [0250.850] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848\\temporaryfile")) returned 1 [0250.851] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.852] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.852] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.852] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.852] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.852] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.852] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.852] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848\\temporaryfile")) returned 1 [0250.852] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a75c020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a75c020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a75c020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.852] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.852] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319848" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319848")) returned 1 [0250.852] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 0 [0250.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.853] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xf98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xf98, lpOverlapped=0x0) returned 1 [0250.854] CloseHandle (hObject=0xdc) returned 1 [0250.854] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.855] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa4c [0250.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa54) returned 0x2350048 [0250.855] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa4c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xa4c, lpOverlapped=0x0) returned 1 [0250.857] CloseHandle (hObject=0xdc) returned 1 [0250.857] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0250.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.858] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.858] GetTickCount () returned 0x4e178 [0250.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.858] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864\\....\\temporaryfile")) returned 0 [0250.859] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864\\temporaryfile")) returned 1 [0250.860] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.860] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.860] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.860] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.860] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.860] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.860] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.860] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864\\temporaryfile")) returned 1 [0250.861] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.861] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.861] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864")) returned 1 [0250.861] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 0 [0250.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.862] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xa50, lpOverlapped=0x0) returned 1 [0250.862] CloseHandle (hObject=0xdc) returned 1 [0250.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.863] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1510 [0250.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1518) returned 0x29b460 [0250.863] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1510, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1510, lpOverlapped=0x0) returned 1 [0250.864] CloseHandle (hObject=0xdc) returned 1 [0250.864] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0250.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.865] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.865] GetTickCount () returned 0x4e178 [0250.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.866] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864\\....\\temporaryfile")) returned 0 [0250.867] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864\\temporaryfile")) returned 1 [0250.868] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.868] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.868] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.868] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.868] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.868] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.868] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.868] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864\\temporaryfile")) returned 1 [0250.869] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a782180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a782180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a782180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.869] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.869] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319864" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319864")) returned 1 [0250.869] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 0 [0250.869] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.870] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1518, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1518, lpOverlapped=0x0) returned 1 [0250.870] CloseHandle (hObject=0xdc) returned 1 [0250.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.871] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x670 [0250.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x678) returned 0x259e70 [0250.871] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x670, lpOverlapped=0x0) returned 1 [0250.872] CloseHandle (hObject=0xdc) returned 1 [0250.872] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0250.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.873] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.873] GetTickCount () returned 0x4e188 [0250.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.874] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880\\....\\temporaryfile")) returned 0 [0250.875] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880\\temporaryfile")) returned 1 [0250.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.876] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.876] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.876] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.876] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.876] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.876] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880\\temporaryfile")) returned 1 [0250.876] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.876] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.876] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880")) returned 1 [0250.877] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 0 [0250.877] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.877] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x678, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x678, lpOverlapped=0x0) returned 1 [0250.878] CloseHandle (hObject=0xdc) returned 1 [0250.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.879] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc38 [0250.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc40) returned 0x2350048 [0250.879] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc38, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xc38, lpOverlapped=0x0) returned 1 [0250.880] CloseHandle (hObject=0xdc) returned 1 [0250.880] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0250.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.881] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.881] GetTickCount () returned 0x4e188 [0250.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.882] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880\\....\\temporaryfile")) returned 0 [0250.882] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880\\temporaryfile")) returned 1 [0250.883] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7ce440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7ce440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.884] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7ce440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7ce440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.884] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.884] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.884] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.884] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.884] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.884] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880\\temporaryfile")) returned 1 [0250.884] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7a82e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7a82e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7a82e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.884] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.884] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319880" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319880")) returned 1 [0250.884] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 0 [0250.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.885] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xc40, lpOverlapped=0x0) returned 1 [0250.886] CloseHandle (hObject=0xdc) returned 1 [0250.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.887] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x32b5 [0250.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32bd) returned 0x2c4a70 [0250.887] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x32b5, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x32b5, lpOverlapped=0x0) returned 1 [0250.888] CloseHandle (hObject=0xdc) returned 1 [0250.888] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0250.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.889] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.889] GetTickCount () returned 0x4e197 [0250.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.890] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319895\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319895\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319895\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319895\\....\\temporaryfile")) returned 0 [0250.891] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319895\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319895\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319895\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319895\\temporaryfile")) returned 1 [0250.892] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319895\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7ce440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7ce440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7ce440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7ce440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7ce440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7ce440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7ce440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7ce440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7ce440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.892] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319895\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7ce440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7ce440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7ce440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.892] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7ce440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7ce440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7ce440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.892] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7ce440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7ce440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7ce440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.892] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.892] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319895\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319895\\temporaryfile")) returned 1 [0250.893] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7ce440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7ce440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7ce440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.893] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.893] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319895" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319895")) returned 1 [0250.893] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 0 [0250.893] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.894] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7d40*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7d40*, lpNumberOfBytesWritten=0x18fdd8*=0x32c0, lpOverlapped=0x0) returned 1 [0250.895] CloseHandle (hObject=0xdc) returned 1 [0250.895] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.896] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2466 [0250.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x246e) returned 0x2c4a70 [0250.896] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2466, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2466, lpOverlapped=0x0) returned 1 [0250.897] CloseHandle (hObject=0xdc) returned 1 [0250.897] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0250.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.898] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.898] GetTickCount () returned 0x4e1a7 [0250.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.899] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911\\....\\temporaryfile")) returned 0 [0250.899] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911\\temporaryfile")) returned 1 [0250.901] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.901] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.901] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.901] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.901] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.901] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.901] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.901] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911\\temporaryfile")) returned 1 [0250.901] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.901] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.901] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911")) returned 1 [0250.901] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 0 [0250.902] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.902] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6ef0*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6ef0*, lpNumberOfBytesWritten=0x18fdd8*=0x2470, lpOverlapped=0x0) returned 1 [0250.903] CloseHandle (hObject=0xdc) returned 1 [0250.903] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.904] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x816 [0250.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x81e) returned 0x2350048 [0250.904] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x816, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x816, lpOverlapped=0x0) returned 1 [0250.906] CloseHandle (hObject=0xdc) returned 1 [0250.906] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 1 [0250.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.907] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.907] GetTickCount () returned 0x4e1a7 [0250.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.907] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911\\....\\temporaryfile")) returned 0 [0250.908] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911\\temporaryfile")) returned 1 [0250.909] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.909] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.909] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.909] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.909] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.909] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911\\temporaryfile")) returned 1 [0250.910] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a7f45a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a7f45a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a7f45a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.910] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.910] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319911" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319911")) returned 1 [0250.910] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 0 [0250.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.913] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x820, lpOverlapped=0x0) returned 1 [0250.914] CloseHandle (hObject=0xdc) returned 1 [0250.914] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.915] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d8f [0250.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d97) returned 0x2c4a70 [0250.916] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1d8f, lpOverlapped=0x0) returned 1 [0250.918] CloseHandle (hObject=0xdc) returned 1 [0250.918] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0250.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.919] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.919] GetTickCount () returned 0x4e1b6 [0250.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.920] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926\\....\\temporaryfile")) returned 0 [0250.920] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926\\temporaryfile")) returned 1 [0250.921] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.921] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.921] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.922] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.922] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.922] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.922] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926\\temporaryfile")) returned 1 [0250.922] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.922] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926")) returned 1 [0250.922] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 0 [0250.923] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.923] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6818*, nNumberOfBytesToWrite=0x1d98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6818*, lpNumberOfBytesWritten=0x18fdd8*=0x1d98, lpOverlapped=0x0) returned 1 [0250.924] CloseHandle (hObject=0xdc) returned 1 [0250.924] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.924] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18bb [0250.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18c3) returned 0x2c4a70 [0250.924] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x18bb, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x18bb, lpOverlapped=0x0) returned 1 [0250.926] CloseHandle (hObject=0xdc) returned 1 [0250.926] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0250.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.927] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.927] GetTickCount () returned 0x4e1b6 [0250.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.927] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926\\....\\temporaryfile")) returned 0 [0250.928] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926\\temporaryfile")) returned 1 [0250.929] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.930] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.930] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.930] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.930] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.930] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.930] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926\\temporaryfile")) returned 1 [0250.930] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a81a700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a81a700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a81a700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.930] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319926" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319926")) returned 1 [0250.930] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 0 [0250.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.931] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6348*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6348*, lpNumberOfBytesWritten=0x18fdd8*=0x18c0, lpOverlapped=0x0) returned 1 [0250.932] CloseHandle (hObject=0xdc) returned 1 [0250.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.933] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xeb4 [0250.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xebc) returned 0x2350048 [0250.933] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xeb4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xeb4, lpOverlapped=0x0) returned 1 [0250.934] CloseHandle (hObject=0xdc) returned 1 [0250.935] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0250.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.935] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.936] GetTickCount () returned 0x4e1c6 [0250.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.936] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942\\....\\temporaryfile")) returned 0 [0250.937] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942\\temporaryfile")) returned 1 [0250.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.938] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.938] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.938] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.938] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942\\temporaryfile")) returned 1 [0250.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.938] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.939] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942")) returned 1 [0250.939] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 0 [0250.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.939] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xeb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xeb8, lpOverlapped=0x0) returned 1 [0250.940] CloseHandle (hObject=0xdc) returned 1 [0250.940] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.941] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9a8 [0250.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9b0) returned 0x2350048 [0250.941] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x9a8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x9a8, lpOverlapped=0x0) returned 1 [0250.943] CloseHandle (hObject=0xdc) returned 1 [0250.943] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0250.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.944] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.944] GetTickCount () returned 0x4e1c6 [0250.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.944] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942\\....\\temporaryfile")) returned 0 [0250.945] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942\\temporaryfile")) returned 1 [0250.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8669c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8669c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.946] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8669c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8669c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.946] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.946] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.946] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.946] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942\\temporaryfile")) returned 1 [0250.947] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a840860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a840860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a840860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.947] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319942" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319942")) returned 1 [0250.947] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 0 [0250.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.948] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x9b0, lpOverlapped=0x0) returned 1 [0250.949] CloseHandle (hObject=0xdc) returned 1 [0250.949] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.950] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8b8 [0250.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8c0) returned 0x2350048 [0250.950] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x8b8, lpOverlapped=0x0) returned 1 [0250.951] CloseHandle (hObject=0xdc) returned 1 [0250.951] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0250.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.952] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.952] GetTickCount () returned 0x4e1d6 [0250.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.953] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319958\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319958\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319958\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319958\\....\\temporaryfile")) returned 0 [0250.953] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319958\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319958\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319958\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319958\\temporaryfile")) returned 1 [0250.954] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319958\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8669c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8669c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8669c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.955] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8669c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8669c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8669c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.955] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8669c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8669c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8669c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.955] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319958\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8669c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8669c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8669c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.955] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8669c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8669c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8669c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.955] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8669c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8669c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8669c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.955] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.955] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319958\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319958\\temporaryfile")) returned 1 [0250.955] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8669c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8669c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8669c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.955] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.955] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319958" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319958")) returned 1 [0250.955] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 0 [0250.956] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.956] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x8c0, lpOverlapped=0x0) returned 1 [0250.957] CloseHandle (hObject=0xdc) returned 1 [0250.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.958] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x402 [0250.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40a) returned 0x259e70 [0250.958] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x402, lpOverlapped=0x0) returned 1 [0250.959] CloseHandle (hObject=0xdc) returned 1 [0250.959] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0250.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.960] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.960] GetTickCount () returned 0x4e1e5 [0250.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.961] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.961] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973\\....\\temporaryfile")) returned 0 [0250.961] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973\\temporaryfile")) returned 1 [0250.962] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.963] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.963] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.963] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.963] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.963] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.963] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.963] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973\\temporaryfile")) returned 1 [0250.963] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.963] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.963] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973")) returned 1 [0250.963] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 0 [0250.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.964] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x408, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x408, lpOverlapped=0x0) returned 1 [0250.965] CloseHandle (hObject=0xdc) returned 1 [0250.965] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.965] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcd6 [0250.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcde) returned 0x2350048 [0250.966] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xcd6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xcd6, lpOverlapped=0x0) returned 1 [0250.967] CloseHandle (hObject=0xdc) returned 1 [0250.967] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0250.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.968] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.968] GetTickCount () returned 0x4e1e5 [0250.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.968] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973\\....\\temporaryfile")) returned 0 [0250.969] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973\\temporaryfile")) returned 1 [0250.970] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.970] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.970] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.970] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.970] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.971] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.971] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.971] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973\\temporaryfile")) returned 1 [0250.971] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a88cb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a88cb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a88cb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.971] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.971] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319973" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319973")) returned 1 [0250.971] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 0 [0250.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.972] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xce0, lpOverlapped=0x0) returned 1 [0250.973] CloseHandle (hObject=0xdc) returned 1 [0250.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.973] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7a8 [0250.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7b0) returned 0x2350048 [0250.973] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7a8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7a8, lpOverlapped=0x0) returned 1 [0250.975] CloseHandle (hObject=0xdc) returned 1 [0250.975] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0250.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.976] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.976] GetTickCount () returned 0x4e1f5 [0250.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.977] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989\\....\\temporaryfile")) returned 0 [0250.977] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989\\temporaryfile")) returned 1 [0250.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.978] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.978] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.978] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.978] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.979] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989\\temporaryfile")) returned 1 [0250.979] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.979] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989")) returned 1 [0250.979] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 0 [0250.979] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.980] WriteFile (in: hFile=0xdc, lpBuffer=0x2350808*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350808*, lpNumberOfBytesWritten=0x18fdd8*=0x7b0, lpOverlapped=0x0) returned 1 [0250.981] CloseHandle (hObject=0xdc) returned 1 [0250.981] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.984] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe4e [0250.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe56) returned 0x2350048 [0250.984] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe4e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe4e, lpOverlapped=0x0) returned 1 [0250.985] CloseHandle (hObject=0xdc) returned 1 [0250.985] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0250.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0250.986] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.986] GetTickCount () returned 0x4e1f5 [0250.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.986] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989\\...."), lpSecurityAttributes=0x256228) returned 1 [0250.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989\\....\\temporaryfile")) returned 0 [0250.987] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989\\temporaryfile")) returned 1 [0250.988] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0250.989] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.989] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0250.989] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0250.989] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.989] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0250.989] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0250.989] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989\\temporaryfile")) returned 1 [0250.989] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8b2c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8b2c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8b2c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0250.989] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0250.989] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18319989" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18319989")) returned 1 [0250.989] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 0 [0250.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.990] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe58, lpOverlapped=0x0) returned 1 [0250.991] CloseHandle (hObject=0xdc) returned 1 [0250.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0250.995] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbc8 [0250.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbd0) returned 0x2350048 [0250.995] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xbc8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xbc8, lpOverlapped=0x0) returned 1 [0250.996] CloseHandle (hObject=0xdc) returned 1 [0250.997] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0250.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0250.997] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0250.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0250.997] GetTickCount () returned 0x4e204 [0250.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0250.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0250.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0250.998] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004\\...."), lpSecurityAttributes=0x256210) returned 1 [0250.998] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004\\....\\temporaryfile")) returned 0 [0250.998] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004\\temporaryfile")) returned 1 [0251.000] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.000] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.000] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.000] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.000] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.000] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.000] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.000] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004\\temporaryfile")) returned 1 [0251.000] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.000] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.000] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004")) returned 1 [0251.000] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 0 [0251.001] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.001] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xbd0, lpOverlapped=0x0) returned 1 [0251.002] CloseHandle (hObject=0xdc) returned 1 [0251.002] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.003] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5f8 [0251.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x600) returned 0x259e70 [0251.003] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5f8, lpOverlapped=0x0) returned 1 [0251.004] CloseHandle (hObject=0xdc) returned 1 [0251.004] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0251.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.005] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.005] GetTickCount () returned 0x4e204 [0251.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.005] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.006] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004\\....\\temporaryfile")) returned 0 [0251.006] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004\\temporaryfile")) returned 1 [0251.007] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.007] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.007] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.008] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.008] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.008] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.008] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.008] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004\\temporaryfile")) returned 1 [0251.008] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8d8de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8d8de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8d8de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.008] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.008] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320004" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320004")) returned 1 [0251.008] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 0 [0251.008] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.009] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x600, lpOverlapped=0x0) returned 1 [0251.010] CloseHandle (hObject=0xdc) returned 1 [0251.010] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.011] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xce2 [0251.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcea) returned 0x2350048 [0251.011] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xce2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xce2, lpOverlapped=0x0) returned 1 [0251.012] CloseHandle (hObject=0xdc) returned 1 [0251.012] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0251.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.013] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.013] GetTickCount () returned 0x4e214 [0251.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.014] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.014] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020\\....\\temporaryfile")) returned 0 [0251.014] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020\\temporaryfile")) returned 1 [0251.015] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.016] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.016] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.016] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.016] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.016] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.016] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.016] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020\\temporaryfile")) returned 1 [0251.016] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.016] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.016] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020")) returned 1 [0251.016] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 0 [0251.017] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.017] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xce8, lpOverlapped=0x0) returned 1 [0251.018] CloseHandle (hObject=0xdc) returned 1 [0251.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.019] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x332 [0251.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x33a) returned 0x259e70 [0251.019] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x332, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x332, lpOverlapped=0x0) returned 1 [0251.020] CloseHandle (hObject=0xdc) returned 1 [0251.020] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0251.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.021] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.021] GetTickCount () returned 0x4e214 [0251.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.021] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020\\....\\temporaryfile")) returned 0 [0251.022] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020\\temporaryfile")) returned 1 [0251.024] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.024] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.024] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.024] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.024] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.024] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.024] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.024] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020\\temporaryfile")) returned 1 [0251.024] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a8fef40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a8fef40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a8fef40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.024] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.024] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320020" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320020")) returned 1 [0251.024] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 0 [0251.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.025] WriteFile (in: hFile=0xdc, lpBuffer=0x25a1c0*, nNumberOfBytesToWrite=0x338, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a1c0*, lpNumberOfBytesWritten=0x18fdd8*=0x338, lpOverlapped=0x0) returned 1 [0251.026] CloseHandle (hObject=0xdc) returned 1 [0251.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.027] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3960 [0251.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3968) returned 0x2c4a70 [0251.027] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x3960, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3960, lpOverlapped=0x0) returned 1 [0251.028] CloseHandle (hObject=0xdc) returned 1 [0251.028] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0251.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.029] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.029] GetTickCount () returned 0x4e224 [0251.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.030] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036\\....\\temporaryfile")) returned 0 [0251.030] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036\\temporaryfile")) returned 1 [0251.031] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.031] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.031] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.031] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.032] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.032] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.032] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.032] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036\\temporaryfile")) returned 1 [0251.032] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.032] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.032] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036")) returned 1 [0251.032] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 0 [0251.033] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.033] WriteFile (in: hFile=0xdc, lpBuffer=0x2c83e8*, nNumberOfBytesToWrite=0x3968, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c83e8*, lpNumberOfBytesWritten=0x18fdd8*=0x3968, lpOverlapped=0x0) returned 1 [0251.034] CloseHandle (hObject=0xdc) returned 1 [0251.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.035] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x34e2 [0251.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x34ea) returned 0x2c4a70 [0251.035] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x34e2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x34e2, lpOverlapped=0x0) returned 1 [0251.036] CloseHandle (hObject=0xdc) returned 1 [0251.036] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0251.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.037] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.037] GetTickCount () returned 0x4e224 [0251.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.038] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036\\....\\temporaryfile")) returned 0 [0251.038] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036\\temporaryfile")) returned 1 [0251.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a94b200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a94b200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a94b200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a94b200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.042] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.042] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.042] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.043] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036\\temporaryfile")) returned 1 [0251.043] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9250a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9250a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9250a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.043] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.043] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320036" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320036")) returned 1 [0251.043] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 0 [0251.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.044] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7f70*, nNumberOfBytesToWrite=0x34e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7f70*, lpNumberOfBytesWritten=0x18fdd8*=0x34e8, lpOverlapped=0x0) returned 1 [0251.045] CloseHandle (hObject=0xdc) returned 1 [0251.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.048] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16a6 [0251.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16ae) returned 0x2c4a70 [0251.048] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16a6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16a6, lpOverlapped=0x0) returned 1 [0251.050] CloseHandle (hObject=0xdc) returned 1 [0251.050] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0251.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.051] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.051] GetTickCount () returned 0x4e233 [0251.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.051] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.051] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320051\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320051\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320051\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320051\\....\\temporaryfile")) returned 0 [0251.052] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320051\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320051\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320051\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320051\\temporaryfile")) returned 1 [0251.053] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320051\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a94b200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a94b200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a94b200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.053] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a94b200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a94b200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a94b200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.053] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a94b200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a94b200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a94b200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.053] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320051\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a94b200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a94b200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a94b200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.053] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a94b200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a94b200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a94b200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.054] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a94b200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a94b200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a94b200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.054] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.054] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320051\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320051\\temporaryfile")) returned 1 [0251.054] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a94b200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a94b200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a94b200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.054] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.054] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320051" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320051")) returned 1 [0251.054] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 0 [0251.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.055] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6130*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6130*, lpNumberOfBytesWritten=0x18fdd8*=0x16b0, lpOverlapped=0x0) returned 1 [0251.056] CloseHandle (hObject=0xdc) returned 1 [0251.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.056] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe86 [0251.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe8e) returned 0x2350048 [0251.057] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe86, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe86, lpOverlapped=0x0) returned 1 [0251.058] CloseHandle (hObject=0xdc) returned 1 [0251.058] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0251.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.059] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.059] GetTickCount () returned 0x4e243 [0251.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.060] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.060] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067\\....\\temporaryfile")) returned 0 [0251.060] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067\\temporaryfile")) returned 1 [0251.061] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.061] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.061] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.061] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.061] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.062] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.062] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.062] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067\\temporaryfile")) returned 1 [0251.062] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.062] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.062] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067")) returned 1 [0251.062] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 0 [0251.062] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.063] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe90, lpOverlapped=0x0) returned 1 [0251.064] CloseHandle (hObject=0xdc) returned 1 [0251.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.064] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5bc [0251.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5c4) returned 0x259e70 [0251.064] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5bc, lpOverlapped=0x0) returned 1 [0251.066] CloseHandle (hObject=0xdc) returned 1 [0251.066] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0251.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.067] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.067] GetTickCount () returned 0x4e243 [0251.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.067] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067\\....\\temporaryfile")) returned 0 [0251.068] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067\\temporaryfile")) returned 1 [0251.069] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.069] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.069] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.069] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.069] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.069] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.070] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.070] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067\\temporaryfile")) returned 1 [0251.070] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a971360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a971360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a971360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.070] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.070] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320067" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320067")) returned 1 [0251.070] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 0 [0251.070] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.071] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x5c0, lpOverlapped=0x0) returned 1 [0251.072] CloseHandle (hObject=0xdc) returned 1 [0251.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.072] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x578 [0251.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x580) returned 0x259e70 [0251.072] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x578, lpOverlapped=0x0) returned 1 [0251.074] CloseHandle (hObject=0xdc) returned 1 [0251.074] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0251.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.074] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.075] GetTickCount () returned 0x4e252 [0251.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.075] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082\\....\\temporaryfile")) returned 0 [0251.076] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082\\temporaryfile")) returned 1 [0251.077] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.077] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.077] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.077] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.077] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.077] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.077] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.077] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082\\temporaryfile")) returned 1 [0251.077] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.077] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.077] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082")) returned 1 [0251.078] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 0 [0251.078] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.078] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x580, lpOverlapped=0x0) returned 1 [0251.079] CloseHandle (hObject=0xdc) returned 1 [0251.079] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.080] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3158 [0251.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3160) returned 0x2c4a70 [0251.080] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x3158, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3158, lpOverlapped=0x0) returned 1 [0251.082] CloseHandle (hObject=0xdc) returned 1 [0251.082] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0251.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.083] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.083] GetTickCount () returned 0x4e252 [0251.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.083] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.084] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082\\....\\temporaryfile")) returned 0 [0251.084] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082\\temporaryfile")) returned 1 [0251.085] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.086] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.086] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.086] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.086] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.086] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.086] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.086] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082\\temporaryfile")) returned 1 [0251.086] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9974c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9974c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9974c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.086] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.086] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320082" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320082")) returned 1 [0251.086] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 0 [0251.087] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.087] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7be0*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7be0*, lpNumberOfBytesWritten=0x18fdd8*=0x3160, lpOverlapped=0x0) returned 1 [0251.088] CloseHandle (hObject=0xdc) returned 1 [0251.088] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.089] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2994 [0251.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x299c) returned 0x2c4a70 [0251.089] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2994, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2994, lpOverlapped=0x0) returned 1 [0251.090] CloseHandle (hObject=0xdc) returned 1 [0251.090] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0251.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.091] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.091] GetTickCount () returned 0x4e262 [0251.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.092] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098\\....\\temporaryfile")) returned 0 [0251.092] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098\\temporaryfile")) returned 1 [0251.093] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.093] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.093] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.093] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.094] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.094] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.094] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098\\temporaryfile")) returned 1 [0251.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.094] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098")) returned 1 [0251.094] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 0 [0251.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.095] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7420*, nNumberOfBytesToWrite=0x2998, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7420*, lpNumberOfBytesWritten=0x18fdd8*=0x2998, lpOverlapped=0x0) returned 1 [0251.096] CloseHandle (hObject=0xdc) returned 1 [0251.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.096] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x844 [0251.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x84c) returned 0x2350048 [0251.097] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x844, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x844, lpOverlapped=0x0) returned 1 [0251.098] CloseHandle (hObject=0xdc) returned 1 [0251.098] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0251.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.099] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.099] GetTickCount () returned 0x4e262 [0251.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.099] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098\\....\\temporaryfile")) returned 0 [0251.100] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098\\temporaryfile")) returned 1 [0251.101] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.101] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.101] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.101] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.102] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.102] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.102] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.102] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098\\temporaryfile")) returned 1 [0251.102] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9bd620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9bd620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9bd620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.102] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.102] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320098" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320098")) returned 1 [0251.102] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 0 [0251.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.103] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x848, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x848, lpOverlapped=0x0) returned 1 [0251.104] CloseHandle (hObject=0xdc) returned 1 [0251.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.105] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x620 [0251.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x628) returned 0x259e70 [0251.105] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x620, lpOverlapped=0x0) returned 1 [0251.106] CloseHandle (hObject=0xdc) returned 1 [0251.106] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0251.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.107] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.107] GetTickCount () returned 0x4e272 [0251.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.108] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320114\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320114\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320114\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320114\\....\\temporaryfile")) returned 0 [0251.109] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320114\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320114\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320114\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320114\\temporaryfile")) returned 1 [0251.110] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320114\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9e3780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9e3780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9e3780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9e3780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9e3780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9e3780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9e3780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9e3780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9e3780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.110] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320114\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9e3780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9e3780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9e3780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.110] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9e3780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9e3780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9e3780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.110] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9e3780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9e3780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9e3780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.110] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.110] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320114\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320114\\temporaryfile")) returned 1 [0251.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9a9e3780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9a9e3780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9a9e3780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.110] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.110] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320114" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320114")) returned 1 [0251.111] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 0 [0251.111] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.114] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x628, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x628, lpOverlapped=0x0) returned 1 [0251.114] CloseHandle (hObject=0xdc) returned 1 [0251.115] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.115] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2ce2 [0251.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2cea) returned 0x2c4a70 [0251.115] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2ce2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2ce2, lpOverlapped=0x0) returned 1 [0251.117] CloseHandle (hObject=0xdc) returned 1 [0251.117] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0251.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.117] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.118] GetTickCount () returned 0x4e281 [0251.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.118] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129\\....\\temporaryfile")) returned 0 [0251.119] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129\\temporaryfile")) returned 1 [0251.120] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.120] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.120] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.120] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.120] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.120] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.120] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.120] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129\\temporaryfile")) returned 1 [0251.120] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.120] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.120] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129")) returned 1 [0251.121] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 0 [0251.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.121] WriteFile (in: hFile=0xdc, lpBuffer=0x2c7770*, nNumberOfBytesToWrite=0x2ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c7770*, lpNumberOfBytesWritten=0x18fdd8*=0x2ce8, lpOverlapped=0x0) returned 1 [0251.122] CloseHandle (hObject=0xdc) returned 1 [0251.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.123] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2454 [0251.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x245c) returned 0x2c4a70 [0251.123] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x2454, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x2454, lpOverlapped=0x0) returned 1 [0251.124] CloseHandle (hObject=0xdc) returned 1 [0251.124] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0251.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.125] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.125] GetTickCount () returned 0x4e281 [0251.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.126] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129\\....\\temporaryfile")) returned 0 [0251.127] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129\\temporaryfile")) returned 1 [0251.128] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.128] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.128] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.128] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.128] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.128] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.128] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.128] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129\\temporaryfile")) returned 1 [0251.128] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa098e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa098e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa098e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.129] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.129] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320129" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320129")) returned 1 [0251.129] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 0 [0251.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.130] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6ee0*, nNumberOfBytesToWrite=0x2458, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6ee0*, lpNumberOfBytesWritten=0x18fdd8*=0x2458, lpOverlapped=0x0) returned 1 [0251.130] CloseHandle (hObject=0xdc) returned 1 [0251.131] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.131] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xfc0 [0251.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfc8) returned 0x25f580 [0251.131] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xfc0, lpOverlapped=0x0) returned 1 [0251.132] CloseHandle (hObject=0xdc) returned 1 [0251.132] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0251.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.133] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.133] GetTickCount () returned 0x4e291 [0251.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.134] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145\\....\\temporaryfile")) returned 0 [0251.134] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145\\temporaryfile")) returned 1 [0251.136] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.136] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.136] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.136] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.136] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.136] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.136] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.136] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145\\temporaryfile")) returned 1 [0251.136] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.136] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.136] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145")) returned 1 [0251.137] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 0 [0251.137] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.137] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xfc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xfc8, lpOverlapped=0x0) returned 1 [0251.138] CloseHandle (hObject=0xdc) returned 1 [0251.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.140] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10f4 [0251.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10fc) returned 0x25b528 [0251.140] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x10f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x10f4, lpOverlapped=0x0) returned 1 [0251.141] CloseHandle (hObject=0xdc) returned 1 [0251.141] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0251.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.142] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.142] GetTickCount () returned 0x4e291 [0251.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.143] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145\\....\\temporaryfile")) returned 0 [0251.143] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145\\temporaryfile")) returned 1 [0251.145] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.145] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.145] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.145] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.145] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.145] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.145] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.145] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145\\temporaryfile")) returned 1 [0251.145] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa2fa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa2fa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa2fa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.145] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.145] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320145" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320145")) returned 1 [0251.146] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 0 [0251.146] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.146] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x10f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x10f8, lpOverlapped=0x0) returned 1 [0251.147] CloseHandle (hObject=0xdc) returned 1 [0251.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.148] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1bac [0251.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1bb4) returned 0x2c4a70 [0251.148] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1bac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1bac, lpOverlapped=0x0) returned 1 [0251.149] CloseHandle (hObject=0xdc) returned 1 [0251.149] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0251.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.150] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.150] GetTickCount () returned 0x4e2a0 [0251.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.151] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160\\....\\temporaryfile")) returned 0 [0251.151] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160\\temporaryfile")) returned 1 [0251.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.153] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.153] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.153] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160\\temporaryfile")) returned 1 [0251.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.153] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160")) returned 1 [0251.153] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 0 [0251.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.157] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6638*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6638*, lpNumberOfBytesWritten=0x18fdd8*=0x1bb0, lpOverlapped=0x0) returned 1 [0251.158] CloseHandle (hObject=0xdc) returned 1 [0251.158] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.159] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1bba [0251.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1bc2) returned 0x2c4a70 [0251.159] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1bba, lpOverlapped=0x0) returned 1 [0251.160] CloseHandle (hObject=0xdc) returned 1 [0251.160] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0251.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.161] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.161] GetTickCount () returned 0x4e2a0 [0251.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.162] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160\\....\\temporaryfile")) returned 0 [0251.163] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160\\temporaryfile")) returned 1 [0251.164] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.164] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.164] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.164] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.164] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.164] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160\\temporaryfile")) returned 1 [0251.164] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa55ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa55ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa55ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.164] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.165] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320160" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320160")) returned 1 [0251.165] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 0 [0251.165] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.165] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6648*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6648*, lpNumberOfBytesWritten=0x18fdd8*=0x1bc0, lpOverlapped=0x0) returned 1 [0251.166] CloseHandle (hObject=0xdc) returned 1 [0251.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.167] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb20 [0251.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb28) returned 0x2350048 [0251.168] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xb20, lpOverlapped=0x0) returned 1 [0251.169] CloseHandle (hObject=0xdc) returned 1 [0251.169] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0251.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.170] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.170] GetTickCount () returned 0x4e2b0 [0251.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.170] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320176\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320176\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320176\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320176\\....\\temporaryfile")) returned 0 [0251.171] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320176\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320176\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320176\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320176\\temporaryfile")) returned 1 [0251.172] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320176\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa7bd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa7bd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa7bd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.172] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa7bd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa7bd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa7bd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.172] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa7bd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa7bd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa7bd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.172] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320176\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa7bd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa7bd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa7bd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.172] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa7bd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa7bd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa7bd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.173] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa7bd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa7bd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa7bd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.173] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.173] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320176\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320176\\temporaryfile")) returned 1 [0251.173] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aa7bd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aa7bd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aa7bd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.173] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.173] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320176" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320176")) returned 1 [0251.173] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 0 [0251.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.174] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xb28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xb28, lpOverlapped=0x0) returned 1 [0251.174] CloseHandle (hObject=0xdc) returned 1 [0251.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.176] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x47c [0251.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x484) returned 0x259e70 [0251.176] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x47c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x47c, lpOverlapped=0x0) returned 1 [0251.177] CloseHandle (hObject=0xdc) returned 1 [0251.177] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0251.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.180] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.180] GetTickCount () returned 0x4e2c0 [0251.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.181] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320192\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320192\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320192\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320192\\....\\temporaryfile")) returned 0 [0251.181] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320192\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320192\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320192\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320192\\temporaryfile")) returned 1 [0251.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320192\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaa1e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaa1e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaa1e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaa1e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaa1e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaa1e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaa1e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaa1e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaa1e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320192\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaa1e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaa1e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaa1e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaa1e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaa1e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaa1e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaa1e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaa1e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaa1e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.183] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.183] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320192\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320192\\temporaryfile")) returned 1 [0251.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaa1e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaa1e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaa1e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.183] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.183] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320192" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320192")) returned 1 [0251.183] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 0 [0251.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.184] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x480, lpOverlapped=0x0) returned 1 [0251.185] CloseHandle (hObject=0xdc) returned 1 [0251.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.186] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xac4 [0251.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xacc) returned 0x2350048 [0251.186] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xac4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xac4, lpOverlapped=0x0) returned 1 [0251.193] CloseHandle (hObject=0xdc) returned 1 [0251.193] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0251.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.194] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.194] GetTickCount () returned 0x4e2cf [0251.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.195] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207\\....\\temporaryfile")) returned 0 [0251.196] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207\\temporaryfile")) returned 1 [0251.197] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.197] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.197] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.197] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.197] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.197] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.197] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.197] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207\\temporaryfile")) returned 1 [0251.197] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.198] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.198] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207")) returned 1 [0251.198] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 0 [0251.198] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.199] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xac8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xac8, lpOverlapped=0x0) returned 1 [0251.200] CloseHandle (hObject=0xdc) returned 1 [0251.200] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.200] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4f4 [0251.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4fc) returned 0x259e70 [0251.200] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x4f4, lpOverlapped=0x0) returned 1 [0251.202] CloseHandle (hObject=0xdc) returned 1 [0251.202] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0251.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.203] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.203] GetTickCount () returned 0x4e2cf [0251.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.203] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.204] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207\\....\\temporaryfile")) returned 0 [0251.204] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207\\temporaryfile")) returned 1 [0251.205] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.205] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.205] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.205] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.206] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.206] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207\\temporaryfile")) returned 1 [0251.206] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aac7fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aac7fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aac7fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.206] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.206] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320207" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320207")) returned 1 [0251.206] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 0 [0251.206] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.207] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x4f8, lpOverlapped=0x0) returned 1 [0251.208] CloseHandle (hObject=0xdc) returned 1 [0251.208] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.208] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1388 [0251.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1390) returned 0x25b528 [0251.208] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1388, lpOverlapped=0x0) returned 1 [0251.210] CloseHandle (hObject=0xdc) returned 1 [0251.210] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0251.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.211] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.211] GetTickCount () returned 0x4e2df [0251.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.211] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223\\....\\temporaryfile")) returned 0 [0251.212] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223\\temporaryfile")) returned 1 [0251.214] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.214] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.214] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.214] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.214] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.214] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.214] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.214] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223\\temporaryfile")) returned 1 [0251.214] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.214] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.214] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223")) returned 1 [0251.215] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 0 [0251.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.216] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1390, lpOverlapped=0x0) returned 1 [0251.216] CloseHandle (hObject=0xdc) returned 1 [0251.217] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.218] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1cac [0251.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1cb4) returned 0x2c4a70 [0251.218] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1cac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1cac, lpOverlapped=0x0) returned 1 [0251.219] CloseHandle (hObject=0xdc) returned 1 [0251.219] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0251.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.220] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.220] GetTickCount () returned 0x4e2df [0251.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.221] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.221] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223\\....\\temporaryfile")) returned 0 [0251.221] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223\\temporaryfile")) returned 1 [0251.223] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.223] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.223] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.223] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.223] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.223] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.223] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.223] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223\\temporaryfile")) returned 1 [0251.223] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aaee120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aaee120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aaee120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.223] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.223] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320223" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320223")) returned 1 [0251.223] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 0 [0251.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.224] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6738*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6738*, lpNumberOfBytesWritten=0x18fdd8*=0x1cb0, lpOverlapped=0x0) returned 1 [0251.225] CloseHandle (hObject=0xdc) returned 1 [0251.226] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.226] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3dbe [0251.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3dc6) returned 0x2c4a70 [0251.226] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x3dbe, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x3dbe, lpOverlapped=0x0) returned 1 [0251.228] CloseHandle (hObject=0xdc) returned 1 [0251.228] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0251.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.229] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.229] GetTickCount () returned 0x4e2ee [0251.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.229] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238\\....\\temporaryfile")) returned 0 [0251.230] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238\\temporaryfile")) returned 1 [0251.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.231] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.231] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.231] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.231] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238\\temporaryfile")) returned 1 [0251.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.232] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.232] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238")) returned 1 [0251.232] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 0 [0251.232] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.233] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8848*, nNumberOfBytesToWrite=0x3dc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8848*, lpNumberOfBytesWritten=0x18fdd8*=0x3dc8, lpOverlapped=0x0) returned 1 [0251.234] CloseHandle (hObject=0xdc) returned 1 [0251.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.234] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1780 [0251.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1788) returned 0x2c4a70 [0251.234] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1780, lpOverlapped=0x0) returned 1 [0251.236] CloseHandle (hObject=0xdc) returned 1 [0251.236] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0251.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.237] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.237] GetTickCount () returned 0x4e2ee [0251.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.237] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238\\....\\temporaryfile")) returned 0 [0251.238] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238\\temporaryfile")) returned 1 [0251.239] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.239] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.239] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.239] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.239] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.239] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.240] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.240] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238\\temporaryfile")) returned 1 [0251.240] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab14280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab14280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab14280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.240] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.240] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320238" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320238")) returned 1 [0251.240] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 0 [0251.240] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.241] WriteFile (in: hFile=0xdc, lpBuffer=0x2c6208*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c6208*, lpNumberOfBytesWritten=0x18fdd8*=0x1788, lpOverlapped=0x0) returned 1 [0251.242] CloseHandle (hObject=0xdc) returned 1 [0251.242] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.242] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1746 [0251.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x174e) returned 0x2c4a70 [0251.243] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1746, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1746, lpOverlapped=0x0) returned 1 [0251.245] CloseHandle (hObject=0xdc) returned 1 [0251.245] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0251.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.246] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.246] GetTickCount () returned 0x4e2fe [0251.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.247] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254\\....\\temporaryfile")) returned 0 [0251.247] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254\\temporaryfile")) returned 1 [0251.248] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.249] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.249] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.249] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.249] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254\\temporaryfile")) returned 1 [0251.249] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.249] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254")) returned 1 [0251.249] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 0 [0251.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.250] WriteFile (in: hFile=0xdc, lpBuffer=0x2c61d0*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c61d0*, lpNumberOfBytesWritten=0x18fdd8*=0x1750, lpOverlapped=0x0) returned 1 [0251.251] CloseHandle (hObject=0xdc) returned 1 [0251.251] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.252] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c80 [0251.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c88) returned 0x2c4a70 [0251.252] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1c80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1c80, lpOverlapped=0x0) returned 1 [0251.253] CloseHandle (hObject=0xdc) returned 1 [0251.253] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0251.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.254] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.254] GetTickCount () returned 0x4e2fe [0251.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.255] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254\\....\\temporaryfile")) returned 0 [0251.255] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254\\temporaryfile")) returned 1 [0251.256] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.257] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.257] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.257] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.257] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.257] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.257] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.257] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254\\temporaryfile")) returned 1 [0251.257] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab3a3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab3a3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab3a3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.257] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.257] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320254" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320254")) returned 1 [0251.257] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 0 [0251.258] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.258] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1c88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1c88, lpOverlapped=0x0) returned 1 [0251.259] CloseHandle (hObject=0xdc) returned 1 [0251.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.260] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1526 [0251.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x152e) returned 0x29b460 [0251.261] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1526, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1526, lpOverlapped=0x0) returned 1 [0251.262] CloseHandle (hObject=0xdc) returned 1 [0251.262] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0251.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.263] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.263] GetTickCount () returned 0x4e30e [0251.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.263] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270\\....\\temporaryfile")) returned 0 [0251.264] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270\\temporaryfile")) returned 1 [0251.265] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.265] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.265] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.265] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.265] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.265] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.265] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.265] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270\\temporaryfile")) returned 1 [0251.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.266] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.266] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270")) returned 1 [0251.266] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 0 [0251.266] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.267] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1530, lpOverlapped=0x0) returned 1 [0251.268] CloseHandle (hObject=0xdc) returned 1 [0251.268] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.268] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa38 [0251.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa40) returned 0x2350048 [0251.268] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xa38, lpOverlapped=0x0) returned 1 [0251.270] CloseHandle (hObject=0xdc) returned 1 [0251.270] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0251.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.271] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.271] GetTickCount () returned 0x4e30e [0251.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.271] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270\\....\\temporaryfile")) returned 0 [0251.272] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270\\temporaryfile")) returned 1 [0251.273] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab866a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab866a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.273] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab866a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab866a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.273] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.274] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.274] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.274] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.274] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.274] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270\\temporaryfile")) returned 1 [0251.274] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab60540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab60540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab60540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.274] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.274] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320270" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320270")) returned 1 [0251.274] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 0 [0251.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.275] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xa40, lpOverlapped=0x0) returned 1 [0251.276] CloseHandle (hObject=0xdc) returned 1 [0251.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.276] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6852 [0251.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x685a) returned 0x2c8700 [0251.277] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6852, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6852, lpOverlapped=0x0) returned 1 [0251.278] CloseHandle (hObject=0xdc) returned 1 [0251.278] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0251.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.279] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.279] GetTickCount () returned 0x4e31d [0251.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.280] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285\\....\\temporaryfile")) returned 0 [0251.280] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285\\temporaryfile")) returned 1 [0251.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab866a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab866a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab866a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab866a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab866a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab866a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab866a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab866a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab866a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab866a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab866a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab866a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab866a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab866a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab866a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab866a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab866a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab866a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.282] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285\\temporaryfile")) returned 1 [0251.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ab866a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ab866a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ab866a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.282] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285")) returned 1 [0251.282] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 0 [0251.283] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.283] WriteFile (in: hFile=0xdc, lpBuffer=0x2cef70*, nNumberOfBytesToWrite=0x6858, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cef70*, lpNumberOfBytesWritten=0x18fdd8*=0x6858, lpOverlapped=0x0) returned 1 [0251.285] CloseHandle (hObject=0xdc) returned 1 [0251.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.285] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa90 [0251.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa98) returned 0x2350048 [0251.285] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xa90, lpOverlapped=0x0) returned 1 [0251.287] CloseHandle (hObject=0xdc) returned 1 [0251.287] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0251.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.287] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.288] GetTickCount () returned 0x4e31d [0251.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.291] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285\\....\\temporaryfile")) returned 0 [0251.292] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285\\temporaryfile")) returned 1 [0251.293] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.293] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.293] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.293] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.293] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.293] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285\\temporaryfile")) returned 1 [0251.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.294] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.294] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320285" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320285")) returned 1 [0251.294] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 0 [0251.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.294] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xa98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xa98, lpOverlapped=0x0) returned 1 [0251.295] CloseHandle (hObject=0xdc) returned 1 [0251.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.296] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x52c [0251.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x534) returned 0x259e70 [0251.296] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x52c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x52c, lpOverlapped=0x0) returned 1 [0251.297] CloseHandle (hObject=0xdc) returned 1 [0251.297] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0251.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.298] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.298] GetTickCount () returned 0x4e32d [0251.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.299] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320301\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320301\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320301\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320301\\....\\temporaryfile")) returned 0 [0251.299] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320301\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320301\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320301\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320301\\temporaryfile")) returned 1 [0251.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320301\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320301\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.301] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320301\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320301\\temporaryfile")) returned 1 [0251.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abac800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abac800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abac800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.301] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320301" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320301")) returned 1 [0251.301] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 0 [0251.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.302] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x530, lpOverlapped=0x0) returned 1 [0251.303] CloseHandle (hObject=0xdc) returned 1 [0251.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.304] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1efc [0251.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f04) returned 0x2c8700 [0251.304] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1efc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1efc, lpOverlapped=0x0) returned 1 [0251.305] CloseHandle (hObject=0xdc) returned 1 [0251.305] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0251.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.306] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.306] GetTickCount () returned 0x4e33c [0251.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.307] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316\\....\\temporaryfile")) returned 0 [0251.307] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316\\temporaryfile")) returned 1 [0251.310] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.310] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.310] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.310] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.310] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.310] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.310] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.310] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316\\temporaryfile")) returned 1 [0251.310] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.310] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.311] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316")) returned 1 [0251.311] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 0 [0251.311] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.312] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca618*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca618*, lpNumberOfBytesWritten=0x18fdd8*=0x1f00, lpOverlapped=0x0) returned 1 [0251.312] CloseHandle (hObject=0xdc) returned 1 [0251.313] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.314] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15b0 [0251.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15b8) returned 0x2c4a70 [0251.314] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x15b0, lpOverlapped=0x0) returned 1 [0251.315] CloseHandle (hObject=0xdc) returned 1 [0251.315] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0251.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.316] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.316] GetTickCount () returned 0x4e33c [0251.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.317] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.317] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316\\....\\temporaryfile")) returned 0 [0251.317] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316\\temporaryfile")) returned 1 [0251.318] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.318] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.319] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.319] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.319] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.319] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316\\temporaryfile")) returned 1 [0251.319] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abd2960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abd2960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abd2960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.319] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.319] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320316" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320316")) returned 1 [0251.319] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 0 [0251.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.320] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x15b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x15b8, lpOverlapped=0x0) returned 1 [0251.321] CloseHandle (hObject=0xdc) returned 1 [0251.321] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.322] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x136a [0251.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1372) returned 0x25b528 [0251.322] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x136a, lpOverlapped=0x0) returned 1 [0251.323] CloseHandle (hObject=0xdc) returned 1 [0251.323] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0251.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.324] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.324] GetTickCount () returned 0x4e34c [0251.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.325] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332\\....\\temporaryfile")) returned 0 [0251.326] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332\\temporaryfile")) returned 1 [0251.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.327] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.327] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.327] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.327] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332\\temporaryfile")) returned 1 [0251.327] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.327] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.327] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332")) returned 1 [0251.328] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 0 [0251.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.328] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1370, lpOverlapped=0x0) returned 1 [0251.329] CloseHandle (hObject=0xdc) returned 1 [0251.329] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.330] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc0a [0251.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc12) returned 0x2350048 [0251.330] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc0a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xc0a, lpOverlapped=0x0) returned 1 [0251.331] CloseHandle (hObject=0xdc) returned 1 [0251.331] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0251.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.332] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.332] GetTickCount () returned 0x4e34c [0251.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.333] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332\\....\\temporaryfile")) returned 0 [0251.333] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332\\temporaryfile")) returned 1 [0251.335] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.335] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.335] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.335] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.335] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.335] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.335] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.335] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332\\temporaryfile")) returned 1 [0251.335] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9abf8ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9abf8ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9abf8ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.336] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320332" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320332")) returned 1 [0251.336] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 0 [0251.336] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.336] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xc10, lpOverlapped=0x0) returned 1 [0251.337] CloseHandle (hObject=0xdc) returned 1 [0251.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.339] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5b04 [0251.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b0c) returned 0x2c8700 [0251.339] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5b04, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5b04, lpOverlapped=0x0) returned 1 [0251.340] CloseHandle (hObject=0xdc) returned 1 [0251.340] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0251.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.341] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.341] GetTickCount () returned 0x4e35c [0251.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.342] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320348\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320348\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320348\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320348\\....\\temporaryfile")) returned 0 [0251.342] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320348\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320348\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320348\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320348\\temporaryfile")) returned 1 [0251.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320348\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac1ec20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac1ec20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac1ec20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.344] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac1ec20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac1ec20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac1ec20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.344] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac1ec20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac1ec20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac1ec20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.344] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320348\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac1ec20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac1ec20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac1ec20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.344] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac1ec20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac1ec20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac1ec20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.344] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac1ec20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac1ec20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac1ec20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.344] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320348\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320348\\temporaryfile")) returned 1 [0251.344] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac1ec20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac1ec20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac1ec20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.344] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320348" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320348")) returned 1 [0251.344] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 0 [0251.345] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.345] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce220*, nNumberOfBytesToWrite=0x5b08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce220*, lpNumberOfBytesWritten=0x18fdd8*=0x5b08, lpOverlapped=0x0) returned 1 [0251.346] CloseHandle (hObject=0xdc) returned 1 [0251.347] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.348] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5664 [0251.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x566c) returned 0x2c8700 [0251.348] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5664, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5664, lpOverlapped=0x0) returned 1 [0251.349] CloseHandle (hObject=0xdc) returned 1 [0251.349] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0251.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.350] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.350] GetTickCount () returned 0x4e36b [0251.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.351] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363\\....\\temporaryfile")) returned 0 [0251.351] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363\\temporaryfile")) returned 1 [0251.352] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.353] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.353] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.353] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.353] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.353] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.353] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.353] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363\\temporaryfile")) returned 1 [0251.353] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.353] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.353] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363")) returned 1 [0251.353] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 0 [0251.354] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.354] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdd80*, nNumberOfBytesToWrite=0x5668, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdd80*, lpNumberOfBytesWritten=0x18fdd8*=0x5668, lpOverlapped=0x0) returned 1 [0251.355] CloseHandle (hObject=0xdc) returned 1 [0251.356] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.356] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3dec [0251.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3df4) returned 0x2c8700 [0251.356] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3dec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3dec, lpOverlapped=0x0) returned 1 [0251.358] CloseHandle (hObject=0xdc) returned 1 [0251.358] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0251.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.359] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.359] GetTickCount () returned 0x4e36b [0251.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.359] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363\\....\\temporaryfile")) returned 0 [0251.360] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363\\temporaryfile")) returned 1 [0251.361] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.361] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.361] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.361] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.361] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.361] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.361] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363\\temporaryfile")) returned 1 [0251.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac44d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac44d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac44d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.362] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320363" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320363")) returned 1 [0251.362] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 0 [0251.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.363] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc508*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc508*, lpNumberOfBytesWritten=0x18fdd8*=0x3df0, lpOverlapped=0x0) returned 1 [0251.364] CloseHandle (hObject=0xdc) returned 1 [0251.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.365] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb10 [0251.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb18) returned 0x2350048 [0251.365] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xb10, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xb10, lpOverlapped=0x0) returned 1 [0251.366] CloseHandle (hObject=0xdc) returned 1 [0251.366] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0251.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.367] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.367] GetTickCount () returned 0x4e37b [0251.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.368] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379\\....\\temporaryfile")) returned 0 [0251.368] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379\\temporaryfile")) returned 1 [0251.369] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.370] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.370] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.370] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.370] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.370] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.370] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.370] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379\\temporaryfile")) returned 1 [0251.370] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.370] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.370] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379")) returned 1 [0251.370] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 0 [0251.371] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.371] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xb18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xb18, lpOverlapped=0x0) returned 1 [0251.372] CloseHandle (hObject=0xdc) returned 1 [0251.372] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.373] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10ca8 [0251.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10cb0) returned 0x2c8700 [0251.373] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x10ca8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x10ca8, lpOverlapped=0x0) returned 1 [0251.376] CloseHandle (hObject=0xdc) returned 1 [0251.376] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0251.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.377] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.377] GetTickCount () returned 0x4e37b [0251.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.378] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379\\....\\temporaryfile")) returned 0 [0251.378] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379\\temporaryfile")) returned 1 [0251.379] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.380] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379\\temporaryfile")) returned 1 [0251.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac6aee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac6aee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac6aee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.380] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320379" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320379")) returned 1 [0251.380] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 0 [0251.382] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.382] WriteFile (in: hFile=0xdc, lpBuffer=0x2d93c0*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d93c0*, lpNumberOfBytesWritten=0x18fdd8*=0x10cb0, lpOverlapped=0x0) returned 1 [0251.384] CloseHandle (hObject=0xdc) returned 1 [0251.384] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.385] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c0a [0251.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c12) returned 0x2c4a70 [0251.385] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1c0a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1c0a, lpOverlapped=0x0) returned 1 [0251.386] CloseHandle (hObject=0xdc) returned 1 [0251.386] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0251.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.387] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.387] GetTickCount () returned 0x4e38a [0251.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.388] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394\\....\\temporaryfile")) returned 0 [0251.388] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394\\temporaryfile")) returned 1 [0251.389] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.390] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.390] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.390] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.390] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.390] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394\\temporaryfile")) returned 1 [0251.390] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.390] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.390] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394")) returned 1 [0251.390] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 0 [0251.391] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.391] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1c10, lpOverlapped=0x0) returned 1 [0251.392] CloseHandle (hObject=0xdc) returned 1 [0251.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.393] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x486 [0251.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48e) returned 0x259e70 [0251.393] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x486, lpOverlapped=0x0) returned 1 [0251.395] CloseHandle (hObject=0xdc) returned 1 [0251.395] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0251.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.395] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.396] GetTickCount () returned 0x4e38a [0251.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.396] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394\\....\\temporaryfile")) returned 0 [0251.397] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394\\temporaryfile")) returned 1 [0251.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acb71a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acb71a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acb71a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acb71a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.399] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.399] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.399] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394\\temporaryfile")) returned 1 [0251.399] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ac91040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ac91040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ac91040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.399] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320394" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320394")) returned 1 [0251.399] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 0 [0251.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.400] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x490, lpOverlapped=0x0) returned 1 [0251.401] CloseHandle (hObject=0xdc) returned 1 [0251.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.401] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x318 [0251.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x320) returned 0x259e70 [0251.401] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x318, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x318, lpOverlapped=0x0) returned 1 [0251.403] CloseHandle (hObject=0xdc) returned 1 [0251.403] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0251.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.404] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.404] GetTickCount () returned 0x4e39a [0251.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.404] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410\\....\\temporaryfile")) returned 0 [0251.405] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410\\temporaryfile")) returned 1 [0251.406] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acb71a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acb71a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acb71a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.407] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acb71a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acb71a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acb71a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.407] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acb71a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acb71a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acb71a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.407] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acb71a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acb71a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acb71a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.407] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acb71a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acb71a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acb71a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.407] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acb71a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acb71a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acb71a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.407] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.407] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410\\temporaryfile")) returned 1 [0251.407] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acb71a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acb71a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acb71a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.407] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.407] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410")) returned 1 [0251.407] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 0 [0251.408] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.408] WriteFile (in: hFile=0xdc, lpBuffer=0x25a1a0*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a1a0*, lpNumberOfBytesWritten=0x18fdd8*=0x320, lpOverlapped=0x0) returned 1 [0251.409] CloseHandle (hObject=0xdc) returned 1 [0251.409] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.410] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x432 [0251.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x43a) returned 0x259e70 [0251.410] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x432, lpOverlapped=0x0) returned 1 [0251.411] CloseHandle (hObject=0xdc) returned 1 [0251.411] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0251.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.412] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.412] GetTickCount () returned 0x4e39a [0251.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.413] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410\\....\\temporaryfile")) returned 0 [0251.413] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410\\temporaryfile")) returned 1 [0251.418] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acb71a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acb71a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.418] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.418] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.418] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.418] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.419] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410\\temporaryfile")) returned 1 [0251.419] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.419] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.419] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320410" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320410")) returned 1 [0251.419] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 0 [0251.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.420] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x438, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x438, lpOverlapped=0x0) returned 1 [0251.421] CloseHandle (hObject=0xdc) returned 1 [0251.421] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.421] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x738 [0251.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x740) returned 0x2350048 [0251.421] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x738, lpOverlapped=0x0) returned 1 [0251.423] CloseHandle (hObject=0xdc) returned 1 [0251.423] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0251.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.424] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.424] GetTickCount () returned 0x4e3aa [0251.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.424] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320426\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320426\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320426\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320426\\....\\temporaryfile")) returned 0 [0251.425] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320426\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320426\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320426\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320426\\temporaryfile")) returned 1 [0251.426] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320426\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.426] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.426] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.426] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320426\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.427] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.427] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.427] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.427] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320426\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320426\\temporaryfile")) returned 1 [0251.427] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9acdd300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9acdd300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9acdd300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.427] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.427] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320426" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320426")) returned 1 [0251.427] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 0 [0251.427] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.428] WriteFile (in: hFile=0xdc, lpBuffer=0x2350798*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350798*, lpNumberOfBytesWritten=0x18fdd8*=0x740, lpOverlapped=0x0) returned 1 [0251.429] CloseHandle (hObject=0xdc) returned 1 [0251.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.430] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2bb6 [0251.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2bbe) returned 0x2c8700 [0251.430] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2bb6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2bb6, lpOverlapped=0x0) returned 1 [0251.431] CloseHandle (hObject=0xdc) returned 1 [0251.432] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0251.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.432] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.433] GetTickCount () returned 0x4e3b9 [0251.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.433] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441\\....\\temporaryfile")) returned 0 [0251.434] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441\\temporaryfile")) returned 1 [0251.435] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad03460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad03460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad03460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.435] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad03460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad03460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad03460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.435] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad03460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad03460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad03460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.435] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad03460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad03460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad03460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.435] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad03460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad03460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad03460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.435] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad03460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad03460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad03460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.435] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.435] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441\\temporaryfile")) returned 1 [0251.436] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad03460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad03460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad03460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.436] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.436] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441")) returned 1 [0251.436] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 0 [0251.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.437] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb2d0*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb2d0*, lpNumberOfBytesWritten=0x18fdd8*=0x2bc0, lpOverlapped=0x0) returned 1 [0251.438] CloseHandle (hObject=0xdc) returned 1 [0251.438] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.441] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x764 [0251.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x76c) returned 0x2350048 [0251.441] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x764, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x764, lpOverlapped=0x0) returned 1 [0251.442] CloseHandle (hObject=0xdc) returned 1 [0251.442] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0251.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.443] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.443] GetTickCount () returned 0x4e3b9 [0251.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.444] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.444] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441\\....\\temporaryfile")) returned 0 [0251.445] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441\\temporaryfile")) returned 1 [0251.446] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad03460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.446] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad03460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.446] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.446] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.446] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.446] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.446] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.446] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441\\temporaryfile")) returned 1 [0251.446] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.447] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.447] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320441" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320441")) returned 1 [0251.447] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 0 [0251.447] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.448] WriteFile (in: hFile=0xdc, lpBuffer=0x23507c8*, nNumberOfBytesToWrite=0x768, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23507c8*, lpNumberOfBytesWritten=0x18fdd8*=0x768, lpOverlapped=0x0) returned 1 [0251.448] CloseHandle (hObject=0xdc) returned 1 [0251.449] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.450] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2b8 [0251.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c0) returned 0x259e70 [0251.450] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2b8, lpOverlapped=0x0) returned 1 [0251.451] CloseHandle (hObject=0xdc) returned 1 [0251.451] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0251.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.451] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.452] GetTickCount () returned 0x4e3c9 [0251.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.452] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320457\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320457\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.453] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320457\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320457\\....\\temporaryfile")) returned 0 [0251.453] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320457\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320457\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320457\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320457\\temporaryfile")) returned 1 [0251.454] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320457\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.454] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.454] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.455] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320457\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.455] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.455] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.455] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.455] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320457\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320457\\temporaryfile")) returned 1 [0251.455] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad295c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad295c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad295c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.455] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.455] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320457" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320457")) returned 1 [0251.455] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 0 [0251.456] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.456] WriteFile (in: hFile=0xdc, lpBuffer=0x25a140*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a140*, lpNumberOfBytesWritten=0x18fdd8*=0x2c0, lpOverlapped=0x0) returned 1 [0251.457] CloseHandle (hObject=0xdc) returned 1 [0251.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.458] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x788 [0251.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x790) returned 0x2350048 [0251.458] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x788, lpOverlapped=0x0) returned 1 [0251.459] CloseHandle (hObject=0xdc) returned 1 [0251.459] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0251.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.460] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.460] GetTickCount () returned 0x4e3d8 [0251.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.461] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472\\....\\temporaryfile")) returned 0 [0251.461] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472\\temporaryfile")) returned 1 [0251.462] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.463] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.463] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.463] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.463] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.463] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472\\temporaryfile")) returned 1 [0251.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.463] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.463] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472")) returned 1 [0251.463] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 0 [0251.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.464] WriteFile (in: hFile=0xdc, lpBuffer=0x23507e8*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23507e8*, lpNumberOfBytesWritten=0x18fdd8*=0x790, lpOverlapped=0x0) returned 1 [0251.465] CloseHandle (hObject=0xdc) returned 1 [0251.465] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.466] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x23d4 [0251.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23dc) returned 0x2c8700 [0251.466] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x23d4, lpOverlapped=0x0) returned 1 [0251.467] CloseHandle (hObject=0xdc) returned 1 [0251.467] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0251.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.468] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.468] GetTickCount () returned 0x4e3d8 [0251.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.469] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472\\....\\temporaryfile")) returned 0 [0251.470] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472\\temporaryfile")) returned 1 [0251.471] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.471] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.471] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.471] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.471] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.471] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.471] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.471] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472\\temporaryfile")) returned 1 [0251.472] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad4f720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad4f720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad4f720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.472] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.472] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320472" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320472")) returned 1 [0251.472] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 0 [0251.472] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.473] WriteFile (in: hFile=0xdc, lpBuffer=0x2caaf0*, nNumberOfBytesToWrite=0x23d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caaf0*, lpNumberOfBytesWritten=0x18fdd8*=0x23d8, lpOverlapped=0x0) returned 1 [0251.474] CloseHandle (hObject=0xdc) returned 1 [0251.474] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.475] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x31cc [0251.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x31d4) returned 0x2c8700 [0251.475] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x31cc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x31cc, lpOverlapped=0x0) returned 1 [0251.477] CloseHandle (hObject=0xdc) returned 1 [0251.477] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0251.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.478] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.478] GetTickCount () returned 0x4e3e8 [0251.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.478] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.478] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488\\....\\temporaryfile")) returned 0 [0251.479] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488\\temporaryfile")) returned 1 [0251.480] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.480] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.480] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.480] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488\\temporaryfile")) returned 1 [0251.481] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.481] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.481] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488")) returned 1 [0251.481] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 0 [0251.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.482] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb8e8*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb8e8*, lpNumberOfBytesWritten=0x18fdd8*=0x31d0, lpOverlapped=0x0) returned 1 [0251.483] CloseHandle (hObject=0xdc) returned 1 [0251.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.483] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b08 [0251.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b10) returned 0x2c4a70 [0251.484] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b08, lpOverlapped=0x0) returned 1 [0251.485] CloseHandle (hObject=0xdc) returned 1 [0251.485] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0251.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.486] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.486] GetTickCount () returned 0x4e3e8 [0251.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.486] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488\\....\\temporaryfile")) returned 0 [0251.487] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488\\temporaryfile")) returned 1 [0251.488] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.488] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.489] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.489] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.489] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.489] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.489] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488\\temporaryfile")) returned 1 [0251.489] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad75880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad75880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad75880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.489] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320488" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320488")) returned 1 [0251.489] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 0 [0251.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.490] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b10, lpOverlapped=0x0) returned 1 [0251.491] CloseHandle (hObject=0xdc) returned 1 [0251.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.492] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4e8 [0251.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f0) returned 0x259e70 [0251.492] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4e8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x4e8, lpOverlapped=0x0) returned 1 [0251.493] CloseHandle (hObject=0xdc) returned 1 [0251.493] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0251.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.494] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.494] GetTickCount () returned 0x4e3f8 [0251.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.495] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504\\....\\temporaryfile")) returned 0 [0251.495] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504\\temporaryfile")) returned 1 [0251.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.497] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504\\temporaryfile")) returned 1 [0251.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.497] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504")) returned 1 [0251.497] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 0 [0251.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.498] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x4f0, lpOverlapped=0x0) returned 1 [0251.499] CloseHandle (hObject=0xdc) returned 1 [0251.499] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.500] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb80 [0251.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb88) returned 0x2350048 [0251.500] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xb80, lpOverlapped=0x0) returned 1 [0251.501] CloseHandle (hObject=0xdc) returned 1 [0251.501] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0251.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.502] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.502] GetTickCount () returned 0x4e3f8 [0251.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.503] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504\\....\\temporaryfile")) returned 0 [0251.505] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504\\temporaryfile")) returned 1 [0251.507] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.507] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.507] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.507] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.507] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.507] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.507] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504\\temporaryfile")) returned 1 [0251.507] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ad9b9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ad9b9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ad9b9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.507] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320504" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320504")) returned 1 [0251.508] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 0 [0251.508] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.508] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xb88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xb88, lpOverlapped=0x0) returned 1 [0251.509] CloseHandle (hObject=0xdc) returned 1 [0251.509] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.510] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2178 [0251.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2180) returned 0x2c8700 [0251.510] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2178, lpOverlapped=0x0) returned 1 [0251.511] CloseHandle (hObject=0xdc) returned 1 [0251.511] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0251.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.512] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.512] GetTickCount () returned 0x4e407 [0251.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.513] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.513] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519\\....\\temporaryfile")) returned 0 [0251.514] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519\\temporaryfile")) returned 1 [0251.515] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9adc1b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9adc1b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9adc1b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.515] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9adc1b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9adc1b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9adc1b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.515] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9adc1b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9adc1b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9adc1b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.515] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9adc1b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9adc1b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9adc1b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.515] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9adc1b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9adc1b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9adc1b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.515] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9adc1b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9adc1b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9adc1b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.515] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.515] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519\\temporaryfile")) returned 1 [0251.515] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9adc1b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9adc1b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9adc1b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.515] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.516] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519")) returned 1 [0251.516] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 0 [0251.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.517] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca890*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca890*, lpNumberOfBytesWritten=0x18fdd8*=0x2180, lpOverlapped=0x0) returned 1 [0251.517] CloseHandle (hObject=0xdc) returned 1 [0251.518] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.519] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4c4 [0251.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4cc) returned 0x259e70 [0251.519] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4c4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x4c4, lpOverlapped=0x0) returned 1 [0251.520] CloseHandle (hObject=0xdc) returned 1 [0251.520] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0251.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.521] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.521] GetTickCount () returned 0x4e407 [0251.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.522] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519\\....\\temporaryfile")) returned 0 [0251.523] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519\\temporaryfile")) returned 1 [0251.524] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9adc1b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.524] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9adc1b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.524] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.524] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.524] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.524] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.524] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.524] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519\\temporaryfile")) returned 1 [0251.524] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.525] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.525] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320519" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320519")) returned 1 [0251.525] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 0 [0251.525] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.526] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x4c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x4c8, lpOverlapped=0x0) returned 1 [0251.526] CloseHandle (hObject=0xdc) returned 1 [0251.527] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.528] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2606 [0251.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x260e) returned 0x2c8700 [0251.528] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2606, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2606, lpOverlapped=0x0) returned 1 [0251.529] CloseHandle (hObject=0xdc) returned 1 [0251.529] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0251.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.530] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.530] GetTickCount () returned 0x4e417 [0251.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.531] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320535\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320535\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320535\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320535\\....\\temporaryfile")) returned 0 [0251.531] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320535\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320535\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320535\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320535\\temporaryfile")) returned 1 [0251.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320535\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320535\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.533] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320535\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320535\\temporaryfile")) returned 1 [0251.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ade7ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ade7ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ade7ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.533] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320535" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320535")) returned 1 [0251.533] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 0 [0251.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.534] WriteFile (in: hFile=0xdc, lpBuffer=0x2cad20*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cad20*, lpNumberOfBytesWritten=0x18fdd8*=0x2610, lpOverlapped=0x0) returned 1 [0251.535] CloseHandle (hObject=0xdc) returned 1 [0251.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.536] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x257c [0251.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2584) returned 0x2c8700 [0251.536] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x257c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x257c, lpOverlapped=0x0) returned 1 [0251.538] CloseHandle (hObject=0xdc) returned 1 [0251.538] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0251.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.539] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.539] GetTickCount () returned 0x4e426 [0251.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.539] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550\\....\\temporaryfile")) returned 0 [0251.540] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550\\temporaryfile")) returned 1 [0251.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.541] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.541] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.541] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.542] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550\\temporaryfile")) returned 1 [0251.542] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.542] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.542] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550")) returned 1 [0251.542] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 0 [0251.542] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.546] WriteFile (in: hFile=0xdc, lpBuffer=0x2cac98*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cac98*, lpNumberOfBytesWritten=0x18fdd8*=0x2580, lpOverlapped=0x0) returned 1 [0251.547] CloseHandle (hObject=0xdc) returned 1 [0251.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.548] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4278 [0251.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4280) returned 0x2c8700 [0251.548] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4278, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4278, lpOverlapped=0x0) returned 1 [0251.549] CloseHandle (hObject=0xdc) returned 1 [0251.549] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0251.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.550] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.550] GetTickCount () returned 0x4e426 [0251.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.551] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550\\....\\temporaryfile")) returned 0 [0251.552] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550\\temporaryfile")) returned 1 [0251.553] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.553] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.553] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.553] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.553] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.553] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550\\temporaryfile")) returned 1 [0251.554] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae0de00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae0de00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae0de00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.554] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.554] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320550" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320550")) returned 1 [0251.554] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 0 [0251.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.555] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc990*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc990*, lpNumberOfBytesWritten=0x18fdd8*=0x4280, lpOverlapped=0x0) returned 1 [0251.556] CloseHandle (hObject=0xdc) returned 1 [0251.556] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.557] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5516 [0251.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x551e) returned 0x2c8700 [0251.557] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5516, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5516, lpOverlapped=0x0) returned 1 [0251.558] CloseHandle (hObject=0xdc) returned 1 [0251.558] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0251.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.559] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.559] GetTickCount () returned 0x4e436 [0251.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.560] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566\\....\\temporaryfile")) returned 0 [0251.560] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566\\temporaryfile")) returned 1 [0251.561] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.562] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.562] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.562] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.562] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.562] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566\\temporaryfile")) returned 1 [0251.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.562] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.562] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566")) returned 1 [0251.562] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 0 [0251.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.563] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdc30*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdc30*, lpNumberOfBytesWritten=0x18fdd8*=0x5520, lpOverlapped=0x0) returned 1 [0251.564] CloseHandle (hObject=0xdc) returned 1 [0251.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.566] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8a12 [0251.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8a1a) returned 0x2c8700 [0251.566] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8a12, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8a12, lpOverlapped=0x0) returned 1 [0251.567] CloseHandle (hObject=0xdc) returned 1 [0251.567] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0251.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.568] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.568] GetTickCount () returned 0x4e436 [0251.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.569] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566\\....\\temporaryfile")) returned 0 [0251.570] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566\\temporaryfile")) returned 1 [0251.571] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae5a0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae5a0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.571] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae5a0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae5a0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.571] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.571] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.571] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.572] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.572] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.572] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566\\temporaryfile")) returned 1 [0251.572] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae33f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae33f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae33f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.572] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.572] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320566" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320566")) returned 1 [0251.572] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 0 [0251.573] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.573] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1130*, nNumberOfBytesToWrite=0x8a18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1130*, lpNumberOfBytesWritten=0x18fdd8*=0x8a18, lpOverlapped=0x0) returned 1 [0251.575] CloseHandle (hObject=0xdc) returned 1 [0251.575] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.575] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x829a [0251.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x82a2) returned 0x2c8700 [0251.575] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x829a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x829a, lpOverlapped=0x0) returned 1 [0251.577] CloseHandle (hObject=0xdc) returned 1 [0251.577] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0251.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.578] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.578] GetTickCount () returned 0x4e446 [0251.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.578] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320582\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320582\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320582\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320582\\....\\temporaryfile")) returned 0 [0251.579] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320582\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320582\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320582\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320582\\temporaryfile")) returned 1 [0251.580] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320582\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae5a0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae5a0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae5a0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.580] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae5a0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae5a0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae5a0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.581] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae5a0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae5a0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae5a0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.581] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320582\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae5a0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae5a0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae5a0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.581] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae5a0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae5a0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae5a0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.581] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae5a0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae5a0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae5a0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.581] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.581] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320582\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320582\\temporaryfile")) returned 1 [0251.581] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae5a0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae5a0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae5a0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.581] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.581] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320582" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320582")) returned 1 [0251.581] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 0 [0251.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.584] WriteFile (in: hFile=0xdc, lpBuffer=0x2d09b8*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d09b8*, lpNumberOfBytesWritten=0x18fdd8*=0x82a0, lpOverlapped=0x0) returned 1 [0251.585] CloseHandle (hObject=0xdc) returned 1 [0251.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.586] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x375e [0251.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3766) returned 0x2c8700 [0251.586] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x375e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x375e, lpOverlapped=0x0) returned 1 [0251.587] CloseHandle (hObject=0xdc) returned 1 [0251.587] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0251.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.588] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.588] GetTickCount () returned 0x4e455 [0251.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.589] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597\\....\\temporaryfile")) returned 0 [0251.589] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597\\temporaryfile")) returned 1 [0251.591] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.591] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.591] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.591] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.591] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.591] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.591] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.591] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597\\temporaryfile")) returned 1 [0251.591] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.591] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.591] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597")) returned 1 [0251.591] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 0 [0251.592] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.592] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbe78*, nNumberOfBytesToWrite=0x3768, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbe78*, lpNumberOfBytesWritten=0x18fdd8*=0x3768, lpOverlapped=0x0) returned 1 [0251.593] CloseHandle (hObject=0xdc) returned 1 [0251.594] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.594] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4dba [0251.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4dc2) returned 0x2c8700 [0251.594] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4dba, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4dba, lpOverlapped=0x0) returned 1 [0251.596] CloseHandle (hObject=0xdc) returned 1 [0251.596] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0251.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.597] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.597] GetTickCount () returned 0x4e455 [0251.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.597] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597\\....\\temporaryfile")) returned 0 [0251.598] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597\\temporaryfile")) returned 1 [0251.599] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.599] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.599] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.599] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.600] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.613] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.613] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.613] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597\\temporaryfile")) returned 1 [0251.613] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ae80220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ae80220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ae80220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.613] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.613] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320597" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320597")) returned 1 [0251.613] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 0 [0251.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.615] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd4d8*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd4d8*, lpNumberOfBytesWritten=0x18fdd8*=0x4dc0, lpOverlapped=0x0) returned 1 [0251.616] CloseHandle (hObject=0xdc) returned 1 [0251.616] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.617] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d40 [0251.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d48) returned 0x2c8700 [0251.617] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3d40, lpOverlapped=0x0) returned 1 [0251.618] CloseHandle (hObject=0xdc) returned 1 [0251.618] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0251.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.619] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.620] GetTickCount () returned 0x4e474 [0251.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.620] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628\\....\\temporaryfile")) returned 0 [0251.621] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628\\temporaryfile")) returned 1 [0251.622] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.622] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.623] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.623] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.623] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.623] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.623] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.623] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628\\temporaryfile")) returned 1 [0251.623] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.623] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.623] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628")) returned 1 [0251.623] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 0 [0251.624] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.624] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc458*, nNumberOfBytesToWrite=0x3d48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc458*, lpNumberOfBytesWritten=0x18fdd8*=0x3d48, lpOverlapped=0x0) returned 1 [0251.625] CloseHandle (hObject=0xdc) returned 1 [0251.626] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.626] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5314 [0251.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x531c) returned 0x2c8700 [0251.626] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5314, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5314, lpOverlapped=0x0) returned 1 [0251.628] CloseHandle (hObject=0xdc) returned 1 [0251.628] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0251.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.629] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.629] GetTickCount () returned 0x4e474 [0251.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.629] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628\\....\\temporaryfile")) returned 0 [0251.630] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628\\temporaryfile")) returned 1 [0251.631] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.632] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.632] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.632] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.632] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.632] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.632] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.632] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628\\temporaryfile")) returned 1 [0251.632] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aecc4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aecc4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aecc4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.632] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.632] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320628" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320628")) returned 1 [0251.632] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 0 [0251.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.633] WriteFile (in: hFile=0xdc, lpBuffer=0x2cda30*, nNumberOfBytesToWrite=0x5318, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cda30*, lpNumberOfBytesWritten=0x18fdd8*=0x5318, lpOverlapped=0x0) returned 1 [0251.635] CloseHandle (hObject=0xdc) returned 1 [0251.635] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.635] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb758 [0251.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb760) returned 0x2c8700 [0251.635] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb758, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb758, lpOverlapped=0x0) returned 1 [0251.637] CloseHandle (hObject=0xdc) returned 1 [0251.637] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0251.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.638] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.638] GetTickCount () returned 0x4e484 [0251.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.639] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320644\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320644\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320644\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320644\\....\\temporaryfile")) returned 0 [0251.639] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320644\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320644\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320644\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320644\\temporaryfile")) returned 1 [0251.641] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320644\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aef2640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aef2640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aef2640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.641] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aef2640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aef2640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aef2640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.641] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aef2640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aef2640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aef2640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.641] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320644\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aef2640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aef2640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aef2640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.641] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aef2640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aef2640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aef2640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.641] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aef2640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aef2640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aef2640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.641] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.641] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320644\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320644\\temporaryfile")) returned 1 [0251.641] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9aef2640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9aef2640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9aef2640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.641] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.641] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320644" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320644")) returned 1 [0251.642] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 0 [0251.642] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.643] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3e70*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3e70*, lpNumberOfBytesWritten=0x18fdd8*=0xb760, lpOverlapped=0x0) returned 1 [0251.644] CloseHandle (hObject=0xdc) returned 1 [0251.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.645] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d90 [0251.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d98) returned 0x2c8700 [0251.646] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3d90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3d90, lpOverlapped=0x0) returned 1 [0251.647] CloseHandle (hObject=0xdc) returned 1 [0251.647] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0251.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.648] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.648] GetTickCount () returned 0x4e494 [0251.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.649] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660\\....\\temporaryfile")) returned 0 [0251.649] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660\\temporaryfile")) returned 1 [0251.650] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.651] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.651] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.651] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.651] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.651] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.651] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.651] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660\\temporaryfile")) returned 1 [0251.651] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.651] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.651] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660")) returned 1 [0251.651] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 0 [0251.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.652] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc4a8*, nNumberOfBytesToWrite=0x3d98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc4a8*, lpNumberOfBytesWritten=0x18fdd8*=0x3d98, lpOverlapped=0x0) returned 1 [0251.653] CloseHandle (hObject=0xdc) returned 1 [0251.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.654] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6e34 [0251.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6e3c) returned 0x2c8700 [0251.654] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6e34, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6e34, lpOverlapped=0x0) returned 1 [0251.656] CloseHandle (hObject=0xdc) returned 1 [0251.656] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0251.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.657] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.657] GetTickCount () returned 0x4e494 [0251.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.657] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660\\....\\temporaryfile")) returned 0 [0251.658] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660\\temporaryfile")) returned 1 [0251.659] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.660] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.660] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.660] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.660] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.660] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.660] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.660] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660\\temporaryfile")) returned 1 [0251.660] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af187a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af187a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af187a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.660] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.660] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320660" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320660")) returned 1 [0251.660] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 0 [0251.661] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.662] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf550*, nNumberOfBytesToWrite=0x6e38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf550*, lpNumberOfBytesWritten=0x18fdd8*=0x6e38, lpOverlapped=0x0) returned 1 [0251.663] CloseHandle (hObject=0xdc) returned 1 [0251.663] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.664] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x44e6 [0251.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x44ee) returned 0x2c8700 [0251.664] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x44e6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x44e6, lpOverlapped=0x0) returned 1 [0251.666] CloseHandle (hObject=0xdc) returned 1 [0251.666] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0251.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.667] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.667] GetTickCount () returned 0x4e4a3 [0251.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.667] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675\\....\\temporaryfile")) returned 0 [0251.668] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675\\temporaryfile")) returned 1 [0251.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.669] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.669] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.669] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.669] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.670] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675\\temporaryfile")) returned 1 [0251.670] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.670] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.670] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675")) returned 1 [0251.670] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 0 [0251.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.671] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccc00*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccc00*, lpNumberOfBytesWritten=0x18fdd8*=0x44f0, lpOverlapped=0x0) returned 1 [0251.672] CloseHandle (hObject=0xdc) returned 1 [0251.672] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.673] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd04 [0251.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd0c) returned 0x2350048 [0251.673] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd04, lpOverlapped=0x0) returned 1 [0251.674] CloseHandle (hObject=0xdc) returned 1 [0251.674] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0251.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.675] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.675] GetTickCount () returned 0x4e4a3 [0251.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.676] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.676] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675\\....\\temporaryfile")) returned 0 [0251.677] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675\\temporaryfile")) returned 1 [0251.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.678] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.678] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.678] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.678] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675\\temporaryfile")) returned 1 [0251.679] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af3e900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af3e900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af3e900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.679] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320675" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320675")) returned 1 [0251.679] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 0 [0251.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.680] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd08, lpOverlapped=0x0) returned 1 [0251.680] CloseHandle (hObject=0xdc) returned 1 [0251.681] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.681] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5b0 [0251.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b8) returned 0x259e70 [0251.681] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5b0, lpOverlapped=0x0) returned 1 [0251.682] CloseHandle (hObject=0xdc) returned 1 [0251.683] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0251.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.683] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.683] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.683] GetTickCount () returned 0x4e4b3 [0251.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.684] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691\\....\\temporaryfile")) returned 0 [0251.685] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691\\temporaryfile")) returned 1 [0251.686] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af64a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af64a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af64a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.686] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af64a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af64a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af64a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.686] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af64a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af64a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af64a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.686] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af64a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af64a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af64a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.686] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af64a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af64a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af64a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.686] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af64a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af64a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af64a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.686] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.686] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691\\temporaryfile")) returned 1 [0251.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af64a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af64a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af64a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.687] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.687] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691")) returned 1 [0251.687] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 0 [0251.687] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.688] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x5b8, lpOverlapped=0x0) returned 1 [0251.688] CloseHandle (hObject=0xdc) returned 1 [0251.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.689] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14c2 [0251.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14ca) returned 0x29b460 [0251.689] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x14c2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x14c2, lpOverlapped=0x0) returned 1 [0251.690] CloseHandle (hObject=0xdc) returned 1 [0251.690] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0251.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.691] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.691] GetTickCount () returned 0x4e4b3 [0251.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.695] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691\\....\\temporaryfile")) returned 0 [0251.696] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691\\temporaryfile")) returned 1 [0251.697] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af64a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af64a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.697] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.697] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.697] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.698] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.698] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691\\temporaryfile")) returned 1 [0251.698] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.698] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.698] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320691" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320691")) returned 1 [0251.698] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 0 [0251.698] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.699] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x14c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x14c8, lpOverlapped=0x0) returned 1 [0251.700] CloseHandle (hObject=0xdc) returned 1 [0251.700] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.700] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b16 [0251.700] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b1e) returned 0x2c4a70 [0251.700] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b16, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b16, lpOverlapped=0x0) returned 1 [0251.702] CloseHandle (hObject=0xdc) returned 1 [0251.702] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0251.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.703] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.703] GetTickCount () returned 0x4e4c2 [0251.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.703] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320706\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320706\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320706\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320706\\....\\temporaryfile")) returned 0 [0251.705] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320706\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320706\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320706\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320706\\temporaryfile")) returned 1 [0251.706] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320706\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.706] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320706\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.706] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.706] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.706] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.706] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320706\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320706\\temporaryfile")) returned 1 [0251.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9af8abc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9af8abc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9af8abc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.706] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.706] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320706" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320706")) returned 1 [0251.707] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 0 [0251.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.708] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b20, lpOverlapped=0x0) returned 1 [0251.708] CloseHandle (hObject=0xdc) returned 1 [0251.709] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.710] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa442 [0251.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa44a) returned 0x2c8700 [0251.710] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa442, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa442, lpOverlapped=0x0) returned 1 [0251.711] CloseHandle (hObject=0xdc) returned 1 [0251.711] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0251.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.712] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.713] GetTickCount () returned 0x4e4d2 [0251.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.713] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722\\....\\temporaryfile")) returned 0 [0251.714] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722\\temporaryfile")) returned 1 [0251.715] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.715] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.715] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.715] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.715] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.715] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.715] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.715] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722\\temporaryfile")) returned 1 [0251.715] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.715] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.716] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722")) returned 1 [0251.716] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 0 [0251.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.717] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2b60*, nNumberOfBytesToWrite=0xa448, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2b60*, lpNumberOfBytesWritten=0x18fdd8*=0xa448, lpOverlapped=0x0) returned 1 [0251.718] CloseHandle (hObject=0xdc) returned 1 [0251.719] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.719] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x136a [0251.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1372) returned 0x25b528 [0251.719] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x136a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x136a, lpOverlapped=0x0) returned 1 [0251.721] CloseHandle (hObject=0xdc) returned 1 [0251.721] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0251.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.722] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.722] GetTickCount () returned 0x4e4d2 [0251.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.722] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722\\....\\temporaryfile")) returned 0 [0251.723] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722\\temporaryfile")) returned 1 [0251.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.725] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.725] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.725] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722\\temporaryfile")) returned 1 [0251.725] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afb0d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afb0d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afb0d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.725] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320722" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320722")) returned 1 [0251.725] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 0 [0251.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.726] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1370, lpOverlapped=0x0) returned 1 [0251.727] CloseHandle (hObject=0xdc) returned 1 [0251.727] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.728] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x60b7 [0251.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x60bf) returned 0x2c8700 [0251.728] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x60b7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x60b7, lpOverlapped=0x0) returned 1 [0251.729] CloseHandle (hObject=0xdc) returned 1 [0251.729] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0251.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.730] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.731] GetTickCount () returned 0x4e4e2 [0251.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.731] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320738\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320738\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320738\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320738\\....\\temporaryfile")) returned 0 [0251.732] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320738\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320738\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320738\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320738\\temporaryfile")) returned 1 [0251.733] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320738\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afd6e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afd6e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afd6e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afd6e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afd6e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afd6e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afd6e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afd6e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afd6e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.733] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320738\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afd6e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afd6e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afd6e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.733] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afd6e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afd6e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afd6e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.733] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afd6e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afd6e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afd6e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.733] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.733] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320738\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320738\\temporaryfile")) returned 1 [0251.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9afd6e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9afd6e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9afd6e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.733] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.734] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320738" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320738")) returned 1 [0251.734] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 0 [0251.734] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.735] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce7d0*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce7d0*, lpNumberOfBytesWritten=0x18fdd8*=0x60c0, lpOverlapped=0x0) returned 1 [0251.737] CloseHandle (hObject=0xdc) returned 1 [0251.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.737] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x40d4 [0251.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40dc) returned 0x2c8700 [0251.738] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x40d4, lpOverlapped=0x0) returned 1 [0251.739] CloseHandle (hObject=0xdc) returned 1 [0251.739] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0251.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.740] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.740] GetTickCount () returned 0x4e4f1 [0251.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.741] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753\\....\\temporaryfile")) returned 0 [0251.741] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753\\temporaryfile")) returned 1 [0251.742] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.743] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.743] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.743] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.743] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.743] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.743] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.743] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753\\temporaryfile")) returned 1 [0251.743] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.743] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.743] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753")) returned 1 [0251.743] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 0 [0251.744] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.744] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc7f0*, nNumberOfBytesToWrite=0x40d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc7f0*, lpNumberOfBytesWritten=0x18fdd8*=0x40d8, lpOverlapped=0x0) returned 1 [0251.745] CloseHandle (hObject=0xdc) returned 1 [0251.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.746] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5f39 [0251.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5f41) returned 0x2c8700 [0251.746] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5f39, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5f39, lpOverlapped=0x0) returned 1 [0251.747] CloseHandle (hObject=0xdc) returned 1 [0251.747] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0251.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.748] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.749] GetTickCount () returned 0x4e4f1 [0251.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.749] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753\\....\\temporaryfile")) returned 0 [0251.750] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753\\temporaryfile")) returned 1 [0251.751] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.751] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.751] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.751] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.751] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.751] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.751] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.751] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753\\temporaryfile")) returned 1 [0251.752] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9affcfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9affcfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9affcfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.752] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.752] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320753" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320753")) returned 1 [0251.752] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 0 [0251.753] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.753] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce658*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce658*, lpNumberOfBytesWritten=0x18fdd8*=0x5f40, lpOverlapped=0x0) returned 1 [0251.754] CloseHandle (hObject=0xdc) returned 1 [0251.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.755] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4752 [0251.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x475a) returned 0x2c8700 [0251.755] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4752, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4752, lpOverlapped=0x0) returned 1 [0251.756] CloseHandle (hObject=0xdc) returned 1 [0251.756] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0251.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.757] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.757] GetTickCount () returned 0x4e501 [0251.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.758] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769\\....\\temporaryfile")) returned 0 [0251.758] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769\\temporaryfile")) returned 1 [0251.760] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.760] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.760] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.760] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.760] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.760] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.760] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.760] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769\\temporaryfile")) returned 1 [0251.760] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.760] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.760] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769")) returned 1 [0251.761] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 0 [0251.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.762] WriteFile (in: hFile=0xdc, lpBuffer=0x2cce70*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cce70*, lpNumberOfBytesWritten=0x18fdd8*=0x4758, lpOverlapped=0x0) returned 1 [0251.763] CloseHandle (hObject=0xdc) returned 1 [0251.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.766] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x11dfe [0251.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11e06) returned 0x2c8700 [0251.766] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x11dfe, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x11dfe, lpOverlapped=0x0) returned 1 [0251.768] CloseHandle (hObject=0xdc) returned 1 [0251.768] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0251.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.769] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.769] GetTickCount () returned 0x4e501 [0251.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.770] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769\\....\\temporaryfile")) returned 0 [0251.770] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769\\temporaryfile")) returned 1 [0251.772] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.772] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.772] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.772] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.772] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769\\temporaryfile")) returned 1 [0251.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b023140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b023140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b023140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.773] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.773] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320769" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320769")) returned 1 [0251.773] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 0 [0251.774] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.775] WriteFile (in: hFile=0xdc, lpBuffer=0x2da518*, nNumberOfBytesToWrite=0x11e08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2da518*, lpNumberOfBytesWritten=0x18fdd8*=0x11e08, lpOverlapped=0x0) returned 1 [0251.776] CloseHandle (hObject=0xdc) returned 1 [0251.778] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.778] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x559a [0251.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x55a2) returned 0x2c8700 [0251.778] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x559a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x559a, lpOverlapped=0x0) returned 1 [0251.780] CloseHandle (hObject=0xdc) returned 1 [0251.780] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0251.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.781] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.781] GetTickCount () returned 0x4e510 [0251.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.781] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320784\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320784\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320784\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320784\\....\\temporaryfile")) returned 0 [0251.782] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320784\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320784\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320784\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320784\\temporaryfile")) returned 1 [0251.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320784\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0492a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0492a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0492a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.783] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0492a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0492a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0492a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.783] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0492a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0492a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0492a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320784\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0492a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0492a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0492a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.783] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0492a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0492a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0492a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.784] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0492a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0492a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0492a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.784] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.784] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320784\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320784\\temporaryfile")) returned 1 [0251.784] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0492a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0492a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0492a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.784] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.784] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320784" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320784")) returned 1 [0251.784] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 0 [0251.785] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.785] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdcb8*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdcb8*, lpNumberOfBytesWritten=0x18fdd8*=0x55a0, lpOverlapped=0x0) returned 1 [0251.786] CloseHandle (hObject=0xdc) returned 1 [0251.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.787] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x65e6 [0251.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x65ee) returned 0x2c8700 [0251.787] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x65e6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x65e6, lpOverlapped=0x0) returned 1 [0251.788] CloseHandle (hObject=0xdc) returned 1 [0251.789] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0251.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.790] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.790] GetTickCount () returned 0x4e520 [0251.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.790] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800\\....\\temporaryfile")) returned 0 [0251.791] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800\\temporaryfile")) returned 1 [0251.792] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.792] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.792] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.792] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.792] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.792] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.792] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.793] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800\\temporaryfile")) returned 1 [0251.793] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.793] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.793] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800")) returned 1 [0251.793] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 0 [0251.794] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.795] WriteFile (in: hFile=0xdc, lpBuffer=0x2ced00*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ced00*, lpNumberOfBytesWritten=0x18fdd8*=0x65f0, lpOverlapped=0x0) returned 1 [0251.797] CloseHandle (hObject=0xdc) returned 1 [0251.797] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.798] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2dae [0251.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2db6) returned 0x2c8700 [0251.798] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2dae, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2dae, lpOverlapped=0x0) returned 1 [0251.799] CloseHandle (hObject=0xdc) returned 1 [0251.799] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0251.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.800] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.800] GetTickCount () returned 0x4e520 [0251.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.801] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800\\....\\temporaryfile")) returned 0 [0251.801] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800\\temporaryfile")) returned 1 [0251.803] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.803] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.803] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.803] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.803] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.803] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.803] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.803] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800\\temporaryfile")) returned 1 [0251.803] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b06f400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b06f400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b06f400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.803] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320800" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320800")) returned 1 [0251.804] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 0 [0251.804] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.805] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb4c8*, nNumberOfBytesToWrite=0x2db8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb4c8*, lpNumberOfBytesWritten=0x18fdd8*=0x2db8, lpOverlapped=0x0) returned 1 [0251.806] CloseHandle (hObject=0xdc) returned 1 [0251.806] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.807] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3632 [0251.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x363a) returned 0x2c8700 [0251.807] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3632, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3632, lpOverlapped=0x0) returned 1 [0251.808] CloseHandle (hObject=0xdc) returned 1 [0251.808] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0251.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.809] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.809] GetTickCount () returned 0x4e530 [0251.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.810] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320816\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320816\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.810] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320816\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320816\\....\\temporaryfile")) returned 0 [0251.810] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320816\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320816\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320816\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320816\\temporaryfile")) returned 1 [0251.812] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320816\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b095560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b095560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b095560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.812] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b095560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b095560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b095560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.812] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b095560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b095560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b095560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.812] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320816\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b095560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b095560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b095560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.812] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b095560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b095560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b095560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.812] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b095560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b095560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b095560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.812] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.812] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320816\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320816\\temporaryfile")) returned 1 [0251.812] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b095560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b095560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b095560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.812] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.812] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320816" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320816")) returned 1 [0251.813] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 0 [0251.813] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.813] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbd50*, nNumberOfBytesToWrite=0x3638, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbd50*, lpNumberOfBytesWritten=0x18fdd8*=0x3638, lpOverlapped=0x0) returned 1 [0251.814] CloseHandle (hObject=0xdc) returned 1 [0251.815] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.816] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b11 [0251.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b19) returned 0x2c4a70 [0251.816] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b11, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b11, lpOverlapped=0x0) returned 1 [0251.817] CloseHandle (hObject=0xdc) returned 1 [0251.817] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0251.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.818] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.818] GetTickCount () returned 0x4e53f [0251.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.819] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831\\....\\temporaryfile")) returned 0 [0251.819] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831\\temporaryfile")) returned 1 [0251.820] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.821] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.821] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.821] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.821] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.821] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.821] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.821] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831\\temporaryfile")) returned 1 [0251.821] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.821] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.821] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831")) returned 1 [0251.821] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 0 [0251.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.822] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1b18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b18, lpOverlapped=0x0) returned 1 [0251.824] CloseHandle (hObject=0xdc) returned 1 [0251.824] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.825] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x227a [0251.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2282) returned 0x2c8700 [0251.825] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x227a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x227a, lpOverlapped=0x0) returned 1 [0251.826] CloseHandle (hObject=0xdc) returned 1 [0251.826] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0251.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.827] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.827] GetTickCount () returned 0x4e53f [0251.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.828] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831\\....\\temporaryfile")) returned 0 [0251.828] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831\\temporaryfile")) returned 1 [0251.830] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.830] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.830] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.830] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.830] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.830] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.830] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.830] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831\\temporaryfile")) returned 1 [0251.830] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0bb6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0bb6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0bb6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.830] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.830] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320831" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320831")) returned 1 [0251.834] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 0 [0251.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.836] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca998*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca998*, lpNumberOfBytesWritten=0x18fdd8*=0x2280, lpOverlapped=0x0) returned 1 [0251.837] CloseHandle (hObject=0xdc) returned 1 [0251.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.837] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3682 [0251.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x368a) returned 0x2c8700 [0251.837] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3682, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3682, lpOverlapped=0x0) returned 1 [0251.839] CloseHandle (hObject=0xdc) returned 1 [0251.839] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0251.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.840] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.840] GetTickCount () returned 0x4e54f [0251.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.840] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847\\....\\temporaryfile")) returned 0 [0251.841] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847\\temporaryfile")) returned 1 [0251.842] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.842] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.842] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.842] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.842] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.842] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847\\temporaryfile")) returned 1 [0251.843] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.843] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.843] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847")) returned 1 [0251.843] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 0 [0251.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.844] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbda0*, nNumberOfBytesToWrite=0x3688, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbda0*, lpNumberOfBytesWritten=0x18fdd8*=0x3688, lpOverlapped=0x0) returned 1 [0251.845] CloseHandle (hObject=0xdc) returned 1 [0251.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.845] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x25c7 [0251.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25cf) returned 0x2c8700 [0251.846] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x25c7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x25c7, lpOverlapped=0x0) returned 1 [0251.847] CloseHandle (hObject=0xdc) returned 1 [0251.847] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0251.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.848] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.848] GetTickCount () returned 0x4e54f [0251.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.849] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847\\....\\temporaryfile")) returned 0 [0251.850] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847\\temporaryfile")) returned 1 [0251.852] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b107980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b107980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.852] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b107980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b107980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.852] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.852] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.852] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.852] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.852] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.852] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847\\temporaryfile")) returned 1 [0251.853] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b0e1820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b0e1820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b0e1820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.853] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.853] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320847" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320847")) returned 1 [0251.853] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 0 [0251.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.854] WriteFile (in: hFile=0xdc, lpBuffer=0x2cace0*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cace0*, lpNumberOfBytesWritten=0x18fdd8*=0x25d0, lpOverlapped=0x0) returned 1 [0251.855] CloseHandle (hObject=0xdc) returned 1 [0251.856] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.856] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6630 [0251.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6638) returned 0x2c8700 [0251.856] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6630, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6630, lpOverlapped=0x0) returned 1 [0251.857] CloseHandle (hObject=0xdc) returned 1 [0251.857] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0251.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.858] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.858] GetTickCount () returned 0x4e55e [0251.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.859] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320862\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320862\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320862\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320862\\....\\temporaryfile")) returned 0 [0251.860] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320862\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320862\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320862\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320862\\temporaryfile")) returned 1 [0251.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320862\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b107980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b107980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b107980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.861] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b107980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b107980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b107980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.861] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b107980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b107980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b107980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320862\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b107980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b107980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b107980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.861] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b107980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b107980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b107980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.861] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b107980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b107980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b107980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.861] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.861] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320862\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320862\\temporaryfile")) returned 1 [0251.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b107980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b107980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b107980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.862] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320862" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320862")) returned 1 [0251.862] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 0 [0251.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.863] WriteFile (in: hFile=0xdc, lpBuffer=0x2ced48*, nNumberOfBytesToWrite=0x6638, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ced48*, lpNumberOfBytesWritten=0x18fdd8*=0x6638, lpOverlapped=0x0) returned 1 [0251.864] CloseHandle (hObject=0xdc) returned 1 [0251.864] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.865] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6b9a [0251.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6ba2) returned 0x2c8700 [0251.865] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6b9a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6b9a, lpOverlapped=0x0) returned 1 [0251.866] CloseHandle (hObject=0xdc) returned 1 [0251.866] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0251.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.867] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.867] GetTickCount () returned 0x4e56e [0251.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.868] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878\\....\\temporaryfile")) returned 0 [0251.868] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878\\temporaryfile")) returned 1 [0251.869] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.870] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.870] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.870] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.870] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.870] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878\\temporaryfile")) returned 1 [0251.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.870] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.870] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878")) returned 1 [0251.870] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 0 [0251.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.871] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf2b8*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf2b8*, lpNumberOfBytesWritten=0x18fdd8*=0x6ba0, lpOverlapped=0x0) returned 1 [0251.873] CloseHandle (hObject=0xdc) returned 1 [0251.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.874] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3b29 [0251.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3b31) returned 0x2c8700 [0251.874] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3b29, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3b29, lpOverlapped=0x0) returned 1 [0251.875] CloseHandle (hObject=0xdc) returned 1 [0251.875] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0251.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.876] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.876] GetTickCount () returned 0x4e56e [0251.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.877] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878\\....\\temporaryfile")) returned 0 [0251.877] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878\\temporaryfile")) returned 1 [0251.879] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.879] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.879] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.879] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.879] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.879] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.879] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.879] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878\\temporaryfile")) returned 1 [0251.879] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b12dae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b12dae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b12dae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.879] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.879] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320878" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320878")) returned 1 [0251.879] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 0 [0251.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.880] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc248*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc248*, lpNumberOfBytesWritten=0x18fdd8*=0x3b30, lpOverlapped=0x0) returned 1 [0251.881] CloseHandle (hObject=0xdc) returned 1 [0251.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.882] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1bf2 [0251.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1bfa) returned 0x2c4a70 [0251.882] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1bf2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1bf2, lpOverlapped=0x0) returned 1 [0251.884] CloseHandle (hObject=0xdc) returned 1 [0251.884] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0251.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.885] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.885] GetTickCount () returned 0x4e57e [0251.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.886] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320894\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320894\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320894\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320894\\....\\temporaryfile")) returned 0 [0251.886] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320894\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320894\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320894\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320894\\temporaryfile")) returned 1 [0251.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320894\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b153c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b153c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b153c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.888] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b153c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b153c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b153c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.888] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b153c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b153c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b153c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.888] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320894\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b153c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b153c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b153c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.888] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b153c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b153c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b153c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.888] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b153c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b153c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b153c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.888] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.888] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320894\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320894\\temporaryfile")) returned 1 [0251.889] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b153c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b153c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b153c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.889] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.889] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320894" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320894")) returned 1 [0251.889] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 0 [0251.890] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.891] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1bf8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1bf8, lpOverlapped=0x0) returned 1 [0251.892] CloseHandle (hObject=0xdc) returned 1 [0251.892] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.893] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4cc8 [0251.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4cd0) returned 0x2c8700 [0251.893] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4cc8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4cc8, lpOverlapped=0x0) returned 1 [0251.896] CloseHandle (hObject=0xdc) returned 1 [0251.896] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0251.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.897] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.897] GetTickCount () returned 0x4e58d [0251.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.898] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.898] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909\\....\\temporaryfile")) returned 0 [0251.898] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909\\temporaryfile")) returned 1 [0251.899] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.899] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.900] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.900] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.900] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.900] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.900] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.900] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909\\temporaryfile")) returned 1 [0251.900] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.900] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.900] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909")) returned 1 [0251.900] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 0 [0251.901] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.901] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd3e0*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd3e0*, lpNumberOfBytesWritten=0x18fdd8*=0x4cd0, lpOverlapped=0x0) returned 1 [0251.902] CloseHandle (hObject=0xdc) returned 1 [0251.902] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.903] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5754 [0251.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x575c) returned 0x2c8700 [0251.903] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5754, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5754, lpOverlapped=0x0) returned 1 [0251.904] CloseHandle (hObject=0xdc) returned 1 [0251.904] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0251.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.905] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.905] GetTickCount () returned 0x4e58d [0251.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.906] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909\\....\\temporaryfile")) returned 0 [0251.907] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909\\temporaryfile")) returned 1 [0251.908] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.908] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.908] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.908] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.908] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.908] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.908] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.908] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909\\temporaryfile")) returned 1 [0251.908] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b179da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b179da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b179da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.908] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.909] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320909" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320909")) returned 1 [0251.909] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 0 [0251.909] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.910] WriteFile (in: hFile=0xdc, lpBuffer=0x2cde70*, nNumberOfBytesToWrite=0x5758, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cde70*, lpNumberOfBytesWritten=0x18fdd8*=0x5758, lpOverlapped=0x0) returned 1 [0251.911] CloseHandle (hObject=0xdc) returned 1 [0251.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.913] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x55ba [0251.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x55c2) returned 0x2c8700 [0251.913] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x55ba, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x55ba, lpOverlapped=0x0) returned 1 [0251.914] CloseHandle (hObject=0xdc) returned 1 [0251.914] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0251.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.915] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.915] GetTickCount () returned 0x4e59d [0251.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.916] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925\\....\\temporaryfile")) returned 0 [0251.916] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925\\temporaryfile")) returned 1 [0251.917] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b19ff00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b19ff00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b19ff00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b19ff00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b19ff00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b19ff00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b19ff00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b19ff00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b19ff00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.917] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b19ff00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b19ff00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b19ff00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.918] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b19ff00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b19ff00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b19ff00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.918] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b19ff00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b19ff00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b19ff00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.918] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925\\temporaryfile")) returned 1 [0251.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b19ff00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b19ff00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b19ff00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.918] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925")) returned 1 [0251.918] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 0 [0251.919] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.919] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdcd8*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdcd8*, lpNumberOfBytesWritten=0x18fdd8*=0x55c0, lpOverlapped=0x0) returned 1 [0251.920] CloseHandle (hObject=0xdc) returned 1 [0251.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.921] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc53a [0251.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc542) returned 0x2c8700 [0251.921] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xc53a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xc53a, lpOverlapped=0x0) returned 1 [0251.925] CloseHandle (hObject=0xdc) returned 1 [0251.925] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0251.926] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.926] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.926] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.926] GetTickCount () returned 0x4e59d [0251.926] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.926] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.927] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925\\....\\temporaryfile")) returned 0 [0251.928] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925\\temporaryfile")) returned 1 [0251.930] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b19ff00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.930] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b19ff00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.930] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.930] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.930] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.930] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.930] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925\\temporaryfile")) returned 1 [0251.931] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.931] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.931] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320925" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320925")) returned 1 [0251.931] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 0 [0251.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.933] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4c58*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4c58*, lpNumberOfBytesWritten=0x18fdd8*=0xc540, lpOverlapped=0x0) returned 1 [0251.934] CloseHandle (hObject=0xdc) returned 1 [0251.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.936] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xfcff [0251.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfd07) returned 0x2c8700 [0251.936] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xfcff, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xfcff, lpOverlapped=0x0) returned 1 [0251.937] CloseHandle (hObject=0xdc) returned 1 [0251.937] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0251.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.939] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.939] GetTickCount () returned 0x4e5ac [0251.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.939] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320940\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320940\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320940\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320940\\....\\temporaryfile")) returned 0 [0251.940] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320940\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320940\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320940\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320940\\temporaryfile")) returned 1 [0251.941] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320940\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.941] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.941] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.941] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320940\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.941] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.941] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.941] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.942] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320940\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320940\\temporaryfile")) returned 1 [0251.942] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1c6060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1c6060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1c6060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.942] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.942] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320940" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320940")) returned 1 [0251.942] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 0 [0251.943] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.944] WriteFile (in: hFile=0xdc, lpBuffer=0x2d8418*, nNumberOfBytesToWrite=0xfd08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d8418*, lpNumberOfBytesWritten=0x18fdd8*=0xfd08, lpOverlapped=0x0) returned 1 [0251.945] CloseHandle (hObject=0xdc) returned 1 [0251.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.946] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xabad [0251.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xabb5) returned 0x2c8700 [0251.946] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xabad, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xabad, lpOverlapped=0x0) returned 1 [0251.947] CloseHandle (hObject=0xdc) returned 1 [0251.947] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0251.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.948] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.948] GetTickCount () returned 0x4e5bc [0251.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.949] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.949] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956\\....\\temporaryfile")) returned 0 [0251.949] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956\\temporaryfile")) returned 1 [0251.950] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.951] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.951] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.951] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.951] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.951] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.951] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.951] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956\\temporaryfile")) returned 1 [0251.951] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.951] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.951] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956")) returned 1 [0251.951] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 0 [0251.952] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.953] WriteFile (in: hFile=0xdc, lpBuffer=0x2d32c8*, nNumberOfBytesToWrite=0xabb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d32c8*, lpNumberOfBytesWritten=0x18fdd8*=0xabb8, lpOverlapped=0x0) returned 1 [0251.955] CloseHandle (hObject=0xdc) returned 1 [0251.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.955] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4ed3 [0251.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4edb) returned 0x2c8700 [0251.955] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4ed3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4ed3, lpOverlapped=0x0) returned 1 [0251.957] CloseHandle (hObject=0xdc) returned 1 [0251.957] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0251.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.958] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.958] GetTickCount () returned 0x4e5bc [0251.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.958] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956\\....\\temporaryfile")) returned 0 [0251.959] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956\\temporaryfile")) returned 1 [0251.961] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.961] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.961] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.961] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.962] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.962] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.962] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.962] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956\\temporaryfile")) returned 1 [0251.962] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b1ec1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b1ec1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b1ec1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.962] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.962] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320956" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320956")) returned 1 [0251.962] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 0 [0251.963] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.964] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd5f0*, nNumberOfBytesToWrite=0x4ed8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd5f0*, lpNumberOfBytesWritten=0x18fdd8*=0x4ed8, lpOverlapped=0x0) returned 1 [0251.965] CloseHandle (hObject=0xdc) returned 1 [0251.965] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.966] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x27d0 [0251.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x27d8) returned 0x2c8700 [0251.966] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x27d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x27d0, lpOverlapped=0x0) returned 1 [0251.967] CloseHandle (hObject=0xdc) returned 1 [0251.967] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0251.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.968] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.968] GetTickCount () returned 0x4e5cc [0251.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.969] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320972\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320972\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320972\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320972\\....\\temporaryfile")) returned 0 [0251.969] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320972\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320972\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320972\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320972\\temporaryfile")) returned 1 [0251.971] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320972\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b212320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b212320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b212320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.971] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b212320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b212320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b212320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.971] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b212320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b212320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b212320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.971] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320972\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b212320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b212320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b212320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.971] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b212320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b212320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b212320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.971] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b212320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b212320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b212320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.971] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.971] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320972\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320972\\temporaryfile")) returned 1 [0251.971] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b212320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b212320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b212320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.971] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.971] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320972" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320972")) returned 1 [0251.971] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 0 [0251.972] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.972] WriteFile (in: hFile=0xdc, lpBuffer=0x2caee8*, nNumberOfBytesToWrite=0x27d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caee8*, lpNumberOfBytesWritten=0x18fdd8*=0x27d8, lpOverlapped=0x0) returned 1 [0251.973] CloseHandle (hObject=0xdc) returned 1 [0251.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.974] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5ee4 [0251.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5eec) returned 0x2c8700 [0251.974] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5ee4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5ee4, lpOverlapped=0x0) returned 1 [0251.975] CloseHandle (hObject=0xdc) returned 1 [0251.975] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0251.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0251.976] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.976] GetTickCount () returned 0x4e5db [0251.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.977] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987\\...."), lpSecurityAttributes=0x256228) returned 1 [0251.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987\\....\\temporaryfile")) returned 0 [0251.981] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987\\temporaryfile")) returned 1 [0251.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.982] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.982] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.982] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.982] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.982] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.982] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987\\temporaryfile")) returned 1 [0251.982] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.982] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.982] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987")) returned 1 [0251.983] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 0 [0251.983] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.984] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce600*, nNumberOfBytesToWrite=0x5ee8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce600*, lpNumberOfBytesWritten=0x18fdd8*=0x5ee8, lpOverlapped=0x0) returned 1 [0251.985] CloseHandle (hObject=0xdc) returned 1 [0251.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0251.985] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2232 [0251.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x223a) returned 0x2c8700 [0251.985] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2232, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2232, lpOverlapped=0x0) returned 1 [0251.987] CloseHandle (hObject=0xdc) returned 1 [0251.987] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0251.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0251.988] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0251.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0251.988] GetTickCount () returned 0x4e5db [0251.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0251.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0251.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0251.988] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987\\...."), lpSecurityAttributes=0x256210) returned 1 [0251.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987\\....\\temporaryfile")) returned 0 [0251.989] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987\\temporaryfile")) returned 1 [0251.991] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0251.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0251.991] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0251.991] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.991] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0251.991] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0251.991] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987\\temporaryfile")) returned 1 [0251.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b238480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b238480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b238480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0251.991] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0251.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18320987" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18320987")) returned 1 [0251.992] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 0 [0251.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.019] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca950*, nNumberOfBytesToWrite=0x2238, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca950*, lpNumberOfBytesWritten=0x18fdd8*=0x2238, lpOverlapped=0x0) returned 1 [0252.020] CloseHandle (hObject=0xdc) returned 1 [0252.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.021] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe392 [0252.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe39a) returned 0x2c8700 [0252.022] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xe392, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xe392, lpOverlapped=0x0) returned 1 [0252.023] CloseHandle (hObject=0xdc) returned 1 [0252.023] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0252.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.024] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.024] GetTickCount () returned 0x4e60a [0252.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.024] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.025] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034\\....\\temporaryfile")) returned 0 [0252.025] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034\\temporaryfile")) returned 1 [0252.027] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.027] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.027] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.027] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.027] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.027] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.027] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.027] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034\\temporaryfile")) returned 1 [0252.027] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.027] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.028] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034")) returned 1 [0252.028] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 0 [0252.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.029] WriteFile (in: hFile=0xdc, lpBuffer=0x2d6ab0*, nNumberOfBytesToWrite=0xe398, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d6ab0*, lpNumberOfBytesWritten=0x18fdd8*=0xe398, lpOverlapped=0x0) returned 1 [0252.031] CloseHandle (hObject=0xdc) returned 1 [0252.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.032] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9114 [0252.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x911c) returned 0x2c8700 [0252.032] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x9114, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x9114, lpOverlapped=0x0) returned 1 [0252.033] CloseHandle (hObject=0xdc) returned 1 [0252.033] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0252.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.034] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.034] GetTickCount () returned 0x4e60a [0252.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.035] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034\\....\\temporaryfile")) returned 0 [0252.036] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034\\temporaryfile")) returned 1 [0252.037] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.037] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.037] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.037] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.037] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.037] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.037] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034\\temporaryfile")) returned 1 [0252.038] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2aa8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2aa8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2aa8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.038] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321034" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321034")) returned 1 [0252.038] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 0 [0252.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.039] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1830*, nNumberOfBytesToWrite=0x9118, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1830*, lpNumberOfBytesWritten=0x18fdd8*=0x9118, lpOverlapped=0x0) returned 1 [0252.040] CloseHandle (hObject=0xdc) returned 1 [0252.041] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.041] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1846 [0252.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x184e) returned 0x2c4a70 [0252.041] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1846, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1846, lpOverlapped=0x0) returned 1 [0252.042] CloseHandle (hObject=0xdc) returned 1 [0252.043] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0252.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.043] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.043] GetTickCount () returned 0x4e61a [0252.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.044] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321050\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321050\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321050\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321050\\....\\temporaryfile")) returned 0 [0252.045] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321050\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321050\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321050\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321050\\temporaryfile")) returned 1 [0252.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321050\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2d0a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2d0a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2d0a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.046] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2d0a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2d0a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2d0a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.046] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2d0a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2d0a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2d0a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321050\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2d0a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2d0a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2d0a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.046] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2d0a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2d0a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2d0a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.046] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2d0a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2d0a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2d0a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.046] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.046] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321050\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321050\\temporaryfile")) returned 1 [0252.047] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2d0a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2d0a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2d0a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.047] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321050" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321050")) returned 1 [0252.047] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 0 [0252.047] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.048] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1850, lpOverlapped=0x0) returned 1 [0252.048] CloseHandle (hObject=0xdc) returned 1 [0252.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.050] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2610 [0252.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2618) returned 0x2c8700 [0252.050] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2610, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2610, lpOverlapped=0x0) returned 1 [0252.051] CloseHandle (hObject=0xdc) returned 1 [0252.051] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0252.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.052] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.052] GetTickCount () returned 0x4e629 [0252.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.053] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065\\....\\temporaryfile")) returned 0 [0252.053] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065\\temporaryfile")) returned 1 [0252.054] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.055] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.055] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.055] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.055] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.055] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065\\temporaryfile")) returned 1 [0252.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.055] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.055] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065")) returned 1 [0252.055] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 0 [0252.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.056] WriteFile (in: hFile=0xdc, lpBuffer=0x2cad28*, nNumberOfBytesToWrite=0x2618, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cad28*, lpNumberOfBytesWritten=0x18fdd8*=0x2618, lpOverlapped=0x0) returned 1 [0252.057] CloseHandle (hObject=0xdc) returned 1 [0252.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.058] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9b8 [0252.058] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9c0) returned 0x2350048 [0252.058] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x9b8, lpOverlapped=0x0) returned 1 [0252.059] CloseHandle (hObject=0xdc) returned 1 [0252.059] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0252.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.060] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.060] GetTickCount () returned 0x4e629 [0252.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.061] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065\\....\\temporaryfile")) returned 0 [0252.062] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065\\temporaryfile")) returned 1 [0252.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.064] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.064] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.064] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.064] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065\\temporaryfile")) returned 1 [0252.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b2f6b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b2f6b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b2f6b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.064] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.065] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321065" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321065")) returned 1 [0252.065] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 0 [0252.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.066] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x9c0, lpOverlapped=0x0) returned 1 [0252.067] CloseHandle (hObject=0xdc) returned 1 [0252.068] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.068] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x150a [0252.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1512) returned 0x29b460 [0252.068] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x150a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x150a, lpOverlapped=0x0) returned 1 [0252.070] CloseHandle (hObject=0xdc) returned 1 [0252.070] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0252.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.071] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.071] GetTickCount () returned 0x4e639 [0252.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.071] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.072] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081\\....\\temporaryfile")) returned 0 [0252.072] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081\\temporaryfile")) returned 1 [0252.073] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.073] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.073] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.073] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.073] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.073] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.073] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.073] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081\\temporaryfile")) returned 1 [0252.074] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.074] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.074] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081")) returned 1 [0252.074] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 0 [0252.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.075] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1510, lpOverlapped=0x0) returned 1 [0252.075] CloseHandle (hObject=0xdc) returned 1 [0252.076] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.077] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe16 [0252.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe1e) returned 0x2350048 [0252.077] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe16, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe16, lpOverlapped=0x0) returned 1 [0252.078] CloseHandle (hObject=0xdc) returned 1 [0252.078] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0252.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.079] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.079] GetTickCount () returned 0x4e639 [0252.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.080] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.080] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081\\....\\temporaryfile")) returned 0 [0252.080] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081\\temporaryfile")) returned 1 [0252.081] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.081] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.082] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.082] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.082] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.082] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.082] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.082] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081\\temporaryfile")) returned 1 [0252.082] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b31ccc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b31ccc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b31ccc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.082] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.082] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321081" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321081")) returned 1 [0252.082] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 0 [0252.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.083] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe20, lpOverlapped=0x0) returned 1 [0252.084] CloseHandle (hObject=0xdc) returned 1 [0252.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.085] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x23c2 [0252.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23ca) returned 0x2c8700 [0252.085] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x23c2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x23c2, lpOverlapped=0x0) returned 1 [0252.086] CloseHandle (hObject=0xdc) returned 1 [0252.086] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0252.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.087] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.087] GetTickCount () returned 0x4e648 [0252.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.088] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096\\....\\temporaryfile")) returned 0 [0252.088] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096\\temporaryfile")) returned 1 [0252.089] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.090] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.090] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.090] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.090] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096\\temporaryfile")) returned 1 [0252.090] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.090] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096")) returned 1 [0252.090] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 0 [0252.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.091] WriteFile (in: hFile=0xdc, lpBuffer=0x2caae0*, nNumberOfBytesToWrite=0x23c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caae0*, lpNumberOfBytesWritten=0x18fdd8*=0x23c8, lpOverlapped=0x0) returned 1 [0252.092] CloseHandle (hObject=0xdc) returned 1 [0252.092] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.093] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd42 [0252.093] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd4a) returned 0x2350048 [0252.093] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd42, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd42, lpOverlapped=0x0) returned 1 [0252.094] CloseHandle (hObject=0xdc) returned 1 [0252.094] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0252.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.095] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.095] GetTickCount () returned 0x4e648 [0252.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.096] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096\\....\\temporaryfile")) returned 0 [0252.097] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096\\temporaryfile")) returned 1 [0252.099] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.099] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.099] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.099] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.099] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.099] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.099] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.099] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096\\temporaryfile")) returned 1 [0252.100] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b342e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b342e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b342e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.100] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.100] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321096" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321096")) returned 1 [0252.100] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 0 [0252.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.101] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd48, lpOverlapped=0x0) returned 1 [0252.102] CloseHandle (hObject=0xdc) returned 1 [0252.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.103] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4ae [0252.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4b6) returned 0x259e70 [0252.103] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4ae, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x4ae, lpOverlapped=0x0) returned 1 [0252.104] CloseHandle (hObject=0xdc) returned 1 [0252.104] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0252.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.105] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.105] GetTickCount () returned 0x4e658 [0252.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.106] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112\\....\\temporaryfile")) returned 0 [0252.106] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112\\temporaryfile")) returned 1 [0252.107] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.107] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.107] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.107] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.108] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.108] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.108] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.108] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112\\temporaryfile")) returned 1 [0252.108] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.108] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.108] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112")) returned 1 [0252.108] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 0 [0252.108] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.109] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x4b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x4b8, lpOverlapped=0x0) returned 1 [0252.110] CloseHandle (hObject=0xdc) returned 1 [0252.110] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.110] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf00 [0252.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf08) returned 0x2350048 [0252.110] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xf00, lpOverlapped=0x0) returned 1 [0252.112] CloseHandle (hObject=0xdc) returned 1 [0252.112] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0252.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.113] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.113] GetTickCount () returned 0x4e658 [0252.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.113] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.114] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112\\....\\temporaryfile")) returned 0 [0252.114] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112\\temporaryfile")) returned 1 [0252.115] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.115] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.115] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.115] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.116] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.116] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.116] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.116] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112\\temporaryfile")) returned 1 [0252.116] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b368f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b368f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b368f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.116] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.116] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321112" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321112")) returned 1 [0252.116] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 0 [0252.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.118] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xf08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xf08, lpOverlapped=0x0) returned 1 [0252.118] CloseHandle (hObject=0xdc) returned 1 [0252.119] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.120] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1352 [0252.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x135a) returned 0x25b528 [0252.120] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1352, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1352, lpOverlapped=0x0) returned 1 [0252.121] CloseHandle (hObject=0xdc) returned 1 [0252.121] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0252.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.122] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.122] GetTickCount () returned 0x4e668 [0252.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.123] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321128\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321128\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321128\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321128\\....\\temporaryfile")) returned 0 [0252.123] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321128\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321128\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321128\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321128\\temporaryfile")) returned 1 [0252.124] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321128\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b38f0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b38f0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b38f0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.124] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b38f0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b38f0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b38f0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.125] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b38f0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b38f0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b38f0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.125] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321128\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b38f0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b38f0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b38f0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.125] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b38f0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b38f0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b38f0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.125] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b38f0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b38f0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b38f0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.125] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321128\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321128\\temporaryfile")) returned 1 [0252.125] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b38f0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b38f0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b38f0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.125] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321128" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321128")) returned 1 [0252.125] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 0 [0252.126] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.126] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1358, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1358, lpOverlapped=0x0) returned 1 [0252.127] CloseHandle (hObject=0xdc) returned 1 [0252.128] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.128] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1016 [0252.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x101e) returned 0x25b528 [0252.128] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1016, lpOverlapped=0x0) returned 1 [0252.130] CloseHandle (hObject=0xdc) returned 1 [0252.130] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0252.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.131] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.131] GetTickCount () returned 0x4e677 [0252.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.132] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143\\....\\temporaryfile")) returned 0 [0252.133] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143\\temporaryfile")) returned 1 [0252.137] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.137] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.137] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.137] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.137] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.138] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.138] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.138] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143\\temporaryfile")) returned 1 [0252.138] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.138] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.138] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143")) returned 1 [0252.138] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 0 [0252.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.139] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1020, lpOverlapped=0x0) returned 1 [0252.140] CloseHandle (hObject=0xdc) returned 1 [0252.141] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.141] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcd2 [0252.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcda) returned 0x2350048 [0252.141] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xcd2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xcd2, lpOverlapped=0x0) returned 1 [0252.143] CloseHandle (hObject=0xdc) returned 1 [0252.143] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0252.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.144] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.144] GetTickCount () returned 0x4e677 [0252.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.144] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143\\....\\temporaryfile")) returned 0 [0252.145] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143\\temporaryfile")) returned 1 [0252.146] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.146] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.146] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.146] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.146] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.147] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.147] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.147] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143\\temporaryfile")) returned 1 [0252.147] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3b5240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3b5240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3b5240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.147] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.147] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321143" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321143")) returned 1 [0252.147] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 0 [0252.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.148] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xcd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xcd8, lpOverlapped=0x0) returned 1 [0252.149] CloseHandle (hObject=0xdc) returned 1 [0252.149] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.149] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4162 [0252.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x416a) returned 0x2c8700 [0252.149] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4162, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4162, lpOverlapped=0x0) returned 1 [0252.151] CloseHandle (hObject=0xdc) returned 1 [0252.151] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0252.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.152] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.152] GetTickCount () returned 0x4e687 [0252.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.153] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321159\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321159\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.153] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321159\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321159\\....\\temporaryfile")) returned 0 [0252.153] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321159\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321159\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321159\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321159\\temporaryfile")) returned 1 [0252.156] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321159\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3db3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3db3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3db3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.156] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3db3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3db3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3db3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.156] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3db3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3db3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3db3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.156] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321159\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3db3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3db3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3db3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.156] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3db3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3db3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3db3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.156] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3db3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3db3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3db3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.156] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.157] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321159\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321159\\temporaryfile")) returned 1 [0252.157] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b3db3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b3db3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b3db3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.157] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.157] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321159" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321159")) returned 1 [0252.157] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 0 [0252.157] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.158] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc880*, nNumberOfBytesToWrite=0x4168, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc880*, lpNumberOfBytesWritten=0x18fdd8*=0x4168, lpOverlapped=0x0) returned 1 [0252.159] CloseHandle (hObject=0xdc) returned 1 [0252.159] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.160] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5fd0 [0252.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5fd8) returned 0x2c8700 [0252.160] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5fd0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5fd0, lpOverlapped=0x0) returned 1 [0252.161] CloseHandle (hObject=0xdc) returned 1 [0252.161] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0252.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.162] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.162] GetTickCount () returned 0x4e696 [0252.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.163] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174\\....\\temporaryfile")) returned 0 [0252.163] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174\\temporaryfile")) returned 1 [0252.165] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.165] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.165] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.165] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.165] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.165] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.165] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.165] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174\\temporaryfile")) returned 1 [0252.165] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.165] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.165] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174")) returned 1 [0252.165] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 0 [0252.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.167] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce6e8*, nNumberOfBytesToWrite=0x5fd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce6e8*, lpNumberOfBytesWritten=0x18fdd8*=0x5fd8, lpOverlapped=0x0) returned 1 [0252.168] CloseHandle (hObject=0xdc) returned 1 [0252.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.168] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2378 [0252.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2380) returned 0x2c8700 [0252.168] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2378, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2378, lpOverlapped=0x0) returned 1 [0252.170] CloseHandle (hObject=0xdc) returned 1 [0252.170] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0252.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.171] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.171] GetTickCount () returned 0x4e696 [0252.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.172] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174\\....\\temporaryfile")) returned 0 [0252.173] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174\\temporaryfile")) returned 1 [0252.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.175] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.175] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.175] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.175] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174\\temporaryfile")) returned 1 [0252.175] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b401500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b401500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b401500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.175] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.175] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321174" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321174")) returned 1 [0252.176] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 0 [0252.176] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.177] WriteFile (in: hFile=0xdc, lpBuffer=0x2caa90*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caa90*, lpNumberOfBytesWritten=0x18fdd8*=0x2380, lpOverlapped=0x0) returned 1 [0252.178] CloseHandle (hObject=0xdc) returned 1 [0252.178] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.179] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f8c [0252.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f94) returned 0x2c8700 [0252.179] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f8c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f8c, lpOverlapped=0x0) returned 1 [0252.180] CloseHandle (hObject=0xdc) returned 1 [0252.181] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0252.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.181] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.181] GetTickCount () returned 0x4e6a6 [0252.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.182] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321190\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321190\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321190\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321190\\....\\temporaryfile")) returned 0 [0252.183] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321190\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321190\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321190\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321190\\temporaryfile")) returned 1 [0252.184] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321190\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b427660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b427660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b427660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.184] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b427660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b427660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b427660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.184] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b427660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b427660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b427660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.184] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321190\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b427660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b427660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b427660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.184] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b427660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b427660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b427660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.184] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b427660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b427660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b427660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.184] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321190\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321190\\temporaryfile")) returned 1 [0252.184] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b427660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b427660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b427660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.184] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321190" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321190")) returned 1 [0252.185] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 0 [0252.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.185] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca6a8*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca6a8*, lpNumberOfBytesWritten=0x18fdd8*=0x1f90, lpOverlapped=0x0) returned 1 [0252.186] CloseHandle (hObject=0xdc) returned 1 [0252.186] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.195] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xab74 [0252.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xab7c) returned 0x2c8700 [0252.195] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xab74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xab74, lpOverlapped=0x0) returned 1 [0252.196] CloseHandle (hObject=0xdc) returned 1 [0252.196] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0252.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.197] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.197] GetTickCount () returned 0x4e6b6 [0252.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.198] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206\\....\\temporaryfile")) returned 0 [0252.198] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206\\temporaryfile")) returned 1 [0252.200] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b44d7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b44d7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b44d7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.200] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b44d7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b44d7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b44d7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.200] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b44d7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b44d7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b44d7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.200] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b44d7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b44d7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b44d7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.200] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b44d7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b44d7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b44d7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.200] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b44d7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b44d7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b44d7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.200] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.200] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206\\temporaryfile")) returned 1 [0252.201] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b44d7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b44d7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b44d7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.201] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.201] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206")) returned 1 [0252.201] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 0 [0252.202] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.202] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3290*, nNumberOfBytesToWrite=0xab78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3290*, lpNumberOfBytesWritten=0x18fdd8*=0xab78, lpOverlapped=0x0) returned 1 [0252.204] CloseHandle (hObject=0xdc) returned 1 [0252.204] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.204] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf39f [0252.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf3a7) returned 0x2c8700 [0252.204] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xf39f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xf39f, lpOverlapped=0x0) returned 1 [0252.206] CloseHandle (hObject=0xdc) returned 1 [0252.206] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0252.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.207] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.207] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.208] GetTickCount () returned 0x4e6b6 [0252.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.209] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206\\....\\temporaryfile")) returned 0 [0252.210] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206\\temporaryfile")) returned 1 [0252.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b44d7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.212] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b44d7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.212] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.212] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.212] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.212] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.212] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206\\temporaryfile")) returned 1 [0252.212] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.212] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321206" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321206")) returned 1 [0252.213] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 0 [0252.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.215] WriteFile (in: hFile=0xdc, lpBuffer=0x2d7ab8*, nNumberOfBytesToWrite=0xf3a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d7ab8*, lpNumberOfBytesWritten=0x18fdd8*=0xf3a8, lpOverlapped=0x0) returned 1 [0252.216] CloseHandle (hObject=0xdc) returned 1 [0252.217] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.217] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x462c [0252.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4634) returned 0x2c8700 [0252.217] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x462c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x462c, lpOverlapped=0x0) returned 1 [0252.219] CloseHandle (hObject=0xdc) returned 1 [0252.219] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0252.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.220] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.220] GetTickCount () returned 0x4e6c5 [0252.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.220] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321221\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321221\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.221] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321221\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321221\\....\\temporaryfile")) returned 0 [0252.221] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321221\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321221\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321221\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321221\\temporaryfile")) returned 1 [0252.222] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321221\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.222] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.222] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.222] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321221\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.222] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.223] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.223] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.223] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321221\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321221\\temporaryfile")) returned 1 [0252.223] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b473920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b473920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b473920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.223] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.223] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321221" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321221")) returned 1 [0252.223] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 0 [0252.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.224] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccd48*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccd48*, lpNumberOfBytesWritten=0x18fdd8*=0x4630, lpOverlapped=0x0) returned 1 [0252.225] CloseHandle (hObject=0xdc) returned 1 [0252.225] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.226] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8ada [0252.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8ae2) returned 0x2c8700 [0252.226] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8ada, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8ada, lpOverlapped=0x0) returned 1 [0252.227] CloseHandle (hObject=0xdc) returned 1 [0252.227] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0252.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.228] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.228] GetTickCount () returned 0x4e6d5 [0252.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.229] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237\\....\\temporaryfile")) returned 0 [0252.229] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237\\temporaryfile")) returned 1 [0252.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.231] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.231] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.231] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.231] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237\\temporaryfile")) returned 1 [0252.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.231] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.231] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237")) returned 1 [0252.231] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 0 [0252.232] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.233] WriteFile (in: hFile=0xdc, lpBuffer=0x2d11f8*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d11f8*, lpNumberOfBytesWritten=0x18fdd8*=0x8ae0, lpOverlapped=0x0) returned 1 [0252.234] CloseHandle (hObject=0xdc) returned 1 [0252.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.235] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x62b1 [0252.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x62b9) returned 0x2c8700 [0252.235] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x62b1, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x62b1, lpOverlapped=0x0) returned 1 [0252.236] CloseHandle (hObject=0xdc) returned 1 [0252.236] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0252.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.237] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.237] GetTickCount () returned 0x4e6d5 [0252.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.238] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237\\....\\temporaryfile")) returned 0 [0252.239] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237\\temporaryfile")) returned 1 [0252.259] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.260] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.260] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.260] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.260] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.260] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237\\temporaryfile")) returned 1 [0252.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b499a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b499a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b499a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.260] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.260] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321237" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321237")) returned 1 [0252.260] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 0 [0252.261] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.262] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce9d0*, nNumberOfBytesToWrite=0x62b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce9d0*, lpNumberOfBytesWritten=0x18fdd8*=0x62b8, lpOverlapped=0x0) returned 1 [0252.263] CloseHandle (hObject=0xdc) returned 1 [0252.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.264] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4dd3 [0252.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4ddb) returned 0x2c8700 [0252.264] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4dd3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4dd3, lpOverlapped=0x0) returned 1 [0252.266] CloseHandle (hObject=0xdc) returned 1 [0252.266] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0252.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.267] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.267] GetTickCount () returned 0x4e6f4 [0252.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.268] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321268\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321268\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321268\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321268\\....\\temporaryfile")) returned 0 [0252.268] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321268\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321268\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321268\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321268\\temporaryfile")) returned 1 [0252.269] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321268\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b4e5d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b4e5d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b4e5d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.270] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b4e5d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b4e5d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b4e5d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.270] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b4e5d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b4e5d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b4e5d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.270] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321268\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b4e5d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b4e5d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b4e5d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.270] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b4e5d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b4e5d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b4e5d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.270] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b4e5d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b4e5d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b4e5d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.270] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.270] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321268\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321268\\temporaryfile")) returned 1 [0252.270] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b4e5d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b4e5d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b4e5d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.270] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.270] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321268" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321268")) returned 1 [0252.270] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 0 [0252.271] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.272] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd4f0*, nNumberOfBytesToWrite=0x4dd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd4f0*, lpNumberOfBytesWritten=0x18fdd8*=0x4dd8, lpOverlapped=0x0) returned 1 [0252.273] CloseHandle (hObject=0xdc) returned 1 [0252.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.274] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3801 [0252.274] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3809) returned 0x2c8700 [0252.274] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3801, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3801, lpOverlapped=0x0) returned 1 [0252.275] CloseHandle (hObject=0xdc) returned 1 [0252.275] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0252.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.276] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.276] GetTickCount () returned 0x4e704 [0252.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.277] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.277] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284\\....\\temporaryfile")) returned 0 [0252.277] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284\\temporaryfile")) returned 1 [0252.279] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.279] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.279] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.279] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.279] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.279] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.279] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.279] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284\\temporaryfile")) returned 1 [0252.279] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.279] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.279] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284")) returned 1 [0252.280] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 0 [0252.280] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.280] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbf20*, nNumberOfBytesToWrite=0x3808, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbf20*, lpNumberOfBytesWritten=0x18fdd8*=0x3808, lpOverlapped=0x0) returned 1 [0252.281] CloseHandle (hObject=0xdc) returned 1 [0252.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.282] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a92 [0252.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a9a) returned 0x2c8700 [0252.282] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2a92, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2a92, lpOverlapped=0x0) returned 1 [0252.283] CloseHandle (hObject=0xdc) returned 1 [0252.284] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0252.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.284] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.285] GetTickCount () returned 0x4e704 [0252.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.285] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284\\....\\temporaryfile")) returned 0 [0252.286] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284\\temporaryfile")) returned 1 [0252.287] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.287] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.287] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.287] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.287] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.287] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.287] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.287] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284\\temporaryfile")) returned 1 [0252.288] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b50bea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b50bea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b50bea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.288] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.288] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321284" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321284")) returned 1 [0252.288] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 0 [0252.288] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.289] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb1b0*, nNumberOfBytesToWrite=0x2a98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb1b0*, lpNumberOfBytesWritten=0x18fdd8*=0x2a98, lpOverlapped=0x0) returned 1 [0252.290] CloseHandle (hObject=0xdc) returned 1 [0252.290] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.290] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x148b [0252.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1493) returned 0x29b460 [0252.290] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x148b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x148b, lpOverlapped=0x0) returned 1 [0252.292] CloseHandle (hObject=0xdc) returned 1 [0252.292] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0252.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.293] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.293] GetTickCount () returned 0x4e713 [0252.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.293] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299\\....\\temporaryfile")) returned 0 [0252.294] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299\\temporaryfile")) returned 1 [0252.295] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b532000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b532000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b532000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.295] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b532000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b532000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b532000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.295] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b532000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b532000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b532000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.295] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b532000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b532000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b532000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.296] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b532000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b532000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b532000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.296] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b532000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b532000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b532000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.296] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.296] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299\\temporaryfile")) returned 1 [0252.296] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b532000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b532000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b532000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.296] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.296] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299")) returned 1 [0252.296] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 0 [0252.296] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.297] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1490, lpOverlapped=0x0) returned 1 [0252.298] CloseHandle (hObject=0xdc) returned 1 [0252.298] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.298] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x84b7 [0252.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x84bf) returned 0x2c8700 [0252.298] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x84b7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x84b7, lpOverlapped=0x0) returned 1 [0252.300] CloseHandle (hObject=0xdc) returned 1 [0252.300] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0252.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.301] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.301] GetTickCount () returned 0x4e713 [0252.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.306] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.306] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299\\....\\temporaryfile")) returned 0 [0252.306] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299\\temporaryfile")) returned 1 [0252.308] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b532000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.308] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b532000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.308] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.308] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.308] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.308] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.308] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.308] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299\\temporaryfile")) returned 1 [0252.309] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.309] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.309] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321299" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321299")) returned 1 [0252.309] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 0 [0252.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.311] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0bd0*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0bd0*, lpNumberOfBytesWritten=0x18fdd8*=0x84c0, lpOverlapped=0x0) returned 1 [0252.312] CloseHandle (hObject=0xdc) returned 1 [0252.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.313] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x409f [0252.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40a7) returned 0x2c8700 [0252.314] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x409f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x409f, lpOverlapped=0x0) returned 1 [0252.315] CloseHandle (hObject=0xdc) returned 1 [0252.315] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0252.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.316] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.316] GetTickCount () returned 0x4e723 [0252.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.317] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321315\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321315\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.317] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321315\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321315\\....\\temporaryfile")) returned 0 [0252.317] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321315\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321315\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321315\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321315\\temporaryfile")) returned 1 [0252.318] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321315\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b57e2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b57e2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b57e2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b57e2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.319] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.319] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321315\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.319] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.319] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.319] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.319] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321315\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321315\\temporaryfile")) returned 1 [0252.319] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b558160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b558160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b558160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.319] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.319] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321315" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321315")) returned 1 [0252.319] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 0 [0252.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.320] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc7b8*, nNumberOfBytesToWrite=0x40a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc7b8*, lpNumberOfBytesWritten=0x18fdd8*=0x40a8, lpOverlapped=0x0) returned 1 [0252.321] CloseHandle (hObject=0xdc) returned 1 [0252.321] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.322] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc8c9 [0252.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc8d1) returned 0x2c8700 [0252.322] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xc8c9, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xc8c9, lpOverlapped=0x0) returned 1 [0252.323] CloseHandle (hObject=0xdc) returned 1 [0252.323] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0252.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.325] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.325] GetTickCount () returned 0x4e732 [0252.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.325] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321330\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.326] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321330\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321330\\....\\temporaryfile")) returned 0 [0252.326] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321330\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321330\\temporaryfile")) returned 1 [0252.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321330\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b57e2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b57e2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b57e2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.327] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b57e2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b57e2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b57e2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.327] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b57e2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b57e2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b57e2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321330\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b57e2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b57e2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b57e2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b57e2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b57e2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b57e2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b57e2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b57e2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b57e2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.327] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.327] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321330\\temporaryfile")) returned 1 [0252.328] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b57e2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b57e2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b57e2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.328] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.328] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321330" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321330")) returned 1 [0252.328] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 0 [0252.329] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.329] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4fe8*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4fe8*, lpNumberOfBytesWritten=0x18fdd8*=0xc8d0, lpOverlapped=0x0) returned 1 [0252.331] CloseHandle (hObject=0xdc) returned 1 [0252.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.331] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1367 [0252.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x136f) returned 0x25b528 [0252.331] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1367, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1367, lpOverlapped=0x0) returned 1 [0252.333] CloseHandle (hObject=0xdc) returned 1 [0252.333] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0252.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.334] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.334] GetTickCount () returned 0x4e742 [0252.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.335] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.335] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346\\....\\temporaryfile")) returned 0 [0252.335] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346\\temporaryfile")) returned 1 [0252.336] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.336] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.336] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.336] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.336] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.337] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.337] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.337] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346\\temporaryfile")) returned 1 [0252.337] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.337] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.337] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346")) returned 1 [0252.337] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 0 [0252.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.338] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1370, lpOverlapped=0x0) returned 1 [0252.339] CloseHandle (hObject=0xdc) returned 1 [0252.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.339] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf40 [0252.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf48) returned 0x2350048 [0252.339] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xf40, lpOverlapped=0x0) returned 1 [0252.341] CloseHandle (hObject=0xdc) returned 1 [0252.341] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0252.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.342] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.342] GetTickCount () returned 0x4e742 [0252.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.343] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346\\....\\temporaryfile")) returned 0 [0252.344] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346\\temporaryfile")) returned 1 [0252.345] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.345] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.345] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.345] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.345] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.346] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.346] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.346] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346\\temporaryfile")) returned 1 [0252.346] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5a4420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5a4420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5a4420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.346] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.346] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321346" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321346")) returned 1 [0252.346] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 0 [0252.347] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.347] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xf48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xf48, lpOverlapped=0x0) returned 1 [0252.348] CloseHandle (hObject=0xdc) returned 1 [0252.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.352] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x45be [0252.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x45c6) returned 0x2c8700 [0252.352] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x45be, lpOverlapped=0x0) returned 1 [0252.354] CloseHandle (hObject=0xdc) returned 1 [0252.354] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0252.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.355] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.355] GetTickCount () returned 0x4e752 [0252.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.355] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362\\....\\temporaryfile")) returned 0 [0252.356] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362\\temporaryfile")) returned 1 [0252.357] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.357] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.357] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.357] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.357] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.357] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.357] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.358] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362\\temporaryfile")) returned 1 [0252.358] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.358] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.358] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362")) returned 1 [0252.358] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 0 [0252.358] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.359] WriteFile (in: hFile=0xdc, lpBuffer=0x2cccd8*, nNumberOfBytesToWrite=0x45c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cccd8*, lpNumberOfBytesWritten=0x18fdd8*=0x45c8, lpOverlapped=0x0) returned 1 [0252.360] CloseHandle (hObject=0xdc) returned 1 [0252.360] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.361] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x45be [0252.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x45c6) returned 0x2c8700 [0252.361] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x45be, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x45be, lpOverlapped=0x0) returned 1 [0252.362] CloseHandle (hObject=0xdc) returned 1 [0252.362] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0252.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.363] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.363] GetTickCount () returned 0x4e752 [0252.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.364] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.364] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362\\....\\temporaryfile")) returned 0 [0252.365] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362\\temporaryfile")) returned 1 [0252.366] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5f06e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5f06e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.366] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5f06e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5f06e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.366] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.366] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.366] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.366] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.366] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.366] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362\\temporaryfile")) returned 1 [0252.366] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5ca580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5ca580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5ca580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.366] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.366] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321362" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321362")) returned 1 [0252.367] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 0 [0252.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.368] WriteFile (in: hFile=0xdc, lpBuffer=0x2cccd8*, nNumberOfBytesToWrite=0x45c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cccd8*, lpNumberOfBytesWritten=0x18fdd8*=0x45c8, lpOverlapped=0x0) returned 1 [0252.369] CloseHandle (hObject=0xdc) returned 1 [0252.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.370] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x133f8 [0252.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13400) returned 0x2c8700 [0252.370] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x133f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x133f8, lpOverlapped=0x0) returned 1 [0252.372] CloseHandle (hObject=0xdc) returned 1 [0252.372] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0252.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.373] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.373] GetTickCount () returned 0x4e761 [0252.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.374] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321377\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321377\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321377\\....\\temporaryfile")) returned 0 [0252.374] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321377\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321377\\temporaryfile")) returned 1 [0252.375] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321377\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5f06e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5f06e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5f06e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.376] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5f06e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5f06e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5f06e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.376] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5f06e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5f06e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5f06e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.376] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321377\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5f06e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5f06e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5f06e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.376] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5f06e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5f06e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5f06e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.376] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5f06e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5f06e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5f06e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.376] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.376] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321377\\temporaryfile")) returned 1 [0252.376] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b5f06e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b5f06e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b5f06e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.376] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.376] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321377" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321377")) returned 1 [0252.376] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 0 [0252.378] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.378] WriteFile (in: hFile=0xdc, lpBuffer=0x2dbb10*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2dbb10*, lpNumberOfBytesWritten=0x18fdd8*=0x13400, lpOverlapped=0x0) returned 1 [0252.380] CloseHandle (hObject=0xdc) returned 1 [0252.380] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.381] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0252.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0252.381] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0252.382] CloseHandle (hObject=0xdc) returned 1 [0252.382] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0252.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.383] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.383] GetTickCount () returned 0x4e771 [0252.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.384] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393\\....\\temporaryfile")) returned 0 [0252.385] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393\\temporaryfile")) returned 1 [0252.386] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.386] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.386] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.386] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.386] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.386] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.386] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.386] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393\\temporaryfile")) returned 1 [0252.386] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.386] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.386] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393")) returned 1 [0252.386] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 0 [0252.387] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.388] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0252.389] CloseHandle (hObject=0xdc) returned 1 [0252.389] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.389] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0252.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0252.390] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0252.391] CloseHandle (hObject=0xdc) returned 1 [0252.391] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0252.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.392] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.392] GetTickCount () returned 0x4e771 [0252.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.393] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393\\....\\temporaryfile")) returned 0 [0252.393] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393\\temporaryfile")) returned 1 [0252.394] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.394] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.395] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.395] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.395] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.395] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.395] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393\\temporaryfile")) returned 1 [0252.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b616840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b616840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b616840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.395] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.395] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321393" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321393")) returned 1 [0252.395] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 0 [0252.396] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.397] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0252.398] CloseHandle (hObject=0xdc) returned 1 [0252.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.398] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0252.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0252.398] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0252.400] CloseHandle (hObject=0xdc) returned 1 [0252.400] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0252.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.401] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.401] GetTickCount () returned 0x4e780 [0252.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.402] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408\\....\\temporaryfile")) returned 0 [0252.402] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408\\temporaryfile")) returned 1 [0252.403] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.404] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.404] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.404] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.404] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.404] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.404] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.404] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408\\temporaryfile")) returned 1 [0252.404] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.404] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.404] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408")) returned 1 [0252.404] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 0 [0252.405] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.406] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0252.407] CloseHandle (hObject=0xdc) returned 1 [0252.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.407] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0252.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0252.407] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0252.409] CloseHandle (hObject=0xdc) returned 1 [0252.409] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0252.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.410] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.410] GetTickCount () returned 0x4e780 [0252.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.411] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408\\....\\temporaryfile")) returned 0 [0252.411] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408\\temporaryfile")) returned 1 [0252.413] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b662b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b662b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b662b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b662b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.413] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.413] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.413] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.413] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.413] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408\\temporaryfile")) returned 1 [0252.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b63c9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b63c9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b63c9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.413] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.413] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321408" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321408")) returned 1 [0252.413] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 0 [0252.414] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.415] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0252.416] CloseHandle (hObject=0xdc) returned 1 [0252.416] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.417] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0252.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0252.417] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0252.419] CloseHandle (hObject=0xdc) returned 1 [0252.419] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0252.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.420] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.420] GetTickCount () returned 0x4e790 [0252.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.420] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321424\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321424\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.421] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321424\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321424\\....\\temporaryfile")) returned 0 [0252.421] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321424\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321424\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321424\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321424\\temporaryfile")) returned 1 [0252.422] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321424\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b662b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b662b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b662b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.422] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b662b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b662b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b662b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.422] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b662b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b662b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b662b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.422] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321424\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b662b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b662b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b662b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b662b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b662b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b662b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b662b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b662b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b662b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.423] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321424\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321424\\temporaryfile")) returned 1 [0252.423] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b662b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b662b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b662b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.423] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321424" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321424")) returned 1 [0252.423] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 0 [0252.424] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.424] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0252.426] CloseHandle (hObject=0xdc) returned 1 [0252.426] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.426] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0252.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0252.426] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0252.428] CloseHandle (hObject=0xdc) returned 1 [0252.428] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0252.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.429] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.429] GetTickCount () returned 0x4e7a0 [0252.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.430] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440\\....\\temporaryfile")) returned 0 [0252.430] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440\\temporaryfile")) returned 1 [0252.431] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.431] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.431] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.431] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.431] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.432] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.432] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.432] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440\\temporaryfile")) returned 1 [0252.432] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.432] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.432] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440")) returned 1 [0252.432] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 0 [0252.433] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.433] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0252.434] CloseHandle (hObject=0xdc) returned 1 [0252.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.435] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0252.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0252.435] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0252.437] CloseHandle (hObject=0xdc) returned 1 [0252.437] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0252.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.438] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.438] GetTickCount () returned 0x4e7a0 [0252.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.438] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440\\....\\temporaryfile")) returned 0 [0252.439] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440\\temporaryfile")) returned 1 [0252.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6aedc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6aedc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6aedc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6aedc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.444] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.444] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440\\temporaryfile")) returned 1 [0252.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b688c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b688c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b688c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.444] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.444] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321440" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321440")) returned 1 [0252.444] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 0 [0252.445] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.446] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0252.447] CloseHandle (hObject=0xdc) returned 1 [0252.447] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.448] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0252.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0252.448] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0252.449] CloseHandle (hObject=0xdc) returned 1 [0252.449] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0252.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.450] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.450] GetTickCount () returned 0x4e7af [0252.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.451] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321455\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321455\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.451] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321455\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321455\\....\\temporaryfile")) returned 0 [0252.451] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321455\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321455\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321455\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321455\\temporaryfile")) returned 1 [0252.453] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321455\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6aedc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6aedc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6aedc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.453] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6aedc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6aedc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6aedc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.453] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6aedc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6aedc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6aedc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.453] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321455\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6aedc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6aedc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6aedc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.453] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6aedc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6aedc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6aedc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.453] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6aedc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6aedc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6aedc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.453] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.453] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321455\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321455\\temporaryfile")) returned 1 [0252.453] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6aedc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6aedc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6aedc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.453] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.453] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321455" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321455")) returned 1 [0252.453] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 0 [0252.454] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.455] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0252.456] CloseHandle (hObject=0xdc) returned 1 [0252.456] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.456] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0252.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0252.456] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0252.458] CloseHandle (hObject=0xdc) returned 1 [0252.458] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0252.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.459] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.459] GetTickCount () returned 0x4e7bf [0252.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.460] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471\\....\\temporaryfile")) returned 0 [0252.461] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471\\temporaryfile")) returned 1 [0252.462] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.463] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.463] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.463] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.463] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.463] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471\\temporaryfile")) returned 1 [0252.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.463] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.463] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471")) returned 1 [0252.464] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 0 [0252.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.465] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0252.466] CloseHandle (hObject=0xdc) returned 1 [0252.467] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.467] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0252.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0252.467] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0252.469] CloseHandle (hObject=0xdc) returned 1 [0252.469] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0252.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.470] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.470] GetTickCount () returned 0x4e7bf [0252.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.470] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471\\....\\temporaryfile")) returned 0 [0252.471] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471\\temporaryfile")) returned 1 [0252.472] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.473] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.473] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.473] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.473] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.473] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471\\temporaryfile")) returned 1 [0252.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6d4f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6d4f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6d4f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.473] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.473] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321471" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321471")) returned 1 [0252.473] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 0 [0252.474] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.474] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0252.476] CloseHandle (hObject=0xdc) returned 1 [0252.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.477] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7f68 [0252.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7f70) returned 0x2c8700 [0252.477] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7f68, lpOverlapped=0x0) returned 1 [0252.478] CloseHandle (hObject=0xdc) returned 1 [0252.478] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0252.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.479] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.479] GetTickCount () returned 0x4e7ce [0252.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.480] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321486\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321486\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321486\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321486\\....\\temporaryfile")) returned 0 [0252.480] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321486\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321486\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321486\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321486\\temporaryfile")) returned 1 [0252.482] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321486\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6fb080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6fb080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6fb080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.482] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6fb080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6fb080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6fb080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.482] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6fb080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6fb080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6fb080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.482] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321486\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6fb080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6fb080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6fb080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.482] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6fb080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6fb080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6fb080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.482] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6fb080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6fb080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6fb080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.482] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.482] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321486\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321486\\temporaryfile")) returned 1 [0252.482] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b6fb080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b6fb080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b6fb080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.482] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.482] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321486" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321486")) returned 1 [0252.483] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 0 [0252.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.484] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0680*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0680*, lpNumberOfBytesWritten=0x18fdd8*=0x7f70, lpOverlapped=0x0) returned 1 [0252.485] CloseHandle (hObject=0xdc) returned 1 [0252.486] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.487] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3ee8 [0252.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ef0) returned 0x2c8700 [0252.487] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3ee8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3ee8, lpOverlapped=0x0) returned 1 [0252.488] CloseHandle (hObject=0xdc) returned 1 [0252.488] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0252.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.489] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.489] GetTickCount () returned 0x4e7de [0252.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.490] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.490] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502\\....\\temporaryfile")) returned 0 [0252.490] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502\\temporaryfile")) returned 1 [0252.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.492] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.492] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.492] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.492] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502\\temporaryfile")) returned 1 [0252.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.492] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.492] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502")) returned 1 [0252.493] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 0 [0252.493] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.493] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc600*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc600*, lpNumberOfBytesWritten=0x18fdd8*=0x3ef0, lpOverlapped=0x0) returned 1 [0252.494] CloseHandle (hObject=0xdc) returned 1 [0252.495] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.495] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3e74 [0252.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3e7c) returned 0x2c8700 [0252.495] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3e74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3e74, lpOverlapped=0x0) returned 1 [0252.496] CloseHandle (hObject=0xdc) returned 1 [0252.497] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0252.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.498] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.498] GetTickCount () returned 0x4e7de [0252.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.499] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.500] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502\\....\\temporaryfile")) returned 0 [0252.500] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502\\temporaryfile")) returned 1 [0252.501] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.501] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.501] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.501] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.502] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.502] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.502] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.502] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502\\temporaryfile")) returned 1 [0252.502] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7211e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7211e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7211e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.502] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.502] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321502" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321502")) returned 1 [0252.502] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 0 [0252.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.504] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc590*, nNumberOfBytesToWrite=0x3e78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc590*, lpNumberOfBytesWritten=0x18fdd8*=0x3e78, lpOverlapped=0x0) returned 1 [0252.505] CloseHandle (hObject=0xdc) returned 1 [0252.505] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.506] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6978 [0252.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6980) returned 0x2c8700 [0252.506] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6978, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6978, lpOverlapped=0x0) returned 1 [0252.507] CloseHandle (hObject=0xdc) returned 1 [0252.507] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0252.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.508] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.508] GetTickCount () returned 0x4e7ee [0252.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.509] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518\\....\\temporaryfile")) returned 0 [0252.509] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518\\temporaryfile")) returned 1 [0252.510] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.510] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.511] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.511] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.511] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.511] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.511] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.511] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518\\temporaryfile")) returned 1 [0252.511] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.511] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.511] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518")) returned 1 [0252.511] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 0 [0252.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.512] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf090*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf090*, lpNumberOfBytesWritten=0x18fdd8*=0x6980, lpOverlapped=0x0) returned 1 [0252.513] CloseHandle (hObject=0xdc) returned 1 [0252.514] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.514] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2bd0 [0252.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2bd8) returned 0x2c8700 [0252.514] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2bd0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2bd0, lpOverlapped=0x0) returned 1 [0252.515] CloseHandle (hObject=0xdc) returned 1 [0252.515] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0252.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.516] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.516] GetTickCount () returned 0x4e7ee [0252.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.517] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518\\....\\temporaryfile")) returned 0 [0252.518] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518\\temporaryfile")) returned 1 [0252.519] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.519] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.519] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.519] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.519] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.519] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.520] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.520] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518\\temporaryfile")) returned 1 [0252.520] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b747340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b747340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b747340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.520] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.520] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321518" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321518")) returned 1 [0252.520] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 0 [0252.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.521] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb2e8*, nNumberOfBytesToWrite=0x2bd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb2e8*, lpNumberOfBytesWritten=0x18fdd8*=0x2bd8, lpOverlapped=0x0) returned 1 [0252.522] CloseHandle (hObject=0xdc) returned 1 [0252.522] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.523] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4290 [0252.523] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4298) returned 0x2c8700 [0252.523] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4290, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4290, lpOverlapped=0x0) returned 1 [0252.524] CloseHandle (hObject=0xdc) returned 1 [0252.524] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0252.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.525] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.525] GetTickCount () returned 0x4e7fd [0252.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.526] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533\\....\\temporaryfile")) returned 0 [0252.526] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533\\temporaryfile")) returned 1 [0252.527] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.527] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.528] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.528] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.528] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.528] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.528] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.528] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533\\temporaryfile")) returned 1 [0252.528] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.528] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.528] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533")) returned 1 [0252.528] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 0 [0252.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.529] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc9a8*, nNumberOfBytesToWrite=0x4298, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc9a8*, lpNumberOfBytesWritten=0x18fdd8*=0x4298, lpOverlapped=0x0) returned 1 [0252.530] CloseHandle (hObject=0xdc) returned 1 [0252.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.531] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x43c0 [0252.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x43c8) returned 0x2c8700 [0252.531] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x43c0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x43c0, lpOverlapped=0x0) returned 1 [0252.532] CloseHandle (hObject=0xdc) returned 1 [0252.532] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0252.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.533] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.533] GetTickCount () returned 0x4e7fd [0252.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.534] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533\\....\\temporaryfile")) returned 0 [0252.535] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533\\temporaryfile")) returned 1 [0252.537] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b793600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b793600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.537] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b793600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b793600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.537] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.537] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.537] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.537] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.537] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.537] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533\\temporaryfile")) returned 1 [0252.538] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b76d4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b76d4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b76d4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.538] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.538] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321533" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321533")) returned 1 [0252.538] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 0 [0252.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.540] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccad8*, nNumberOfBytesToWrite=0x43c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccad8*, lpNumberOfBytesWritten=0x18fdd8*=0x43c8, lpOverlapped=0x0) returned 1 [0252.541] CloseHandle (hObject=0xdc) returned 1 [0252.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.542] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3264 [0252.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x326c) returned 0x2c8700 [0252.542] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3264, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3264, lpOverlapped=0x0) returned 1 [0252.543] CloseHandle (hObject=0xdc) returned 1 [0252.543] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0252.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.544] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.544] GetTickCount () returned 0x4e80d [0252.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.544] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321549\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321549\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321549\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321549\\....\\temporaryfile")) returned 0 [0252.545] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321549\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321549\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321549\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321549\\temporaryfile")) returned 1 [0252.546] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321549\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b793600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b793600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b793600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.546] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b793600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b793600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b793600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.547] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b793600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b793600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b793600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.547] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321549\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b793600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b793600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b793600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.547] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b793600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b793600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b793600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.547] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b793600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b793600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b793600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.547] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.547] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321549\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321549\\temporaryfile")) returned 1 [0252.547] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b793600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b793600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b793600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.547] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.547] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321549" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321549")) returned 1 [0252.547] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 0 [0252.548] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.548] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb980*, nNumberOfBytesToWrite=0x3268, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb980*, lpNumberOfBytesWritten=0x18fdd8*=0x3268, lpOverlapped=0x0) returned 1 [0252.549] CloseHandle (hObject=0xdc) returned 1 [0252.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.550] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaf94 [0252.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaf9c) returned 0x2c8700 [0252.550] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xaf94, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xaf94, lpOverlapped=0x0) returned 1 [0252.552] CloseHandle (hObject=0xdc) returned 1 [0252.552] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0252.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.553] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.553] GetTickCount () returned 0x4e81c [0252.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.554] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564\\....\\temporaryfile")) returned 0 [0252.554] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564\\temporaryfile")) returned 1 [0252.555] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.555] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.555] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.555] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.556] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.556] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.556] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.556] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564\\temporaryfile")) returned 1 [0252.556] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.556] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.556] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564")) returned 1 [0252.556] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 0 [0252.557] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.558] WriteFile (in: hFile=0xdc, lpBuffer=0x2d36b0*, nNumberOfBytesToWrite=0xaf98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d36b0*, lpNumberOfBytesWritten=0x18fdd8*=0xaf98, lpOverlapped=0x0) returned 1 [0252.559] CloseHandle (hObject=0xdc) returned 1 [0252.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.560] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1714 [0252.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x171c) returned 0x2c4a70 [0252.560] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1714, lpOverlapped=0x0) returned 1 [0252.561] CloseHandle (hObject=0xdc) returned 1 [0252.561] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0252.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.562] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.562] GetTickCount () returned 0x4e81c [0252.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.562] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564\\....\\temporaryfile")) returned 0 [0252.563] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564\\temporaryfile")) returned 1 [0252.564] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.564] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.565] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.565] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.565] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.565] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.565] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.565] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564\\temporaryfile")) returned 1 [0252.565] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7b9760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7b9760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7b9760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.565] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.565] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321564" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321564")) returned 1 [0252.565] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 0 [0252.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.566] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1718, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1718, lpOverlapped=0x0) returned 1 [0252.567] CloseHandle (hObject=0xdc) returned 1 [0252.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.568] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5c2c [0252.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5c34) returned 0x2c8700 [0252.568] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5c2c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5c2c, lpOverlapped=0x0) returned 1 [0252.569] CloseHandle (hObject=0xdc) returned 1 [0252.569] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0252.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.570] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.570] GetTickCount () returned 0x4e82c [0252.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.571] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580\\....\\temporaryfile")) returned 0 [0252.571] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580\\temporaryfile")) returned 1 [0252.573] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7df8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7df8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7df8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.573] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7df8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7df8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7df8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.573] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7df8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7df8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7df8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.573] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7df8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7df8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7df8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.573] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7df8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7df8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7df8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.573] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7df8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7df8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7df8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.573] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.573] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580\\temporaryfile")) returned 1 [0252.573] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7df8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b7df8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b7df8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.573] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.573] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580")) returned 1 [0252.574] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 0 [0252.574] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.575] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce348*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce348*, lpNumberOfBytesWritten=0x18fdd8*=0x5c30, lpOverlapped=0x0) returned 1 [0252.576] CloseHandle (hObject=0xdc) returned 1 [0252.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.576] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1434 [0252.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x143c) returned 0x25b528 [0252.576] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1434, lpOverlapped=0x0) returned 1 [0252.578] CloseHandle (hObject=0xdc) returned 1 [0252.578] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0252.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.579] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.579] GetTickCount () returned 0x4e82c [0252.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.583] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580\\....\\temporaryfile")) returned 0 [0252.583] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580\\temporaryfile")) returned 1 [0252.585] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7df8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.585] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b7df8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.585] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.585] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.585] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.585] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.585] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.585] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580\\temporaryfile")) returned 1 [0252.585] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.585] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.585] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321580" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321580")) returned 1 [0252.585] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 0 [0252.586] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.586] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1438, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1438, lpOverlapped=0x0) returned 1 [0252.587] CloseHandle (hObject=0xdc) returned 1 [0252.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.588] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1600 [0252.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1608) returned 0x2c4a70 [0252.588] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1600, lpOverlapped=0x0) returned 1 [0252.590] CloseHandle (hObject=0xdc) returned 1 [0252.590] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0252.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.591] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.591] GetTickCount () returned 0x4e83c [0252.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.591] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321596\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321596\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.592] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321596\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321596\\....\\temporaryfile")) returned 0 [0252.592] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321596\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321596\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321596\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321596\\temporaryfile")) returned 1 [0252.593] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321596\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.593] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321596\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.593] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.593] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.594] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.594] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321596\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321596\\temporaryfile")) returned 1 [0252.594] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b805a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b805a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b805a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.594] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.594] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321596" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321596")) returned 1 [0252.594] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 0 [0252.594] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.595] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1608, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1608, lpOverlapped=0x0) returned 1 [0252.596] CloseHandle (hObject=0xdc) returned 1 [0252.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.597] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd74 [0252.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd7c) returned 0x2350048 [0252.597] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd74, lpOverlapped=0x0) returned 1 [0252.603] CloseHandle (hObject=0xdc) returned 1 [0252.603] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0252.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.604] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.604] GetTickCount () returned 0x4e84b [0252.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.604] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611\\....\\temporaryfile")) returned 0 [0252.605] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611\\temporaryfile")) returned 1 [0252.606] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b82bb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b82bb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b82bb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.606] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b82bb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b82bb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b82bb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.606] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b82bb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b82bb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b82bb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.606] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b82bb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b82bb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b82bb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.606] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b82bb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b82bb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b82bb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.606] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b82bb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b82bb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b82bb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.606] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.606] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611\\temporaryfile")) returned 1 [0252.607] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b82bb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b82bb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b82bb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.607] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.607] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611")) returned 1 [0252.607] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 0 [0252.607] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.608] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd78, lpOverlapped=0x0) returned 1 [0252.608] CloseHandle (hObject=0xdc) returned 1 [0252.609] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.609] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4314 [0252.609] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x431c) returned 0x2c8700 [0252.609] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4314, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4314, lpOverlapped=0x0) returned 1 [0252.612] CloseHandle (hObject=0xdc) returned 1 [0252.612] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0252.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.613] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.614] GetTickCount () returned 0x4e84b [0252.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.615] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611\\....\\temporaryfile")) returned 0 [0252.615] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611\\temporaryfile")) returned 1 [0252.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.617] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.617] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.617] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.617] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.617] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.617] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.618] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611\\temporaryfile")) returned 1 [0252.618] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.618] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.618] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321611" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321611")) returned 1 [0252.618] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 0 [0252.619] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.620] WriteFile (in: hFile=0xdc, lpBuffer=0x2cca30*, nNumberOfBytesToWrite=0x4318, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cca30*, lpNumberOfBytesWritten=0x18fdd8*=0x4318, lpOverlapped=0x0) returned 1 [0252.621] CloseHandle (hObject=0xdc) returned 1 [0252.621] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.622] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2d0c [0252.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d14) returned 0x2c8700 [0252.622] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2d0c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2d0c, lpOverlapped=0x0) returned 1 [0252.623] CloseHandle (hObject=0xdc) returned 1 [0252.623] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0252.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.624] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.624] GetTickCount () returned 0x4e85b [0252.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.625] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321627\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321627\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321627\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321627\\....\\temporaryfile")) returned 0 [0252.625] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321627\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321627\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321627\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321627\\temporaryfile")) returned 1 [0252.626] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321627\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.627] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.627] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.627] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321627\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.627] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.627] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.627] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.627] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321627\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321627\\temporaryfile")) returned 1 [0252.627] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b851ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b851ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b851ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.627] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.627] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321627" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321627")) returned 1 [0252.627] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 0 [0252.628] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.628] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb428*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb428*, lpNumberOfBytesWritten=0x18fdd8*=0x2d10, lpOverlapped=0x0) returned 1 [0252.629] CloseHandle (hObject=0xdc) returned 1 [0252.629] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.630] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2bdc [0252.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2be4) returned 0x2c8700 [0252.630] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2bdc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2bdc, lpOverlapped=0x0) returned 1 [0252.631] CloseHandle (hObject=0xdc) returned 1 [0252.631] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0252.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.632] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.632] GetTickCount () returned 0x4e86a [0252.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.633] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642\\....\\temporaryfile")) returned 0 [0252.633] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642\\temporaryfile")) returned 1 [0252.635] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.635] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.635] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.635] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.635] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.635] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.635] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.635] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642\\temporaryfile")) returned 1 [0252.635] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.635] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.635] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642")) returned 1 [0252.635] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 0 [0252.636] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.636] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb2f8*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb2f8*, lpNumberOfBytesWritten=0x18fdd8*=0x2be0, lpOverlapped=0x0) returned 1 [0252.637] CloseHandle (hObject=0xdc) returned 1 [0252.637] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.638] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4b80 [0252.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4b88) returned 0x2c8700 [0252.638] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4b80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4b80, lpOverlapped=0x0) returned 1 [0252.639] CloseHandle (hObject=0xdc) returned 1 [0252.640] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0252.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.640] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.641] GetTickCount () returned 0x4e86a [0252.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.641] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.642] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642\\....\\temporaryfile")) returned 0 [0252.642] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642\\temporaryfile")) returned 1 [0252.643] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.644] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.644] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.644] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.644] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.644] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.644] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.644] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642\\temporaryfile")) returned 1 [0252.644] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b877e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b877e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b877e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.644] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.644] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321642" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321642")) returned 1 [0252.645] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 0 [0252.645] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.646] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd298*, nNumberOfBytesToWrite=0x4b88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd298*, lpNumberOfBytesWritten=0x18fdd8*=0x4b88, lpOverlapped=0x0) returned 1 [0252.647] CloseHandle (hObject=0xdc) returned 1 [0252.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.648] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1214 [0252.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x121c) returned 0x25b528 [0252.648] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1214, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1214, lpOverlapped=0x0) returned 1 [0252.649] CloseHandle (hObject=0xdc) returned 1 [0252.649] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0252.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.650] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.650] GetTickCount () returned 0x4e87a [0252.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.651] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658\\....\\temporaryfile")) returned 0 [0252.651] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658\\temporaryfile")) returned 1 [0252.653] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.653] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.653] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.653] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.653] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.653] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.653] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.653] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658\\temporaryfile")) returned 1 [0252.653] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.653] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.653] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658")) returned 1 [0252.653] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 0 [0252.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.654] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1218, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1218, lpOverlapped=0x0) returned 1 [0252.655] CloseHandle (hObject=0xdc) returned 1 [0252.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.656] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1714 [0252.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x171c) returned 0x2c4a70 [0252.656] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1714, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1714, lpOverlapped=0x0) returned 1 [0252.657] CloseHandle (hObject=0xdc) returned 1 [0252.657] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0252.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.658] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.658] GetTickCount () returned 0x4e87a [0252.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.659] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658\\....\\temporaryfile")) returned 0 [0252.659] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658\\temporaryfile")) returned 1 [0252.661] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.661] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.661] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.661] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.661] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.661] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.661] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.661] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658\\temporaryfile")) returned 1 [0252.661] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b89dfa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b89dfa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b89dfa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.661] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.661] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321658" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321658")) returned 1 [0252.661] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 0 [0252.662] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.662] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1718, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1718, lpOverlapped=0x0) returned 1 [0252.663] CloseHandle (hObject=0xdc) returned 1 [0252.663] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.664] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4540 [0252.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4548) returned 0x2c8700 [0252.664] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4540, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4540, lpOverlapped=0x0) returned 1 [0252.665] CloseHandle (hObject=0xdc) returned 1 [0252.665] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0252.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.666] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.666] GetTickCount () returned 0x4e88a [0252.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.667] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674\\....\\temporaryfile")) returned 0 [0252.667] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674\\temporaryfile")) returned 1 [0252.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.669] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.669] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.669] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.669] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.669] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.669] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.669] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674\\temporaryfile")) returned 1 [0252.669] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.669] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.669] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674")) returned 1 [0252.669] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 0 [0252.670] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.670] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccc58*, nNumberOfBytesToWrite=0x4548, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccc58*, lpNumberOfBytesWritten=0x18fdd8*=0x4548, lpOverlapped=0x0) returned 1 [0252.671] CloseHandle (hObject=0xdc) returned 1 [0252.672] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.672] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4b28 [0252.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4b30) returned 0x2c8700 [0252.672] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4b28, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4b28, lpOverlapped=0x0) returned 1 [0252.674] CloseHandle (hObject=0xdc) returned 1 [0252.674] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0252.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.675] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.675] GetTickCount () returned 0x4e88a [0252.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.675] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674\\....\\temporaryfile")) returned 0 [0252.677] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674\\temporaryfile")) returned 1 [0252.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8ea260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8ea260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8ea260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8ea260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.678] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.679] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.679] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674\\temporaryfile")) returned 1 [0252.679] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8c4100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8c4100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8c4100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.679] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321674" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321674")) returned 1 [0252.679] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 0 [0252.680] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.680] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd240*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd240*, lpNumberOfBytesWritten=0x18fdd8*=0x4b30, lpOverlapped=0x0) returned 1 [0252.681] CloseHandle (hObject=0xdc) returned 1 [0252.681] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.682] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2d14 [0252.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d1c) returned 0x2c8700 [0252.682] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2d14, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2d14, lpOverlapped=0x0) returned 1 [0252.684] CloseHandle (hObject=0xdc) returned 1 [0252.684] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0252.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.685] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.685] GetTickCount () returned 0x4e899 [0252.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.685] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321689\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321689\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321689\\....\\temporaryfile")) returned 0 [0252.686] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321689\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321689\\temporaryfile")) returned 1 [0252.687] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321689\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8ea260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8ea260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8ea260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8ea260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8ea260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8ea260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8ea260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8ea260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8ea260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.687] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321689\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8ea260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8ea260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8ea260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.687] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8ea260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8ea260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8ea260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.688] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8ea260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8ea260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8ea260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.688] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.688] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321689\\temporaryfile")) returned 1 [0252.688] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b8ea260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b8ea260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b8ea260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.688] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.688] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321689" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321689")) returned 1 [0252.688] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 0 [0252.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.689] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb430*, nNumberOfBytesToWrite=0x2d18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb430*, lpNumberOfBytesWritten=0x18fdd8*=0x2d18, lpOverlapped=0x0) returned 1 [0252.690] CloseHandle (hObject=0xdc) returned 1 [0252.690] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.691] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x12bc [0252.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12c4) returned 0x25b528 [0252.691] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x12bc, lpOverlapped=0x0) returned 1 [0252.692] CloseHandle (hObject=0xdc) returned 1 [0252.692] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0252.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.693] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.693] GetTickCount () returned 0x4e8a9 [0252.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.693] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705\\....\\temporaryfile")) returned 0 [0252.694] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705\\temporaryfile")) returned 1 [0252.695] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.695] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.695] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.695] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.695] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.695] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.695] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.695] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705\\temporaryfile")) returned 1 [0252.696] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.696] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.696] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705")) returned 1 [0252.696] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 0 [0252.696] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.697] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x12c0, lpOverlapped=0x0) returned 1 [0252.698] CloseHandle (hObject=0xdc) returned 1 [0252.698] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.698] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x19a8 [0252.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19b0) returned 0x2c4a70 [0252.698] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x19a8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x19a8, lpOverlapped=0x0) returned 1 [0252.700] CloseHandle (hObject=0xdc) returned 1 [0252.700] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0252.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.701] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.701] GetTickCount () returned 0x4e8a9 [0252.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.701] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705\\....\\temporaryfile")) returned 0 [0252.702] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705\\temporaryfile")) returned 1 [0252.703] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.703] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.703] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.703] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.703] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.703] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.703] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.703] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705\\temporaryfile")) returned 1 [0252.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9103c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9103c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9103c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.704] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321705" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321705")) returned 1 [0252.704] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 0 [0252.704] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.705] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x19b0, lpOverlapped=0x0) returned 1 [0252.706] CloseHandle (hObject=0xdc) returned 1 [0252.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.706] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3dd8 [0252.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3de0) returned 0x2c8700 [0252.706] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3dd8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3dd8, lpOverlapped=0x0) returned 1 [0252.708] CloseHandle (hObject=0xdc) returned 1 [0252.708] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0252.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.709] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.709] GetTickCount () returned 0x4e8b8 [0252.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.709] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.713] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720\\....\\temporaryfile")) returned 0 [0252.713] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720\\temporaryfile")) returned 1 [0252.714] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.715] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.715] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.715] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.715] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.715] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.715] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.715] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720\\temporaryfile")) returned 1 [0252.715] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.715] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.715] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720")) returned 1 [0252.715] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 0 [0252.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.716] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc4f0*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc4f0*, lpNumberOfBytesWritten=0x18fdd8*=0x3de0, lpOverlapped=0x0) returned 1 [0252.717] CloseHandle (hObject=0xdc) returned 1 [0252.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.718] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3a14 [0252.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3a1c) returned 0x2c8700 [0252.718] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3a14, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3a14, lpOverlapped=0x0) returned 1 [0252.719] CloseHandle (hObject=0xdc) returned 1 [0252.719] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0252.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.720] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.721] GetTickCount () returned 0x4e8b8 [0252.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.721] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720\\....\\temporaryfile")) returned 0 [0252.722] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720\\temporaryfile")) returned 1 [0252.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.724] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.724] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.724] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.724] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720\\temporaryfile")) returned 1 [0252.725] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b936520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b936520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b936520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.725] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321720" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321720")) returned 1 [0252.725] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 0 [0252.726] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.726] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc130*, nNumberOfBytesToWrite=0x3a18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc130*, lpNumberOfBytesWritten=0x18fdd8*=0x3a18, lpOverlapped=0x0) returned 1 [0252.728] CloseHandle (hObject=0xdc) returned 1 [0252.728] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.728] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1580 [0252.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1588) returned 0x29b460 [0252.728] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1580, lpOverlapped=0x0) returned 1 [0252.730] CloseHandle (hObject=0xdc) returned 1 [0252.730] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0252.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.731] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.731] GetTickCount () returned 0x4e8c8 [0252.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.731] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321736\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321736\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321736\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321736\\....\\temporaryfile")) returned 0 [0252.732] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321736\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321736\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321736\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321736\\temporaryfile")) returned 1 [0252.733] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321736\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b95c680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b95c680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b95c680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b95c680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b95c680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b95c680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b95c680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b95c680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b95c680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.733] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321736\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b95c680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b95c680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b95c680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.733] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b95c680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b95c680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b95c680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.733] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b95c680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b95c680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b95c680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.733] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.733] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321736\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321736\\temporaryfile")) returned 1 [0252.734] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b95c680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b95c680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b95c680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.734] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.734] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321736" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321736")) returned 1 [0252.734] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 0 [0252.734] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.735] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1588, lpOverlapped=0x0) returned 1 [0252.736] CloseHandle (hObject=0xdc) returned 1 [0252.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.737] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18b0 [0252.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18b8) returned 0x2c4a70 [0252.737] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x18b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x18b0, lpOverlapped=0x0) returned 1 [0252.738] CloseHandle (hObject=0xdc) returned 1 [0252.738] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0252.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.739] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.739] GetTickCount () returned 0x4e8d8 [0252.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.740] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752\\....\\temporaryfile")) returned 0 [0252.740] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752\\temporaryfile")) returned 1 [0252.742] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.742] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.742] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.742] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.742] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.742] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.742] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.742] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752\\temporaryfile")) returned 1 [0252.742] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.742] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.742] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752")) returned 1 [0252.743] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 0 [0252.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.743] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x18b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x18b8, lpOverlapped=0x0) returned 1 [0252.744] CloseHandle (hObject=0xdc) returned 1 [0252.744] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.745] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10e0 [0252.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10e8) returned 0x25b528 [0252.745] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x10e0, lpOverlapped=0x0) returned 1 [0252.746] CloseHandle (hObject=0xdc) returned 1 [0252.746] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0252.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.747] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.747] GetTickCount () returned 0x4e8d8 [0252.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.748] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752\\....\\temporaryfile")) returned 0 [0252.748] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752\\temporaryfile")) returned 1 [0252.750] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.750] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.750] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.750] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.750] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.750] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.750] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.750] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752\\temporaryfile")) returned 1 [0252.750] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9827e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9827e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9827e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.750] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.750] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321752" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321752")) returned 1 [0252.750] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 0 [0252.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.752] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x10e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x10e8, lpOverlapped=0x0) returned 1 [0252.753] CloseHandle (hObject=0xdc) returned 1 [0252.753] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.754] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7e4 [0252.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ec) returned 0x2350048 [0252.754] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7e4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7e4, lpOverlapped=0x0) returned 1 [0252.755] CloseHandle (hObject=0xdc) returned 1 [0252.755] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0252.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.756] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.756] GetTickCount () returned 0x4e8e7 [0252.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.757] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767\\....\\temporaryfile")) returned 0 [0252.757] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767\\temporaryfile")) returned 1 [0252.758] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.759] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.759] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.759] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.759] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.759] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.759] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.759] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767\\temporaryfile")) returned 1 [0252.759] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.759] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.759] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767")) returned 1 [0252.759] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 0 [0252.760] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.760] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x7e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x7e8, lpOverlapped=0x0) returned 1 [0252.761] CloseHandle (hObject=0xdc) returned 1 [0252.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.761] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f38 [0252.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f40) returned 0x2c8700 [0252.762] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f38, lpOverlapped=0x0) returned 1 [0252.763] CloseHandle (hObject=0xdc) returned 1 [0252.763] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0252.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.764] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.764] GetTickCount () returned 0x4e8e7 [0252.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.765] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767\\....\\temporaryfile")) returned 0 [0252.765] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767\\temporaryfile")) returned 1 [0252.767] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.767] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.767] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.767] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.767] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.767] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.767] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.767] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767\\temporaryfile")) returned 1 [0252.767] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9a8940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9a8940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9a8940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.767] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.767] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321767" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321767")) returned 1 [0252.767] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 0 [0252.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.768] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca650*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca650*, lpNumberOfBytesWritten=0x18fdd8*=0x1f40, lpOverlapped=0x0) returned 1 [0252.769] CloseHandle (hObject=0xdc) returned 1 [0252.769] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.770] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x290c [0252.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2914) returned 0x2c8700 [0252.770] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x290c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x290c, lpOverlapped=0x0) returned 1 [0252.772] CloseHandle (hObject=0xdc) returned 1 [0252.772] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0252.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.773] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.773] GetTickCount () returned 0x4e8f7 [0252.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.773] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783\\....\\temporaryfile")) returned 0 [0252.774] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783\\temporaryfile")) returned 1 [0252.775] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.775] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.775] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.775] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.775] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.775] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.775] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.775] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783\\temporaryfile")) returned 1 [0252.776] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.776] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.776] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783")) returned 1 [0252.776] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 0 [0252.776] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.777] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb028*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb028*, lpNumberOfBytesWritten=0x18fdd8*=0x2910, lpOverlapped=0x0) returned 1 [0252.778] CloseHandle (hObject=0xdc) returned 1 [0252.778] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.778] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb54 [0252.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb5c) returned 0x2350048 [0252.778] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xb54, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xb54, lpOverlapped=0x0) returned 1 [0252.780] CloseHandle (hObject=0xdc) returned 1 [0252.780] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0252.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.781] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.781] GetTickCount () returned 0x4e8f7 [0252.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.781] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783\\....\\temporaryfile")) returned 0 [0252.782] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783\\temporaryfile")) returned 1 [0252.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.783] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.783] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.783] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.783] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.783] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.784] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.784] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783\\temporaryfile")) returned 1 [0252.784] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9ceaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9ceaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9ceaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.784] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.784] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321783" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321783")) returned 1 [0252.784] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 0 [0252.784] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.785] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xb58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xb58, lpOverlapped=0x0) returned 1 [0252.786] CloseHandle (hObject=0xdc) returned 1 [0252.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.787] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2d40 [0252.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d48) returned 0x2c8700 [0252.787] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2d40, lpOverlapped=0x0) returned 1 [0252.788] CloseHandle (hObject=0xdc) returned 1 [0252.788] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0252.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.789] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.789] GetTickCount () returned 0x4e906 [0252.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.789] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.790] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.790] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798\\....\\temporaryfile")) returned 0 [0252.790] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798\\temporaryfile")) returned 1 [0252.791] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.792] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.792] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.792] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.792] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.792] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.792] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798\\temporaryfile")) returned 1 [0252.792] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.792] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.792] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798")) returned 1 [0252.792] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 0 [0252.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.793] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb458*, nNumberOfBytesToWrite=0x2d48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb458*, lpNumberOfBytesWritten=0x18fdd8*=0x2d48, lpOverlapped=0x0) returned 1 [0252.794] CloseHandle (hObject=0xdc) returned 1 [0252.794] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.795] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x42a4 [0252.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x42ac) returned 0x2c8700 [0252.795] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x42a4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x42a4, lpOverlapped=0x0) returned 1 [0252.796] CloseHandle (hObject=0xdc) returned 1 [0252.796] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0252.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.797] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.797] GetTickCount () returned 0x4e906 [0252.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.798] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798\\....\\temporaryfile")) returned 0 [0252.798] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798\\temporaryfile")) returned 1 [0252.800] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.800] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.800] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.800] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.800] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.800] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.800] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.800] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798\\temporaryfile")) returned 1 [0252.800] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9b9f4c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9b9f4c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9b9f4c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.800] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.800] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321798" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321798")) returned 1 [0252.800] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 0 [0252.801] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.802] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc9c0*, nNumberOfBytesToWrite=0x42a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc9c0*, lpNumberOfBytesWritten=0x18fdd8*=0x42a8, lpOverlapped=0x0) returned 1 [0252.803] CloseHandle (hObject=0xdc) returned 1 [0252.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.804] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x229c [0252.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22a4) returned 0x2c8700 [0252.804] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x229c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x229c, lpOverlapped=0x0) returned 1 [0252.807] CloseHandle (hObject=0xdc) returned 1 [0252.807] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0252.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.808] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.808] GetTickCount () returned 0x4e916 [0252.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.809] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321814\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321814\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321814\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321814\\....\\temporaryfile")) returned 0 [0252.809] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321814\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321814\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321814\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321814\\temporaryfile")) returned 1 [0252.810] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321814\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba1ad60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba1ad60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba1ad60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba1ad60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba1ad60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba1ad60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba1ad60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba1ad60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba1ad60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.810] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321814\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba1ad60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba1ad60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba1ad60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.810] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba1ad60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba1ad60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba1ad60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.811] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba1ad60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba1ad60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba1ad60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.811] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.811] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321814\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321814\\temporaryfile")) returned 1 [0252.811] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba1ad60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba1ad60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba1ad60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.811] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.811] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321814" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321814")) returned 1 [0252.811] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 0 [0252.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.812] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca9b8*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca9b8*, lpNumberOfBytesWritten=0x18fdd8*=0x22a0, lpOverlapped=0x0) returned 1 [0252.813] CloseHandle (hObject=0xdc) returned 1 [0252.813] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.814] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x305c [0252.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3064) returned 0x2c8700 [0252.814] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x305c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x305c, lpOverlapped=0x0) returned 1 [0252.816] CloseHandle (hObject=0xdc) returned 1 [0252.816] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0252.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.817] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.817] GetTickCount () returned 0x4e926 [0252.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.817] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.818] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830\\....\\temporaryfile")) returned 0 [0252.818] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830\\temporaryfile")) returned 1 [0252.819] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.819] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.819] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.819] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.819] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.819] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830\\temporaryfile")) returned 1 [0252.820] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.820] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.820] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830")) returned 1 [0252.820] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 0 [0252.820] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.821] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb778*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb778*, lpNumberOfBytesWritten=0x18fdd8*=0x3060, lpOverlapped=0x0) returned 1 [0252.822] CloseHandle (hObject=0xdc) returned 1 [0252.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.822] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1364 [0252.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x136c) returned 0x25b528 [0252.822] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1364, lpOverlapped=0x0) returned 1 [0252.824] CloseHandle (hObject=0xdc) returned 1 [0252.824] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0252.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.825] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.825] GetTickCount () returned 0x4e926 [0252.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.825] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830\\....\\temporaryfile")) returned 0 [0252.826] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830\\temporaryfile")) returned 1 [0252.827] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.827] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.828] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.828] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.828] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.828] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.828] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.828] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830\\temporaryfile")) returned 1 [0252.828] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba40ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba40ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba40ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.828] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.828] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321830" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321830")) returned 1 [0252.828] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 0 [0252.829] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.829] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1368, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1368, lpOverlapped=0x0) returned 1 [0252.830] CloseHandle (hObject=0xdc) returned 1 [0252.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.831] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1364 [0252.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x136c) returned 0x25b528 [0252.831] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1364, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1364, lpOverlapped=0x0) returned 1 [0252.832] CloseHandle (hObject=0xdc) returned 1 [0252.832] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0252.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.833] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.833] GetTickCount () returned 0x4e935 [0252.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.834] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845\\....\\temporaryfile")) returned 0 [0252.834] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845\\temporaryfile")) returned 1 [0252.836] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.836] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.836] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.836] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.836] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.836] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.836] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.836] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845\\temporaryfile")) returned 1 [0252.836] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.836] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.836] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845")) returned 1 [0252.837] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 0 [0252.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.841] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1368, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1368, lpOverlapped=0x0) returned 1 [0252.842] CloseHandle (hObject=0xdc) returned 1 [0252.842] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.842] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1210 [0252.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1218) returned 0x25b528 [0252.842] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1210, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1210, lpOverlapped=0x0) returned 1 [0252.844] CloseHandle (hObject=0xdc) returned 1 [0252.844] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0252.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.845] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.845] GetTickCount () returned 0x4e935 [0252.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.845] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845\\....\\temporaryfile")) returned 0 [0252.846] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845\\temporaryfile")) returned 1 [0252.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.847] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.847] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.847] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.847] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.848] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845\\temporaryfile")) returned 1 [0252.848] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba67020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba67020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba67020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.848] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321845" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321845")) returned 1 [0252.848] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 0 [0252.848] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.849] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1218, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1218, lpOverlapped=0x0) returned 1 [0252.850] CloseHandle (hObject=0xdc) returned 1 [0252.850] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.850] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16f8 [0252.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1700) returned 0x2c4a70 [0252.850] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16f8, lpOverlapped=0x0) returned 1 [0252.852] CloseHandle (hObject=0xdc) returned 1 [0252.852] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0252.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.853] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.853] GetTickCount () returned 0x4e945 [0252.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.853] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861\\....\\temporaryfile")) returned 0 [0252.854] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861\\temporaryfile")) returned 1 [0252.855] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.855] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.855] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.855] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.855] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.855] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.855] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.856] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861\\temporaryfile")) returned 1 [0252.856] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.856] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.856] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861")) returned 1 [0252.856] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 0 [0252.856] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.857] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1700, lpOverlapped=0x0) returned 1 [0252.858] CloseHandle (hObject=0xdc) returned 1 [0252.858] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.858] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x175c [0252.858] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1764) returned 0x2c4a70 [0252.858] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x175c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x175c, lpOverlapped=0x0) returned 1 [0252.860] CloseHandle (hObject=0xdc) returned 1 [0252.860] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0252.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.861] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.861] GetTickCount () returned 0x4e945 [0252.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.861] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861\\....\\temporaryfile")) returned 0 [0252.862] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861\\temporaryfile")) returned 1 [0252.863] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.864] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.864] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.864] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.864] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.864] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.864] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.864] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861\\temporaryfile")) returned 1 [0252.864] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ba8d180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ba8d180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ba8d180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.864] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.864] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321861" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321861")) returned 1 [0252.864] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 0 [0252.865] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.865] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1760, lpOverlapped=0x0) returned 1 [0252.866] CloseHandle (hObject=0xdc) returned 1 [0252.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.867] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x203c [0252.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2044) returned 0x2c8700 [0252.867] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x203c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x203c, lpOverlapped=0x0) returned 1 [0252.869] CloseHandle (hObject=0xdc) returned 1 [0252.869] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0252.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.870] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.870] GetTickCount () returned 0x4e954 [0252.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.870] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876\\....\\temporaryfile")) returned 0 [0252.871] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876\\temporaryfile")) returned 1 [0252.872] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.872] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.872] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.872] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.872] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.873] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.873] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.873] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876\\temporaryfile")) returned 1 [0252.873] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.873] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.873] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876")) returned 1 [0252.873] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 0 [0252.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.874] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca758*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca758*, lpNumberOfBytesWritten=0x18fdd8*=0x2040, lpOverlapped=0x0) returned 1 [0252.875] CloseHandle (hObject=0xdc) returned 1 [0252.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.876] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1350 [0252.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1358) returned 0x25b528 [0252.876] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1350, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1350, lpOverlapped=0x0) returned 1 [0252.877] CloseHandle (hObject=0xdc) returned 1 [0252.877] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0252.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.878] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.878] GetTickCount () returned 0x4e954 [0252.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.878] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876\\....\\temporaryfile")) returned 0 [0252.879] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876\\temporaryfile")) returned 1 [0252.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bad9440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bad9440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.881] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bad9440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bad9440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.881] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.881] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.881] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.881] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.881] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.881] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876\\temporaryfile")) returned 1 [0252.881] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bab32e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bab32e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bab32e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.881] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.881] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321876" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321876")) returned 1 [0252.881] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 0 [0252.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.882] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1358, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1358, lpOverlapped=0x0) returned 1 [0252.883] CloseHandle (hObject=0xdc) returned 1 [0252.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.884] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2b04 [0252.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b0c) returned 0x2c8700 [0252.884] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2b04, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2b04, lpOverlapped=0x0) returned 1 [0252.885] CloseHandle (hObject=0xdc) returned 1 [0252.885] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0252.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.892] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.893] GetTickCount () returned 0x4e964 [0252.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.893] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321892\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321892\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321892\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321892\\....\\temporaryfile")) returned 0 [0252.894] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321892\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321892\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321892\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321892\\temporaryfile")) returned 1 [0252.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321892\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bad9440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bad9440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bad9440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.895] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bad9440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bad9440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bad9440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.895] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bad9440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bad9440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bad9440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321892\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bad9440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bad9440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bad9440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.896] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bad9440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bad9440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bad9440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.896] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bad9440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bad9440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bad9440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.896] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.896] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321892\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321892\\temporaryfile")) returned 1 [0252.896] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bad9440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bad9440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bad9440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.896] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.896] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321892" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321892")) returned 1 [0252.896] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 0 [0252.897] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.897] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb220*, nNumberOfBytesToWrite=0x2b08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb220*, lpNumberOfBytesWritten=0x18fdd8*=0x2b08, lpOverlapped=0x0) returned 1 [0252.898] CloseHandle (hObject=0xdc) returned 1 [0252.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.899] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd00 [0252.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd08) returned 0x2350048 [0252.900] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd00, lpOverlapped=0x0) returned 1 [0252.901] CloseHandle (hObject=0xdc) returned 1 [0252.901] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0252.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.902] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.902] GetTickCount () returned 0x4e974 [0252.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.902] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321908\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321908\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.903] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321908\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321908\\....\\temporaryfile")) returned 0 [0252.903] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321908\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321908\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321908\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321908\\temporaryfile")) returned 1 [0252.904] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321908\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9baff5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9baff5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9baff5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.905] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9baff5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9baff5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9baff5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.905] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9baff5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9baff5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9baff5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321908\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9baff5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9baff5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9baff5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.905] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9baff5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9baff5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9baff5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.905] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9baff5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9baff5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9baff5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.905] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.905] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321908\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321908\\temporaryfile")) returned 1 [0252.905] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9baff5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9baff5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9baff5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.905] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.905] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321908" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321908")) returned 1 [0252.905] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 0 [0252.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.906] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd08, lpOverlapped=0x0) returned 1 [0252.907] CloseHandle (hObject=0xdc) returned 1 [0252.907] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.908] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4fdc [0252.908] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4fe4) returned 0x2c8700 [0252.908] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4fdc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4fdc, lpOverlapped=0x0) returned 1 [0252.909] CloseHandle (hObject=0xdc) returned 1 [0252.909] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0252.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.910] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.910] GetTickCount () returned 0x4e983 [0252.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.911] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923\\....\\temporaryfile")) returned 0 [0252.912] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923\\temporaryfile")) returned 1 [0252.913] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.913] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.913] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.913] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.913] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.913] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.913] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.913] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923\\temporaryfile")) returned 1 [0252.913] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.913] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923")) returned 1 [0252.914] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 0 [0252.914] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.915] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd6f8*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd6f8*, lpNumberOfBytesWritten=0x18fdd8*=0x4fe0, lpOverlapped=0x0) returned 1 [0252.916] CloseHandle (hObject=0xdc) returned 1 [0252.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.916] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x24b8 [0252.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24c0) returned 0x2c8700 [0252.917] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x24b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x24b8, lpOverlapped=0x0) returned 1 [0252.918] CloseHandle (hObject=0xdc) returned 1 [0252.918] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0252.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.919] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.919] GetTickCount () returned 0x4e983 [0252.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.920] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923\\....\\temporaryfile")) returned 0 [0252.920] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923\\temporaryfile")) returned 1 [0252.922] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.922] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.922] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.922] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.922] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.922] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.922] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923\\temporaryfile")) returned 1 [0252.922] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb25700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb25700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb25700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.922] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321923" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321923")) returned 1 [0252.922] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 0 [0252.923] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.923] WriteFile (in: hFile=0xdc, lpBuffer=0x2cabd0*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cabd0*, lpNumberOfBytesWritten=0x18fdd8*=0x24c0, lpOverlapped=0x0) returned 1 [0252.924] CloseHandle (hObject=0xdc) returned 1 [0252.924] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.925] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1864 [0252.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x186c) returned 0x2c4a70 [0252.925] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1864, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1864, lpOverlapped=0x0) returned 1 [0252.926] CloseHandle (hObject=0xdc) returned 1 [0252.926] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0252.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.927] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.927] GetTickCount () returned 0x4e993 [0252.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.928] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939\\....\\temporaryfile")) returned 0 [0252.929] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939\\temporaryfile")) returned 1 [0252.930] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.930] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.930] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.930] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.930] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.930] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.930] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939\\temporaryfile")) returned 1 [0252.930] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.930] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.930] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939")) returned 1 [0252.931] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 0 [0252.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.931] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1868, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1868, lpOverlapped=0x0) returned 1 [0252.932] CloseHandle (hObject=0xdc) returned 1 [0252.933] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.933] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4928 [0252.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4930) returned 0x2c8700 [0252.933] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4928, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4928, lpOverlapped=0x0) returned 1 [0252.937] CloseHandle (hObject=0xdc) returned 1 [0252.937] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0252.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.938] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.938] GetTickCount () returned 0x4e993 [0252.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.938] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939\\....\\temporaryfile")) returned 0 [0252.939] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939\\temporaryfile")) returned 1 [0252.941] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.941] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.941] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.941] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.941] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.941] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.941] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.941] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939\\temporaryfile")) returned 1 [0252.941] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb4b860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb4b860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb4b860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.941] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.941] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321939" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321939")) returned 1 [0252.942] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 0 [0252.942] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.943] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd040*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd040*, lpNumberOfBytesWritten=0x18fdd8*=0x4930, lpOverlapped=0x0) returned 1 [0252.944] CloseHandle (hObject=0xdc) returned 1 [0252.944] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.944] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1424 [0252.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x142c) returned 0x25b528 [0252.944] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1424, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1424, lpOverlapped=0x0) returned 1 [0252.946] CloseHandle (hObject=0xdc) returned 1 [0252.946] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0252.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.947] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.947] GetTickCount () returned 0x4e9a2 [0252.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.947] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.947] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.948] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954\\....\\temporaryfile")) returned 0 [0252.948] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954\\temporaryfile")) returned 1 [0252.949] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.949] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.949] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.949] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.949] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.949] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.949] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.950] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954\\temporaryfile")) returned 1 [0252.950] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.950] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.950] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954")) returned 1 [0252.950] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 0 [0252.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.951] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1428, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1428, lpOverlapped=0x0) returned 1 [0252.952] CloseHandle (hObject=0xdc) returned 1 [0252.952] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.953] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1560 [0252.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1568) returned 0x29b460 [0252.953] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1560, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1560, lpOverlapped=0x0) returned 1 [0252.954] CloseHandle (hObject=0xdc) returned 1 [0252.954] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0252.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.955] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.955] GetTickCount () returned 0x4e9a2 [0252.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.956] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954\\....\\temporaryfile")) returned 0 [0252.957] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954\\temporaryfile")) returned 1 [0252.958] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb97b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb97b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.958] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb97b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb97b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.958] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.958] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.958] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.958] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.959] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.959] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954\\temporaryfile")) returned 1 [0252.959] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb719c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb719c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb719c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.959] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.959] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321954" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321954")) returned 1 [0252.959] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 0 [0252.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.960] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1568, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1568, lpOverlapped=0x0) returned 1 [0252.961] CloseHandle (hObject=0xdc) returned 1 [0252.961] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.962] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1034 [0252.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x103c) returned 0x25b528 [0252.962] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1034, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1034, lpOverlapped=0x0) returned 1 [0252.963] CloseHandle (hObject=0xdc) returned 1 [0252.963] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0252.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.964] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.964] GetTickCount () returned 0x4e9b2 [0252.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.965] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321970\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321970\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321970\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321970\\....\\temporaryfile")) returned 0 [0252.966] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321970\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321970\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321970\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321970\\temporaryfile")) returned 1 [0252.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321970\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb97b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb97b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb97b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.967] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb97b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb97b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb97b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.967] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb97b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb97b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb97b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321970\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb97b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb97b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb97b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.967] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb97b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb97b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb97b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.967] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb97b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb97b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb97b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.967] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.967] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321970\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321970\\temporaryfile")) returned 1 [0252.968] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bb97b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bb97b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bb97b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.968] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.968] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321970" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321970")) returned 1 [0252.968] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 0 [0252.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.969] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1038, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1038, lpOverlapped=0x0) returned 1 [0252.970] CloseHandle (hObject=0xdc) returned 1 [0252.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.970] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb60 [0252.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb68) returned 0x2350048 [0252.971] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xb60, lpOverlapped=0x0) returned 1 [0252.972] CloseHandle (hObject=0xdc) returned 1 [0252.972] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0252.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.973] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.973] GetTickCount () returned 0x4e9c2 [0252.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.973] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986\\....\\temporaryfile")) returned 0 [0252.974] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986\\temporaryfile")) returned 1 [0252.979] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.979] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.979] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.979] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.979] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.979] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.979] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986\\temporaryfile")) returned 1 [0252.979] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.979] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986")) returned 1 [0252.980] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 0 [0252.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.980] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xb68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xb68, lpOverlapped=0x0) returned 1 [0252.981] CloseHandle (hObject=0xdc) returned 1 [0252.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.982] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c44 [0252.982] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c4c) returned 0x2c8700 [0252.982] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7c44, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7c44, lpOverlapped=0x0) returned 1 [0252.984] CloseHandle (hObject=0xdc) returned 1 [0252.984] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0252.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0252.985] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.985] GetTickCount () returned 0x4e9c2 [0252.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.986] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986\\...."), lpSecurityAttributes=0x256228) returned 1 [0252.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986\\....\\temporaryfile")) returned 0 [0252.986] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986\\temporaryfile")) returned 1 [0252.988] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.988] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.988] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.988] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.988] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.988] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.988] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.988] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986\\temporaryfile")) returned 1 [0252.989] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbbdc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbbdc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbbdc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.989] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.989] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18321986" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18321986")) returned 1 [0252.989] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 0 [0252.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.990] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0360*, nNumberOfBytesToWrite=0x7c48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0360*, lpNumberOfBytesWritten=0x18fdd8*=0x7c48, lpOverlapped=0x0) returned 1 [0252.991] CloseHandle (hObject=0xdc) returned 1 [0252.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.992] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x43b4 [0252.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x43bc) returned 0x2c8700 [0252.992] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x43b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x43b4, lpOverlapped=0x0) returned 1 [0252.994] CloseHandle (hObject=0xdc) returned 1 [0252.994] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0252.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0252.995] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0252.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0252.995] GetTickCount () returned 0x4e9d1 [0252.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0252.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0252.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0252.995] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001\\...."), lpSecurityAttributes=0x256210) returned 1 [0252.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001\\....\\temporaryfile")) returned 0 [0252.996] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001\\temporaryfile")) returned 1 [0252.997] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbe3de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbe3de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbe3de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0252.997] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbe3de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbe3de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbe3de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.997] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbe3de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbe3de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbe3de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0252.997] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbe3de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbe3de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbe3de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0252.997] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbe3de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbe3de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbe3de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.997] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbe3de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbe3de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbe3de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0252.998] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0252.998] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001\\temporaryfile")) returned 1 [0252.998] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbe3de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bbe3de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bbe3de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0252.998] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0252.998] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001")) returned 1 [0252.998] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 0 [0252.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0252.999] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccad0*, nNumberOfBytesToWrite=0x43b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccad0*, lpNumberOfBytesWritten=0x18fdd8*=0x43b8, lpOverlapped=0x0) returned 1 [0253.000] CloseHandle (hObject=0xdc) returned 1 [0253.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.001] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1cd8 [0253.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ce0) returned 0x2c8700 [0253.001] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1cd8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1cd8, lpOverlapped=0x0) returned 1 [0253.002] CloseHandle (hObject=0xdc) returned 1 [0253.002] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0253.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.003] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.003] GetTickCount () returned 0x4e9d1 [0253.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.004] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001\\....\\temporaryfile")) returned 0 [0253.005] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001\\temporaryfile")) returned 1 [0253.006] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbe3de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.006] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bbe3de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.006] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.006] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.007] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.007] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.007] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.007] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001\\temporaryfile")) returned 1 [0253.007] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.007] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.007] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322001" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322001")) returned 1 [0253.007] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 0 [0253.008] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.008] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca3f0*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca3f0*, lpNumberOfBytesWritten=0x18fdd8*=0x1ce0, lpOverlapped=0x0) returned 1 [0253.009] CloseHandle (hObject=0xdc) returned 1 [0253.009] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.010] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x542c [0253.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5434) returned 0x2c8700 [0253.010] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x542c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x542c, lpOverlapped=0x0) returned 1 [0253.011] CloseHandle (hObject=0xdc) returned 1 [0253.011] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0253.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.012] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.012] GetTickCount () returned 0x4e9e1 [0253.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.013] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.013] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322017\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322017\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322017\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322017\\....\\temporaryfile")) returned 0 [0253.014] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322017\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322017\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322017\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322017\\temporaryfile")) returned 1 [0253.015] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322017\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.015] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.015] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.015] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322017\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.015] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.015] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.015] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.015] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322017\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322017\\temporaryfile")) returned 1 [0253.015] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc09f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc09f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc09f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.015] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.016] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322017" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322017")) returned 1 [0253.016] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 0 [0253.016] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.017] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdb48*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdb48*, lpNumberOfBytesWritten=0x18fdd8*=0x5430, lpOverlapped=0x0) returned 1 [0253.019] CloseHandle (hObject=0xdc) returned 1 [0253.019] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.020] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x21e8 [0253.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x21f0) returned 0x2c8700 [0253.020] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x21e8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x21e8, lpOverlapped=0x0) returned 1 [0253.022] CloseHandle (hObject=0xdc) returned 1 [0253.022] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0253.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.023] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.023] GetTickCount () returned 0x4e9f0 [0253.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.023] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032\\....\\temporaryfile")) returned 0 [0253.024] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032\\temporaryfile")) returned 1 [0253.025] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.025] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.025] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.025] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.025] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.025] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.025] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.025] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032\\temporaryfile")) returned 1 [0253.026] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.026] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.026] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032")) returned 1 [0253.026] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 0 [0253.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.027] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca900*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca900*, lpNumberOfBytesWritten=0x18fdd8*=0x21f0, lpOverlapped=0x0) returned 1 [0253.028] CloseHandle (hObject=0xdc) returned 1 [0253.028] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.028] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x287c [0253.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2884) returned 0x2c8700 [0253.028] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x287c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x287c, lpOverlapped=0x0) returned 1 [0253.030] CloseHandle (hObject=0xdc) returned 1 [0253.030] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0253.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.031] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.031] GetTickCount () returned 0x4e9f0 [0253.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.031] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.032] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032\\....\\temporaryfile")) returned 0 [0253.032] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032\\temporaryfile")) returned 1 [0253.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.034] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.034] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.034] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.034] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.034] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.034] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.034] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032\\temporaryfile")) returned 1 [0253.034] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc300a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc300a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc300a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.034] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.034] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322032" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322032")) returned 1 [0253.034] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 0 [0253.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.035] WriteFile (in: hFile=0xdc, lpBuffer=0x2caf98*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caf98*, lpNumberOfBytesWritten=0x18fdd8*=0x2880, lpOverlapped=0x0) returned 1 [0253.036] CloseHandle (hObject=0xdc) returned 1 [0253.036] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.037] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x35f0 [0253.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x35f8) returned 0x2c8700 [0253.037] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x35f0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x35f0, lpOverlapped=0x0) returned 1 [0253.038] CloseHandle (hObject=0xdc) returned 1 [0253.038] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0253.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.039] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.039] GetTickCount () returned 0x4ea00 [0253.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.040] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048\\....\\temporaryfile")) returned 0 [0253.041] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048\\temporaryfile")) returned 1 [0253.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.042] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.042] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.042] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.042] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048\\temporaryfile")) returned 1 [0253.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.042] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.043] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048")) returned 1 [0253.043] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 0 [0253.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.044] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbd08*, nNumberOfBytesToWrite=0x35f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbd08*, lpNumberOfBytesWritten=0x18fdd8*=0x35f8, lpOverlapped=0x0) returned 1 [0253.045] CloseHandle (hObject=0xdc) returned 1 [0253.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.046] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2030 [0253.046] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2038) returned 0x2c8700 [0253.046] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2030, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2030, lpOverlapped=0x0) returned 1 [0253.047] CloseHandle (hObject=0xdc) returned 1 [0253.047] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0253.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.048] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.048] GetTickCount () returned 0x4ea00 [0253.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.049] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048\\....\\temporaryfile")) returned 0 [0253.050] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048\\temporaryfile")) returned 1 [0253.051] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.051] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.051] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.051] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.051] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.051] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.051] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.051] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048\\temporaryfile")) returned 1 [0253.052] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc56200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc56200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc56200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.052] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.052] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322048" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322048")) returned 1 [0253.052] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 0 [0253.052] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.053] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca748*, nNumberOfBytesToWrite=0x2038, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca748*, lpNumberOfBytesWritten=0x18fdd8*=0x2038, lpOverlapped=0x0) returned 1 [0253.055] CloseHandle (hObject=0xdc) returned 1 [0253.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.056] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2dc8 [0253.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2dd0) returned 0x2c8700 [0253.056] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2dc8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2dc8, lpOverlapped=0x0) returned 1 [0253.060] CloseHandle (hObject=0xdc) returned 1 [0253.060] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0253.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.061] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.061] GetTickCount () returned 0x4ea10 [0253.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.061] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322064\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322064\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322064\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322064\\....\\temporaryfile")) returned 0 [0253.062] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322064\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322064\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322064\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322064\\temporaryfile")) returned 1 [0253.063] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322064\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc7c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc7c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc7c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.063] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc7c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc7c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc7c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.063] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc7c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc7c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc7c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.063] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322064\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc7c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc7c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc7c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.063] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc7c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc7c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc7c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.063] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc7c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc7c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc7c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.063] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.063] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322064\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322064\\temporaryfile")) returned 1 [0253.063] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bc7c360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bc7c360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bc7c360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.064] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.064] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322064" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322064")) returned 1 [0253.064] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 0 [0253.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.065] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb4e0*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb4e0*, lpNumberOfBytesWritten=0x18fdd8*=0x2dd0, lpOverlapped=0x0) returned 1 [0253.066] CloseHandle (hObject=0xdc) returned 1 [0253.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.066] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1204 [0253.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x120c) returned 0x25b528 [0253.066] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1204, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1204, lpOverlapped=0x0) returned 1 [0253.068] CloseHandle (hObject=0xdc) returned 1 [0253.068] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0253.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.069] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.069] GetTickCount () returned 0x4ea1f [0253.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.069] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.070] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079\\....\\temporaryfile")) returned 0 [0253.070] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079\\temporaryfile")) returned 1 [0253.071] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.071] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.071] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.071] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.071] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.071] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.071] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.071] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079\\temporaryfile")) returned 1 [0253.072] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.072] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.072] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079")) returned 1 [0253.072] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 0 [0253.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.073] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1208, lpOverlapped=0x0) returned 1 [0253.074] CloseHandle (hObject=0xdc) returned 1 [0253.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.074] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x274c [0253.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2754) returned 0x2c8700 [0253.074] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x274c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x274c, lpOverlapped=0x0) returned 1 [0253.076] CloseHandle (hObject=0xdc) returned 1 [0253.076] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0253.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.077] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.077] GetTickCount () returned 0x4ea1f [0253.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.077] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079\\....\\temporaryfile")) returned 0 [0253.078] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079\\temporaryfile")) returned 1 [0253.079] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.079] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.080] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.080] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.080] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079\\temporaryfile")) returned 1 [0253.080] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bca24c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bca24c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bca24c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.080] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322079" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322079")) returned 1 [0253.080] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 0 [0253.081] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.081] WriteFile (in: hFile=0xdc, lpBuffer=0x2cae68*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cae68*, lpNumberOfBytesWritten=0x18fdd8*=0x2750, lpOverlapped=0x0) returned 1 [0253.082] CloseHandle (hObject=0xdc) returned 1 [0253.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.083] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16b4 [0253.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16bc) returned 0x2c4a70 [0253.083] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16b4, lpOverlapped=0x0) returned 1 [0253.084] CloseHandle (hObject=0xdc) returned 1 [0253.084] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0253.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.085] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.085] GetTickCount () returned 0x4ea2f [0253.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.086] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.086] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095\\....\\temporaryfile")) returned 0 [0253.086] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095\\temporaryfile")) returned 1 [0253.088] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.088] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.088] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.088] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.088] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.088] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.088] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.088] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095\\temporaryfile")) returned 1 [0253.088] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.088] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.089] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095")) returned 1 [0253.089] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 0 [0253.089] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.090] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x16b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x16b8, lpOverlapped=0x0) returned 1 [0253.090] CloseHandle (hObject=0xdc) returned 1 [0253.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.091] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5bfc [0253.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5c04) returned 0x2c8700 [0253.091] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5bfc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5bfc, lpOverlapped=0x0) returned 1 [0253.092] CloseHandle (hObject=0xdc) returned 1 [0253.093] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0253.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.094] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.094] GetTickCount () returned 0x4ea2f [0253.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.094] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095\\....\\temporaryfile")) returned 0 [0253.095] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095\\temporaryfile")) returned 1 [0253.096] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.096] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.096] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.096] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.096] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.096] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.097] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.097] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095\\temporaryfile")) returned 1 [0253.097] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcc8620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcc8620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcc8620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.097] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.097] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322095" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322095")) returned 1 [0253.097] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 0 [0253.098] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.098] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce318*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce318*, lpNumberOfBytesWritten=0x18fdd8*=0x5c00, lpOverlapped=0x0) returned 1 [0253.099] CloseHandle (hObject=0xdc) returned 1 [0253.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.101] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2e7c [0253.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e84) returned 0x2c8700 [0253.101] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2e7c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2e7c, lpOverlapped=0x0) returned 1 [0253.102] CloseHandle (hObject=0xdc) returned 1 [0253.102] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0253.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.103] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.103] GetTickCount () returned 0x4ea3e [0253.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.103] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.104] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322110\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322110\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.104] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322110\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322110\\....\\temporaryfile")) returned 0 [0253.104] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322110\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322110\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322110\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322110\\temporaryfile")) returned 1 [0253.106] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322110\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcee780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcee780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcee780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.106] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcee780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcee780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcee780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.106] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcee780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcee780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcee780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.106] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322110\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcee780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcee780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcee780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.106] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcee780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcee780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcee780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.106] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcee780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcee780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcee780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.106] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.106] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322110\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322110\\temporaryfile")) returned 1 [0253.106] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bcee780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bcee780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bcee780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.106] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.106] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322110" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322110")) returned 1 [0253.106] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 0 [0253.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.111] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb598*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb598*, lpNumberOfBytesWritten=0x18fdd8*=0x2e80, lpOverlapped=0x0) returned 1 [0253.112] CloseHandle (hObject=0xdc) returned 1 [0253.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.113] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4c90 [0253.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c98) returned 0x2c8700 [0253.113] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4c90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4c90, lpOverlapped=0x0) returned 1 [0253.115] CloseHandle (hObject=0xdc) returned 1 [0253.115] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0253.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.116] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.116] GetTickCount () returned 0x4ea4e [0253.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.116] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126\\....\\temporaryfile")) returned 0 [0253.117] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126\\temporaryfile")) returned 1 [0253.118] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.118] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.118] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.118] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.118] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.118] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.118] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.119] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126\\temporaryfile")) returned 1 [0253.119] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.119] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.119] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126")) returned 1 [0253.119] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 0 [0253.120] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.120] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd3a8*, nNumberOfBytesToWrite=0x4c98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd3a8*, lpNumberOfBytesWritten=0x18fdd8*=0x4c98, lpOverlapped=0x0) returned 1 [0253.121] CloseHandle (hObject=0xdc) returned 1 [0253.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.122] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x864 [0253.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x86c) returned 0x2350048 [0253.123] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x864, lpOverlapped=0x0) returned 1 [0253.124] CloseHandle (hObject=0xdc) returned 1 [0253.124] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0253.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.125] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.125] GetTickCount () returned 0x4ea4e [0253.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.125] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126\\....\\temporaryfile")) returned 0 [0253.126] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126\\temporaryfile")) returned 1 [0253.127] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.127] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.127] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.127] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.128] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.128] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.128] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.128] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126\\temporaryfile")) returned 1 [0253.128] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd148e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd148e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd148e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.128] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.128] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322126" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322126")) returned 1 [0253.128] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 0 [0253.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.129] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x868, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x868, lpOverlapped=0x0) returned 1 [0253.130] CloseHandle (hObject=0xdc) returned 1 [0253.130] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.131] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd04 [0253.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd0c) returned 0x2350048 [0253.131] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd04, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd04, lpOverlapped=0x0) returned 1 [0253.132] CloseHandle (hObject=0xdc) returned 1 [0253.132] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0253.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.133] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.133] GetTickCount () returned 0x4ea5e [0253.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.134] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142\\....\\temporaryfile")) returned 0 [0253.134] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142\\temporaryfile")) returned 1 [0253.136] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.136] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.136] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.136] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.136] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.136] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.136] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.136] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142\\temporaryfile")) returned 1 [0253.136] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.136] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.136] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142")) returned 1 [0253.136] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 0 [0253.137] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.137] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd08, lpOverlapped=0x0) returned 1 [0253.138] CloseHandle (hObject=0xdc) returned 1 [0253.138] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.139] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x35d8 [0253.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x35e0) returned 0x2c8700 [0253.139] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x35d8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x35d8, lpOverlapped=0x0) returned 1 [0253.140] CloseHandle (hObject=0xdc) returned 1 [0253.140] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0253.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.141] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.141] GetTickCount () returned 0x4ea5e [0253.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.142] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142\\....\\temporaryfile")) returned 0 [0253.143] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142\\temporaryfile")) returned 1 [0253.144] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.144] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.144] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.144] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.144] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.144] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.145] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.145] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142\\temporaryfile")) returned 1 [0253.145] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd3aa40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd3aa40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd3aa40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.145] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.145] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322142" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322142")) returned 1 [0253.145] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 0 [0253.145] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.146] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbcf0*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbcf0*, lpNumberOfBytesWritten=0x18fdd8*=0x35e0, lpOverlapped=0x0) returned 1 [0253.147] CloseHandle (hObject=0xdc) returned 1 [0253.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.148] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbcc [0253.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbd4) returned 0x2350048 [0253.148] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xbcc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xbcc, lpOverlapped=0x0) returned 1 [0253.149] CloseHandle (hObject=0xdc) returned 1 [0253.149] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0253.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.150] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.150] GetTickCount () returned 0x4ea6d [0253.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.151] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157\\....\\temporaryfile")) returned 0 [0253.151] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157\\temporaryfile")) returned 1 [0253.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.153] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.153] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.153] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157\\temporaryfile")) returned 1 [0253.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.153] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157")) returned 1 [0253.154] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 0 [0253.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.154] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xbd0, lpOverlapped=0x0) returned 1 [0253.155] CloseHandle (hObject=0xdc) returned 1 [0253.155] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.156] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1dd0 [0253.156] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1dd8) returned 0x2c8700 [0253.156] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1dd0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1dd0, lpOverlapped=0x0) returned 1 [0253.157] CloseHandle (hObject=0xdc) returned 1 [0253.157] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0253.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.158] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.158] GetTickCount () returned 0x4ea6d [0253.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.159] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157\\....\\temporaryfile")) returned 0 [0253.160] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157\\temporaryfile")) returned 1 [0253.161] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd86d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd86d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.161] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd86d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd86d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.161] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.161] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.161] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.161] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.161] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.161] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157\\temporaryfile")) returned 1 [0253.161] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd60ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd60ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd60ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.161] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.162] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322157" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322157")) returned 1 [0253.162] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 0 [0253.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.163] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca4e8*, nNumberOfBytesToWrite=0x1dd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca4e8*, lpNumberOfBytesWritten=0x18fdd8*=0x1dd8, lpOverlapped=0x0) returned 1 [0253.164] CloseHandle (hObject=0xdc) returned 1 [0253.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.165] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2358 [0253.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2360) returned 0x2c8700 [0253.165] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2358, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2358, lpOverlapped=0x0) returned 1 [0253.166] CloseHandle (hObject=0xdc) returned 1 [0253.166] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0253.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.167] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.167] GetTickCount () returned 0x4ea7d [0253.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.168] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322173\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322173\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322173\\....\\temporaryfile")) returned 0 [0253.169] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322173\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322173\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322173\\temporaryfile")) returned 1 [0253.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322173\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd86d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd86d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd86d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.170] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd86d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd86d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd86d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.170] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd86d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd86d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd86d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322173\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd86d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd86d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd86d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.170] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd86d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd86d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd86d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.170] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd86d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd86d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd86d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.170] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.170] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322173\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322173\\temporaryfile")) returned 1 [0253.170] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bd86d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bd86d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bd86d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.170] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.171] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322173" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322173")) returned 1 [0253.171] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 0 [0253.171] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.172] WriteFile (in: hFile=0xdc, lpBuffer=0x2caa70*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caa70*, lpNumberOfBytesWritten=0x18fdd8*=0x2360, lpOverlapped=0x0) returned 1 [0253.173] CloseHandle (hObject=0xdc) returned 1 [0253.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.173] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3734 [0253.173] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x373c) returned 0x2c8700 [0253.173] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3734, lpOverlapped=0x0) returned 1 [0253.175] CloseHandle (hObject=0xdc) returned 1 [0253.175] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0253.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.176] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.176] GetTickCount () returned 0x4ea8c [0253.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.177] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.177] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188\\....\\temporaryfile")) returned 0 [0253.177] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188\\temporaryfile")) returned 1 [0253.178] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.178] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.179] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.179] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.179] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.179] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.179] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.179] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188\\temporaryfile")) returned 1 [0253.179] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.179] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.179] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188")) returned 1 [0253.179] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 0 [0253.180] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.180] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbe50*, nNumberOfBytesToWrite=0x3738, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbe50*, lpNumberOfBytesWritten=0x18fdd8*=0x3738, lpOverlapped=0x0) returned 1 [0253.181] CloseHandle (hObject=0xdc) returned 1 [0253.181] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.182] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x69cc [0253.182] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x69d4) returned 0x2c8700 [0253.182] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x69cc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x69cc, lpOverlapped=0x0) returned 1 [0253.183] CloseHandle (hObject=0xdc) returned 1 [0253.184] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0253.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.185] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.185] GetTickCount () returned 0x4ea8c [0253.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.185] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188\\....\\temporaryfile")) returned 0 [0253.186] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188\\temporaryfile")) returned 1 [0253.187] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.187] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.187] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.187] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.188] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.188] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.188] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.188] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188\\temporaryfile")) returned 1 [0253.188] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdace60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdace60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdace60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.188] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.188] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322188" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322188")) returned 1 [0253.188] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 0 [0253.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.189] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf0e8*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf0e8*, lpNumberOfBytesWritten=0x18fdd8*=0x69d0, lpOverlapped=0x0) returned 1 [0253.191] CloseHandle (hObject=0xdc) returned 1 [0253.191] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.191] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbcfc [0253.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbd04) returned 0x2c8700 [0253.191] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xbcfc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xbcfc, lpOverlapped=0x0) returned 1 [0253.203] CloseHandle (hObject=0xdc) returned 1 [0253.203] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0253.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.204] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.204] GetTickCount () returned 0x4ea9c [0253.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.204] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.205] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.205] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322204\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322204\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322204\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322204\\....\\temporaryfile")) returned 0 [0253.205] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322204\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322204\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322204\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322204\\temporaryfile")) returned 1 [0253.207] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322204\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdd2fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdd2fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdd2fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.207] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdd2fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdd2fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdd2fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.207] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdd2fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdd2fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdd2fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.207] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322204\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdd2fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdd2fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdd2fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.207] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdd2fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdd2fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdd2fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.208] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdd2fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdd2fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdd2fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.208] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.208] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322204\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322204\\temporaryfile")) returned 1 [0253.208] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdd2fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdd2fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdd2fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.208] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.208] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322204" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322204")) returned 1 [0253.208] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 0 [0253.209] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.210] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4418*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4418*, lpNumberOfBytesWritten=0x18fdd8*=0xbd00, lpOverlapped=0x0) returned 1 [0253.211] CloseHandle (hObject=0xdc) returned 1 [0253.212] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.212] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbd04 [0253.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbd0c) returned 0x2c8700 [0253.212] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xbd04, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xbd04, lpOverlapped=0x0) returned 1 [0253.214] CloseHandle (hObject=0xdc) returned 1 [0253.214] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0253.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.215] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.215] GetTickCount () returned 0x4eaac [0253.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.216] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322220\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322220\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322220\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322220\\....\\temporaryfile")) returned 0 [0253.216] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322220\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322220\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322220\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322220\\temporaryfile")) returned 1 [0253.218] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322220\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdf9120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdf9120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdf9120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.218] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdf9120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdf9120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdf9120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.218] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdf9120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdf9120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdf9120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.218] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322220\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdf9120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdf9120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdf9120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.218] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdf9120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdf9120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdf9120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.218] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdf9120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdf9120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdf9120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.218] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.218] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322220\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322220\\temporaryfile")) returned 1 [0253.219] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bdf9120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bdf9120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bdf9120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.219] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322220" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322220")) returned 1 [0253.219] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 0 [0253.220] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.220] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4420*, nNumberOfBytesToWrite=0xbd08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4420*, lpNumberOfBytesWritten=0x18fdd8*=0xbd08, lpOverlapped=0x0) returned 1 [0253.222] CloseHandle (hObject=0xdc) returned 1 [0253.222] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.223] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4330 [0253.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4338) returned 0x2c8700 [0253.223] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4330, lpOverlapped=0x0) returned 1 [0253.225] CloseHandle (hObject=0xdc) returned 1 [0253.225] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0253.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.226] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.226] GetTickCount () returned 0x4eabb [0253.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.226] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.226] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235\\....\\temporaryfile")) returned 0 [0253.227] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235\\temporaryfile")) returned 1 [0253.228] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.229] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.229] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.229] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.229] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.229] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.229] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235\\temporaryfile")) returned 1 [0253.229] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.229] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235")) returned 1 [0253.229] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 0 [0253.230] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.230] WriteFile (in: hFile=0xdc, lpBuffer=0x2cca48*, nNumberOfBytesToWrite=0x4338, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cca48*, lpNumberOfBytesWritten=0x18fdd8*=0x4338, lpOverlapped=0x0) returned 1 [0253.231] CloseHandle (hObject=0xdc) returned 1 [0253.232] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.232] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3a94 [0253.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3a9c) returned 0x2c8700 [0253.232] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3a94, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3a94, lpOverlapped=0x0) returned 1 [0253.234] CloseHandle (hObject=0xdc) returned 1 [0253.234] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0253.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.235] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.235] GetTickCount () returned 0x4eabb [0253.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.235] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235\\....\\temporaryfile")) returned 0 [0253.236] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235\\temporaryfile")) returned 1 [0253.237] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.238] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.238] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.238] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.238] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.238] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.238] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235\\temporaryfile")) returned 1 [0253.238] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be1f280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be1f280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be1f280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.238] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322235" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322235")) returned 1 [0253.239] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 0 [0253.239] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.240] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc1b0*, nNumberOfBytesToWrite=0x3a98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc1b0*, lpNumberOfBytesWritten=0x18fdd8*=0x3a98, lpOverlapped=0x0) returned 1 [0253.241] CloseHandle (hObject=0xdc) returned 1 [0253.241] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.242] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4ea8 [0253.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4eb0) returned 0x2c8700 [0253.242] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4ea8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4ea8, lpOverlapped=0x0) returned 1 [0253.243] CloseHandle (hObject=0xdc) returned 1 [0253.243] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0253.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.244] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.244] GetTickCount () returned 0x4eacb [0253.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.245] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251\\....\\temporaryfile")) returned 0 [0253.245] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251\\temporaryfile")) returned 1 [0253.247] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be453e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be453e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be453e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.247] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be453e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be453e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be453e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.247] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be453e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be453e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be453e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.247] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be453e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be453e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be453e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.247] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be453e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be453e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be453e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.247] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be453e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be453e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be453e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.247] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.247] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251\\temporaryfile")) returned 1 [0253.247] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be453e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be453e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be453e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.247] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.248] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251")) returned 1 [0253.248] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 0 [0253.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.249] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd5c0*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd5c0*, lpNumberOfBytesWritten=0x18fdd8*=0x4eb0, lpOverlapped=0x0) returned 1 [0253.250] CloseHandle (hObject=0xdc) returned 1 [0253.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.251] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3490 [0253.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3498) returned 0x2c8700 [0253.251] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3490, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3490, lpOverlapped=0x0) returned 1 [0253.252] CloseHandle (hObject=0xdc) returned 1 [0253.252] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0253.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.253] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.253] GetTickCount () returned 0x4eacb [0253.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.257] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.257] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251\\....\\temporaryfile")) returned 0 [0253.258] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251\\temporaryfile")) returned 1 [0253.260] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be6b540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be6b540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be6b540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be6b540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be6b540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be6b540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be6b540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be6b540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be6b540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.260] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be6b540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be6b540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be6b540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.260] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be6b540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be6b540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be6b540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.260] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be6b540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be6b540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be6b540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.260] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.260] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251\\temporaryfile")) returned 1 [0253.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be6b540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be6b540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be6b540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.260] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.260] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322251" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322251")) returned 1 [0253.260] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 0 [0253.261] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.262] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbba8*, nNumberOfBytesToWrite=0x3498, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbba8*, lpNumberOfBytesWritten=0x18fdd8*=0x3498, lpOverlapped=0x0) returned 1 [0253.263] CloseHandle (hObject=0xdc) returned 1 [0253.263] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.263] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5804 [0253.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x580c) returned 0x2c8700 [0253.263] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5804, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5804, lpOverlapped=0x0) returned 1 [0253.267] CloseHandle (hObject=0xdc) returned 1 [0253.267] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0253.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.268] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.268] GetTickCount () returned 0x4eada [0253.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.269] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322266\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322266\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322266\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322266\\....\\temporaryfile")) returned 0 [0253.270] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322266\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322266\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322266\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322266\\temporaryfile")) returned 1 [0253.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322266\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be6b540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.271] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be6b540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.271] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322266\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.271] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.272] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.272] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322266\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322266\\temporaryfile")) returned 1 [0253.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.272] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322266" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322266")) returned 1 [0253.272] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 0 [0253.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.273] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdf20*, nNumberOfBytesToWrite=0x5808, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdf20*, lpNumberOfBytesWritten=0x18fdd8*=0x5808, lpOverlapped=0x0) returned 1 [0253.274] CloseHandle (hObject=0xdc) returned 1 [0253.275] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.275] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x571c [0253.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5724) returned 0x2c8700 [0253.275] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x571c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x571c, lpOverlapped=0x0) returned 1 [0253.277] CloseHandle (hObject=0xdc) returned 1 [0253.277] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0253.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.278] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.278] GetTickCount () returned 0x4eaea [0253.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.278] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322282\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322282\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322282\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322282\\....\\temporaryfile")) returned 0 [0253.279] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322282\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322282\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322282\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322282\\temporaryfile")) returned 1 [0253.280] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322282\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.280] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.280] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.280] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322282\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.281] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.281] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.281] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.281] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322282\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322282\\temporaryfile")) returned 1 [0253.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9be916a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9be916a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9be916a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.281] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.281] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322282" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322282")) returned 1 [0253.281] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 0 [0253.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.282] WriteFile (in: hFile=0xdc, lpBuffer=0x2cde38*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cde38*, lpNumberOfBytesWritten=0x18fdd8*=0x5720, lpOverlapped=0x0) returned 1 [0253.283] CloseHandle (hObject=0xdc) returned 1 [0253.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.285] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x614c [0253.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6154) returned 0x2c8700 [0253.285] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x614c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x614c, lpOverlapped=0x0) returned 1 [0253.286] CloseHandle (hObject=0xdc) returned 1 [0253.286] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0253.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.287] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.288] GetTickCount () returned 0x4eafa [0253.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.288] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.288] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298\\....\\temporaryfile")) returned 0 [0253.289] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298\\temporaryfile")) returned 1 [0253.290] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.290] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.290] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.290] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.290] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.290] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.290] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298\\temporaryfile")) returned 1 [0253.291] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.291] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298")) returned 1 [0253.291] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 0 [0253.292] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.292] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce868*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce868*, lpNumberOfBytesWritten=0x18fdd8*=0x6150, lpOverlapped=0x0) returned 1 [0253.293] CloseHandle (hObject=0xdc) returned 1 [0253.293] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.294] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3ee4 [0253.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3eec) returned 0x2c8700 [0253.294] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3ee4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3ee4, lpOverlapped=0x0) returned 1 [0253.298] CloseHandle (hObject=0xdc) returned 1 [0253.298] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0253.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.299] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.299] GetTickCount () returned 0x4eafa [0253.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.300] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.301] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298\\....\\temporaryfile")) returned 0 [0253.301] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298\\temporaryfile")) returned 1 [0253.302] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bedd960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bedd960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.302] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bedd960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bedd960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.302] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.302] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.302] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.302] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.302] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.302] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298\\temporaryfile")) returned 1 [0253.303] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9beb7800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9beb7800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9beb7800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.303] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.303] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322298" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322298")) returned 1 [0253.303] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 0 [0253.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.304] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc600*, nNumberOfBytesToWrite=0x3ee8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc600*, lpNumberOfBytesWritten=0x18fdd8*=0x3ee8, lpOverlapped=0x0) returned 1 [0253.305] CloseHandle (hObject=0xdc) returned 1 [0253.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.306] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x11b8 [0253.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11c0) returned 0x25b528 [0253.306] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x11b8, lpOverlapped=0x0) returned 1 [0253.307] CloseHandle (hObject=0xdc) returned 1 [0253.307] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0253.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.308] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.308] GetTickCount () returned 0x4eb09 [0253.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.309] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322313\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322313\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.309] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322313\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322313\\....\\temporaryfile")) returned 0 [0253.309] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322313\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322313\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322313\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322313\\temporaryfile")) returned 1 [0253.310] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322313\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bedd960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bedd960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bedd960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.311] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bedd960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bedd960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bedd960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.311] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bedd960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bedd960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bedd960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.311] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322313\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bedd960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bedd960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bedd960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.311] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bedd960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bedd960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bedd960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.311] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bedd960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bedd960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bedd960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.311] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.311] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322313\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322313\\temporaryfile")) returned 1 [0253.311] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bedd960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bedd960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bedd960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.311] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.311] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322313" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322313")) returned 1 [0253.311] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 0 [0253.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.312] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x11c0, lpOverlapped=0x0) returned 1 [0253.313] CloseHandle (hObject=0xdc) returned 1 [0253.313] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.314] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x26f0 [0253.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26f8) returned 0x2c8700 [0253.314] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x26f0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x26f0, lpOverlapped=0x0) returned 1 [0253.315] CloseHandle (hObject=0xdc) returned 1 [0253.315] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0253.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.316] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.316] GetTickCount () returned 0x4eb19 [0253.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.317] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.317] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329\\....\\temporaryfile")) returned 0 [0253.317] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329\\temporaryfile")) returned 1 [0253.319] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.319] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.319] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.319] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.319] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.319] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.319] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.319] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329\\temporaryfile")) returned 1 [0253.319] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.319] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.319] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329")) returned 1 [0253.320] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 0 [0253.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.321] WriteFile (in: hFile=0xdc, lpBuffer=0x2cae08*, nNumberOfBytesToWrite=0x26f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cae08*, lpNumberOfBytesWritten=0x18fdd8*=0x26f8, lpOverlapped=0x0) returned 1 [0253.322] CloseHandle (hObject=0xdc) returned 1 [0253.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.322] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4ef4 [0253.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4efc) returned 0x2c8700 [0253.322] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4ef4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4ef4, lpOverlapped=0x0) returned 1 [0253.324] CloseHandle (hObject=0xdc) returned 1 [0253.324] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0253.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.325] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.325] GetTickCount () returned 0x4eb19 [0253.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.325] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.326] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329\\....\\temporaryfile")) returned 0 [0253.326] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329\\temporaryfile")) returned 1 [0253.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.328] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.328] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.328] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.328] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.328] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.328] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.328] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329\\temporaryfile")) returned 1 [0253.328] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf03ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf03ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf03ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.328] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.328] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322329" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322329")) returned 1 [0253.328] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 0 [0253.329] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.329] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd610*, nNumberOfBytesToWrite=0x4ef8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd610*, lpNumberOfBytesWritten=0x18fdd8*=0x4ef8, lpOverlapped=0x0) returned 1 [0253.330] CloseHandle (hObject=0xdc) returned 1 [0253.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.333] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2168 [0253.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2170) returned 0x2c8700 [0253.333] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2168, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2168, lpOverlapped=0x0) returned 1 [0253.334] CloseHandle (hObject=0xdc) returned 1 [0253.334] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0253.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.335] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.335] GetTickCount () returned 0x4eb28 [0253.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.336] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344\\....\\temporaryfile")) returned 0 [0253.336] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344\\temporaryfile")) returned 1 [0253.337] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.338] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.338] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.338] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.338] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.338] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.338] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.338] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344\\temporaryfile")) returned 1 [0253.338] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.338] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.338] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344")) returned 1 [0253.338] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 0 [0253.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.339] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca880*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca880*, lpNumberOfBytesWritten=0x18fdd8*=0x2170, lpOverlapped=0x0) returned 1 [0253.340] CloseHandle (hObject=0xdc) returned 1 [0253.340] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.341] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f3c [0253.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f44) returned 0x2c8700 [0253.341] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f3c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f3c, lpOverlapped=0x0) returned 1 [0253.342] CloseHandle (hObject=0xdc) returned 1 [0253.342] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0253.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.343] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.343] GetTickCount () returned 0x4eb28 [0253.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.344] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344\\....\\temporaryfile")) returned 0 [0253.345] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344\\temporaryfile")) returned 1 [0253.346] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.346] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.346] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.346] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.346] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.346] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.346] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.346] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344\\temporaryfile")) returned 1 [0253.346] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf29c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf29c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf29c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.346] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.346] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322344" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322344")) returned 1 [0253.347] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 0 [0253.347] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.348] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca658*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca658*, lpNumberOfBytesWritten=0x18fdd8*=0x1f40, lpOverlapped=0x0) returned 1 [0253.348] CloseHandle (hObject=0xdc) returned 1 [0253.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.350] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1498 [0253.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14a0) returned 0x29b460 [0253.350] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1498, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1498, lpOverlapped=0x0) returned 1 [0253.351] CloseHandle (hObject=0xdc) returned 1 [0253.351] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0253.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.352] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.352] GetTickCount () returned 0x4eb38 [0253.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.353] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.353] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360\\....\\temporaryfile")) returned 0 [0253.353] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360\\temporaryfile")) returned 1 [0253.354] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.354] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.355] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.355] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.355] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.355] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.355] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.355] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360\\temporaryfile")) returned 1 [0253.355] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.355] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.355] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360")) returned 1 [0253.355] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 0 [0253.356] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.356] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x14a0, lpOverlapped=0x0) returned 1 [0253.357] CloseHandle (hObject=0xdc) returned 1 [0253.357] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.358] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16ec [0253.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16f4) returned 0x2c4a70 [0253.358] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16ec, lpOverlapped=0x0) returned 1 [0253.359] CloseHandle (hObject=0xdc) returned 1 [0253.359] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0253.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.360] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.360] GetTickCount () returned 0x4eb38 [0253.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.361] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360\\....\\temporaryfile")) returned 0 [0253.361] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360\\temporaryfile")) returned 1 [0253.363] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.363] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.363] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.363] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.363] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.363] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.363] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.363] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360\\temporaryfile")) returned 1 [0253.363] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf4fd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf4fd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf4fd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.363] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.364] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322360" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322360")) returned 1 [0253.364] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 0 [0253.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.365] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x16f0, lpOverlapped=0x0) returned 1 [0253.365] CloseHandle (hObject=0xdc) returned 1 [0253.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.366] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2b64 [0253.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b6c) returned 0x2c8700 [0253.366] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2b64, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2b64, lpOverlapped=0x0) returned 1 [0253.368] CloseHandle (hObject=0xdc) returned 1 [0253.368] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0253.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.369] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.369] GetTickCount () returned 0x4eb48 [0253.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.369] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376\\....\\temporaryfile")) returned 0 [0253.370] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376\\temporaryfile")) returned 1 [0253.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.371] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.371] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.371] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.371] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.371] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.371] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376\\temporaryfile")) returned 1 [0253.371] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.371] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.372] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376")) returned 1 [0253.372] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 0 [0253.372] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.373] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb280*, nNumberOfBytesToWrite=0x2b68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb280*, lpNumberOfBytesWritten=0x18fdd8*=0x2b68, lpOverlapped=0x0) returned 1 [0253.374] CloseHandle (hObject=0xdc) returned 1 [0253.374] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.375] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3734 [0253.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x373c) returned 0x2c8700 [0253.375] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3734, lpOverlapped=0x0) returned 1 [0253.376] CloseHandle (hObject=0xdc) returned 1 [0253.376] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0253.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.377] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.377] GetTickCount () returned 0x4eb48 [0253.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.378] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376\\....\\temporaryfile")) returned 0 [0253.379] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376\\temporaryfile")) returned 1 [0253.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf9c040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf9c040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf9c040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf9c040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.380] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376\\temporaryfile")) returned 1 [0253.381] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf75ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf75ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf75ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.381] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322376" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322376")) returned 1 [0253.381] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 0 [0253.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.382] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbe50*, nNumberOfBytesToWrite=0x3738, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbe50*, lpNumberOfBytesWritten=0x18fdd8*=0x3738, lpOverlapped=0x0) returned 1 [0253.383] CloseHandle (hObject=0xdc) returned 1 [0253.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.383] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x347c [0253.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3484) returned 0x2c8700 [0253.383] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x347c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x347c, lpOverlapped=0x0) returned 1 [0253.385] CloseHandle (hObject=0xdc) returned 1 [0253.385] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0253.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.386] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.386] GetTickCount () returned 0x4eb57 [0253.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.386] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322391\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322391\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.387] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322391\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322391\\....\\temporaryfile")) returned 0 [0253.387] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322391\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322391\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322391\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322391\\temporaryfile")) returned 1 [0253.392] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322391\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf9c040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf9c040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf9c040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.392] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf9c040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf9c040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf9c040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.392] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf9c040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf9c040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf9c040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.392] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322391\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf9c040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf9c040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf9c040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.392] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf9c040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf9c040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf9c040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.392] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf9c040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf9c040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf9c040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.392] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.392] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322391\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322391\\temporaryfile")) returned 1 [0253.393] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bf9c040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bf9c040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bf9c040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.393] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.393] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322391" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322391")) returned 1 [0253.393] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 0 [0253.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.394] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbb98*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbb98*, lpNumberOfBytesWritten=0x18fdd8*=0x3480, lpOverlapped=0x0) returned 1 [0253.395] CloseHandle (hObject=0xdc) returned 1 [0253.395] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.396] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3014 [0253.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x301c) returned 0x2c8700 [0253.396] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3014, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3014, lpOverlapped=0x0) returned 1 [0253.397] CloseHandle (hObject=0xdc) returned 1 [0253.397] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0253.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.398] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.398] GetTickCount () returned 0x4eb67 [0253.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.399] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.399] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407\\....\\temporaryfile")) returned 0 [0253.399] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407\\temporaryfile")) returned 1 [0253.401] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.401] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.401] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.401] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.401] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.401] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.401] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.401] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407\\temporaryfile")) returned 1 [0253.401] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.401] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.401] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407")) returned 1 [0253.402] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 0 [0253.402] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.402] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb730*, nNumberOfBytesToWrite=0x3018, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb730*, lpNumberOfBytesWritten=0x18fdd8*=0x3018, lpOverlapped=0x0) returned 1 [0253.404] CloseHandle (hObject=0xdc) returned 1 [0253.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.405] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x99c [0253.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9a4) returned 0x2350048 [0253.405] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x99c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x99c, lpOverlapped=0x0) returned 1 [0253.406] CloseHandle (hObject=0xdc) returned 1 [0253.406] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0253.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.407] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.407] GetTickCount () returned 0x4eb67 [0253.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.407] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407\\....\\temporaryfile")) returned 0 [0253.408] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407\\temporaryfile")) returned 1 [0253.409] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.410] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.410] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.410] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.410] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.410] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.410] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.410] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407\\temporaryfile")) returned 1 [0253.410] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfc21a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfc21a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfc21a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.410] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.410] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322407" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322407")) returned 1 [0253.410] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 0 [0253.411] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.411] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x9a0, lpOverlapped=0x0) returned 1 [0253.412] CloseHandle (hObject=0xdc) returned 1 [0253.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.413] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1028 [0253.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1030) returned 0x25b528 [0253.413] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1028, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1028, lpOverlapped=0x0) returned 1 [0253.415] CloseHandle (hObject=0xdc) returned 1 [0253.415] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0253.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.416] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.416] GetTickCount () returned 0x4eb76 [0253.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.416] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422\\....\\temporaryfile")) returned 0 [0253.417] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422\\temporaryfile")) returned 1 [0253.418] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.418] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.418] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.418] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.418] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.418] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422\\temporaryfile")) returned 1 [0253.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.419] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.419] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422")) returned 1 [0253.419] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 0 [0253.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.420] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1030, lpOverlapped=0x0) returned 1 [0253.420] CloseHandle (hObject=0xdc) returned 1 [0253.421] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.421] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3e10 [0253.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3e18) returned 0x2c8700 [0253.421] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3e10, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3e10, lpOverlapped=0x0) returned 1 [0253.422] CloseHandle (hObject=0xdc) returned 1 [0253.422] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0253.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.423] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.424] GetTickCount () returned 0x4eb76 [0253.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.424] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.424] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422\\....\\temporaryfile")) returned 0 [0253.425] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422\\temporaryfile")) returned 1 [0253.426] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c00e460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c00e460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.427] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c00e460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c00e460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.427] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.427] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.427] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.427] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.427] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.427] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422\\temporaryfile")) returned 1 [0253.427] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9bfe8300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9bfe8300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9bfe8300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.427] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.427] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322422" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322422")) returned 1 [0253.427] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 0 [0253.428] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.428] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc528*, nNumberOfBytesToWrite=0x3e18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc528*, lpNumberOfBytesWritten=0x18fdd8*=0x3e18, lpOverlapped=0x0) returned 1 [0253.429] CloseHandle (hObject=0xdc) returned 1 [0253.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.430] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a64 [0253.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a6c) returned 0x2c8700 [0253.430] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2a64, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2a64, lpOverlapped=0x0) returned 1 [0253.431] CloseHandle (hObject=0xdc) returned 1 [0253.431] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0253.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.432] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.432] GetTickCount () returned 0x4eb86 [0253.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.433] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322438\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322438\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322438\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322438\\....\\temporaryfile")) returned 0 [0253.434] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322438\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322438\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322438\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322438\\temporaryfile")) returned 1 [0253.435] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322438\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c00e460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c00e460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c00e460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.435] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c00e460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c00e460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c00e460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.435] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c00e460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c00e460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c00e460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.435] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322438\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c00e460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c00e460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c00e460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.435] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c00e460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c00e460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c00e460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.435] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c00e460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c00e460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c00e460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.435] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.435] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322438\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322438\\temporaryfile")) returned 1 [0253.435] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c00e460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c00e460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c00e460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.435] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.436] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322438" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322438")) returned 1 [0253.436] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 0 [0253.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.437] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb180*, nNumberOfBytesToWrite=0x2a68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb180*, lpNumberOfBytesWritten=0x18fdd8*=0x2a68, lpOverlapped=0x0) returned 1 [0253.438] CloseHandle (hObject=0xdc) returned 1 [0253.438] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.439] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2c18 [0253.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c20) returned 0x2c8700 [0253.439] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2c18, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2c18, lpOverlapped=0x0) returned 1 [0253.441] CloseHandle (hObject=0xdc) returned 1 [0253.441] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0253.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.442] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.442] GetTickCount () returned 0x4eb96 [0253.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.443] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.443] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454\\....\\temporaryfile")) returned 0 [0253.443] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454\\temporaryfile")) returned 1 [0253.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.445] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.445] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.445] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.445] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.445] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.445] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454\\temporaryfile")) returned 1 [0253.445] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.445] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.445] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454")) returned 1 [0253.445] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 0 [0253.446] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.446] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb330*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb330*, lpNumberOfBytesWritten=0x18fdd8*=0x2c20, lpOverlapped=0x0) returned 1 [0253.447] CloseHandle (hObject=0xdc) returned 1 [0253.447] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.449] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1984 [0253.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x198c) returned 0x2c4a70 [0253.449] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1984, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1984, lpOverlapped=0x0) returned 1 [0253.450] CloseHandle (hObject=0xdc) returned 1 [0253.450] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0253.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.451] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.451] GetTickCount () returned 0x4eb96 [0253.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.452] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454\\....\\temporaryfile")) returned 0 [0253.452] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454\\temporaryfile")) returned 1 [0253.453] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.453] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.454] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.454] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.454] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.454] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.454] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.454] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454\\temporaryfile")) returned 1 [0253.454] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0345c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0345c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0345c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.454] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.454] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322454" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322454")) returned 1 [0253.454] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 0 [0253.455] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.455] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1988, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1988, lpOverlapped=0x0) returned 1 [0253.456] CloseHandle (hObject=0xdc) returned 1 [0253.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.457] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1094 [0253.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x109c) returned 0x25b528 [0253.457] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1094, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1094, lpOverlapped=0x0) returned 1 [0253.458] CloseHandle (hObject=0xdc) returned 1 [0253.459] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0253.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.459] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.459] GetTickCount () returned 0x4eba5 [0253.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.460] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469\\....\\temporaryfile")) returned 0 [0253.461] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469\\temporaryfile")) returned 1 [0253.462] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.462] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.462] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.462] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.462] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.462] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.462] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.462] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469\\temporaryfile")) returned 1 [0253.462] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.462] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.463] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469")) returned 1 [0253.463] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 0 [0253.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.464] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1098, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1098, lpOverlapped=0x0) returned 1 [0253.465] CloseHandle (hObject=0xdc) returned 1 [0253.465] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.466] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13d4 [0253.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13dc) returned 0x25b528 [0253.466] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13d4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13d4, lpOverlapped=0x0) returned 1 [0253.467] CloseHandle (hObject=0xdc) returned 1 [0253.467] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0253.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.468] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.468] GetTickCount () returned 0x4eba5 [0253.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.469] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469\\....\\temporaryfile")) returned 0 [0253.469] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469\\temporaryfile")) returned 1 [0253.470] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.471] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.471] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.471] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.471] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.471] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.471] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.471] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469\\temporaryfile")) returned 1 [0253.471] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c05a720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c05a720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c05a720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.471] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.471] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322469" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322469")) returned 1 [0253.471] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 0 [0253.472] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.472] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x13d8, lpOverlapped=0x0) returned 1 [0253.473] CloseHandle (hObject=0xdc) returned 1 [0253.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.474] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5c78 [0253.474] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5c80) returned 0x2c8700 [0253.474] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5c78, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5c78, lpOverlapped=0x0) returned 1 [0253.476] CloseHandle (hObject=0xdc) returned 1 [0253.476] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0253.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.477] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.477] GetTickCount () returned 0x4ebb5 [0253.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.478] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.478] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485\\....\\temporaryfile")) returned 0 [0253.478] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485\\temporaryfile")) returned 1 [0253.479] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.479] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.479] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.479] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.480] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.480] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485\\temporaryfile")) returned 1 [0253.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.480] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.480] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485")) returned 1 [0253.480] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 0 [0253.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.481] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce390*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce390*, lpNumberOfBytesWritten=0x18fdd8*=0x5c80, lpOverlapped=0x0) returned 1 [0253.483] CloseHandle (hObject=0xdc) returned 1 [0253.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.483] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f1c [0253.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f24) returned 0x2c8700 [0253.483] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f1c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f1c, lpOverlapped=0x0) returned 1 [0253.485] CloseHandle (hObject=0xdc) returned 1 [0253.485] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0253.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.485] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.486] GetTickCount () returned 0x4ebb5 [0253.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.486] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485\\....\\temporaryfile")) returned 0 [0253.487] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485\\temporaryfile")) returned 1 [0253.488] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.488] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.488] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.489] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.489] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.489] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.489] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485\\temporaryfile")) returned 1 [0253.489] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c080880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c080880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c080880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.489] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322485" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322485")) returned 1 [0253.489] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 0 [0253.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.490] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca638*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca638*, lpNumberOfBytesWritten=0x18fdd8*=0x1f20, lpOverlapped=0x0) returned 1 [0253.491] CloseHandle (hObject=0xdc) returned 1 [0253.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.492] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x40cc [0253.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40d4) returned 0x2c8700 [0253.492] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x40cc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x40cc, lpOverlapped=0x0) returned 1 [0253.493] CloseHandle (hObject=0xdc) returned 1 [0253.493] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0253.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.494] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.494] GetTickCount () returned 0x4ebc4 [0253.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.495] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500\\....\\temporaryfile")) returned 0 [0253.495] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500\\temporaryfile")) returned 1 [0253.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0a69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0a69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0a69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0a69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0a69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0a69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0a69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0a69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0a69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0a69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0a69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0a69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0a69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0a69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0a69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0a69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0a69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0a69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.497] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500\\temporaryfile")) returned 1 [0253.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0a69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0a69e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0a69e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.497] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500")) returned 1 [0253.497] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 0 [0253.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.498] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc7e8*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc7e8*, lpNumberOfBytesWritten=0x18fdd8*=0x40d0, lpOverlapped=0x0) returned 1 [0253.499] CloseHandle (hObject=0xdc) returned 1 [0253.500] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.500] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2ce4 [0253.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2cec) returned 0x2c8700 [0253.500] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2ce4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2ce4, lpOverlapped=0x0) returned 1 [0253.501] CloseHandle (hObject=0xdc) returned 1 [0253.501] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0253.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.502] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.502] GetTickCount () returned 0x4ebc4 [0253.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.503] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500\\....\\temporaryfile")) returned 0 [0253.504] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500\\temporaryfile")) returned 1 [0253.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0a69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.505] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0a69e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.505] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.506] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.506] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.506] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.506] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500\\temporaryfile")) returned 1 [0253.506] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.506] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.506] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322500" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322500")) returned 1 [0253.506] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 0 [0253.507] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.507] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb400*, nNumberOfBytesToWrite=0x2ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb400*, lpNumberOfBytesWritten=0x18fdd8*=0x2ce8, lpOverlapped=0x0) returned 1 [0253.508] CloseHandle (hObject=0xdc) returned 1 [0253.508] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.509] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7680 [0253.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7688) returned 0x2c8700 [0253.509] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7680, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7680, lpOverlapped=0x0) returned 1 [0253.510] CloseHandle (hObject=0xdc) returned 1 [0253.510] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0253.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.511] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.511] GetTickCount () returned 0x4ebd4 [0253.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.512] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322516\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322516\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322516\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322516\\....\\temporaryfile")) returned 0 [0253.513] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322516\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322516\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322516\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322516\\temporaryfile")) returned 1 [0253.514] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322516\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.514] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.514] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.514] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322516\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.514] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.514] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.514] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322516\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322516\\temporaryfile")) returned 1 [0253.514] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0ccb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0ccb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0ccb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.514] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.515] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322516" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322516")) returned 1 [0253.515] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 0 [0253.515] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.516] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfd98*, nNumberOfBytesToWrite=0x7688, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfd98*, lpNumberOfBytesWritten=0x18fdd8*=0x7688, lpOverlapped=0x0) returned 1 [0253.517] CloseHandle (hObject=0xdc) returned 1 [0253.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.522] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1338 [0253.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1340) returned 0x25b528 [0253.522] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1338, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1338, lpOverlapped=0x0) returned 1 [0253.523] CloseHandle (hObject=0xdc) returned 1 [0253.523] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0253.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.524] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.524] GetTickCount () returned 0x4ebe4 [0253.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.525] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532\\....\\temporaryfile")) returned 0 [0253.526] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532\\temporaryfile")) returned 1 [0253.527] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.527] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.527] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.527] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.527] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.527] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.527] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.527] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532\\temporaryfile")) returned 1 [0253.527] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.527] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.527] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532")) returned 1 [0253.528] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 0 [0253.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.528] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1340, lpOverlapped=0x0) returned 1 [0253.529] CloseHandle (hObject=0xdc) returned 1 [0253.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.531] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x52e0 [0253.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x52e8) returned 0x2c8700 [0253.531] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x52e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x52e0, lpOverlapped=0x0) returned 1 [0253.532] CloseHandle (hObject=0xdc) returned 1 [0253.532] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0253.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.533] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.533] GetTickCount () returned 0x4ebe4 [0253.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.534] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532\\....\\temporaryfile")) returned 0 [0253.535] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532\\temporaryfile")) returned 1 [0253.536] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c118e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c118e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.536] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c118e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c118e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.536] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.536] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.536] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.536] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.536] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.536] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532\\temporaryfile")) returned 1 [0253.537] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c0f2ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c0f2ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c0f2ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.537] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.537] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322532" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322532")) returned 1 [0253.537] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 0 [0253.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.538] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd9f8*, nNumberOfBytesToWrite=0x52e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd9f8*, lpNumberOfBytesWritten=0x18fdd8*=0x52e8, lpOverlapped=0x0) returned 1 [0253.539] CloseHandle (hObject=0xdc) returned 1 [0253.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.540] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe8c [0253.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe94) returned 0x2350048 [0253.540] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe8c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe8c, lpOverlapped=0x0) returned 1 [0253.541] CloseHandle (hObject=0xdc) returned 1 [0253.541] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0253.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.542] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.542] GetTickCount () returned 0x4ebf3 [0253.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.543] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322547\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322547\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322547\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322547\\....\\temporaryfile")) returned 0 [0253.544] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322547\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322547\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322547\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322547\\temporaryfile")) returned 1 [0253.545] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322547\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c118e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c118e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c118e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.545] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c118e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c118e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c118e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.545] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c118e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c118e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c118e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.545] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322547\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c118e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c118e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c118e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.545] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c118e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c118e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c118e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.545] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c118e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c118e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c118e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.545] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.545] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322547\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322547\\temporaryfile")) returned 1 [0253.546] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c118e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c118e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c118e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.546] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.546] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322547" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322547")) returned 1 [0253.546] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 0 [0253.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.547] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe90, lpOverlapped=0x0) returned 1 [0253.548] CloseHandle (hObject=0xdc) returned 1 [0253.548] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.549] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdf0 [0253.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdf8) returned 0x2350048 [0253.549] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xdf0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xdf0, lpOverlapped=0x0) returned 1 [0253.550] CloseHandle (hObject=0xdc) returned 1 [0253.550] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0253.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.551] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.551] GetTickCount () returned 0x4ec03 [0253.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.552] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563\\....\\temporaryfile")) returned 0 [0253.552] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563\\temporaryfile")) returned 1 [0253.554] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.554] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.554] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.554] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.554] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.554] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.554] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.554] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563\\temporaryfile")) returned 1 [0253.554] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.554] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.555] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563")) returned 1 [0253.555] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 0 [0253.555] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.556] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xdf8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xdf8, lpOverlapped=0x0) returned 1 [0253.556] CloseHandle (hObject=0xdc) returned 1 [0253.557] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.557] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x258c [0253.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2594) returned 0x2c8700 [0253.557] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x258c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x258c, lpOverlapped=0x0) returned 1 [0253.558] CloseHandle (hObject=0xdc) returned 1 [0253.558] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0253.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.559] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.559] GetTickCount () returned 0x4ec03 [0253.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.560] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563\\....\\temporaryfile")) returned 0 [0253.561] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563\\temporaryfile")) returned 1 [0253.562] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.562] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.562] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.562] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.562] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.562] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563\\temporaryfile")) returned 1 [0253.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c13ef60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c13ef60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c13ef60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.563] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.563] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322563" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322563")) returned 1 [0253.563] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 0 [0253.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.564] WriteFile (in: hFile=0xdc, lpBuffer=0x2caca8*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caca8*, lpNumberOfBytesWritten=0x18fdd8*=0x2590, lpOverlapped=0x0) returned 1 [0253.565] CloseHandle (hObject=0xdc) returned 1 [0253.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.565] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1788 [0253.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1790) returned 0x2c4a70 [0253.566] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1788, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1788, lpOverlapped=0x0) returned 1 [0253.567] CloseHandle (hObject=0xdc) returned 1 [0253.567] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0253.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.568] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.568] GetTickCount () returned 0x4ec12 [0253.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.568] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578\\....\\temporaryfile")) returned 0 [0253.569] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578\\temporaryfile")) returned 1 [0253.570] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.570] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.570] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.570] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.570] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.570] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.570] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.571] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578\\temporaryfile")) returned 1 [0253.571] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.571] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.571] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578")) returned 1 [0253.571] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 0 [0253.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.572] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1790, lpOverlapped=0x0) returned 1 [0253.573] CloseHandle (hObject=0xdc) returned 1 [0253.573] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.573] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1374 [0253.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x137c) returned 0x25b528 [0253.573] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1374, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1374, lpOverlapped=0x0) returned 1 [0253.575] CloseHandle (hObject=0xdc) returned 1 [0253.575] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0253.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.576] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.576] GetTickCount () returned 0x4ec12 [0253.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.576] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578\\....\\temporaryfile")) returned 0 [0253.577] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578\\temporaryfile")) returned 1 [0253.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.578] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.578] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.578] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.578] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.578] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.579] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578\\temporaryfile")) returned 1 [0253.579] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1650c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1650c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1650c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.579] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.579] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322578" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322578")) returned 1 [0253.579] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 0 [0253.579] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.580] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1378, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1378, lpOverlapped=0x0) returned 1 [0253.581] CloseHandle (hObject=0xdc) returned 1 [0253.581] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.582] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbe0 [0253.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbe8) returned 0x2350048 [0253.582] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xbe0, lpOverlapped=0x0) returned 1 [0253.583] CloseHandle (hObject=0xdc) returned 1 [0253.584] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0253.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.584] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.584] GetTickCount () returned 0x4ec22 [0253.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.585] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594\\....\\temporaryfile")) returned 0 [0253.586] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594\\temporaryfile")) returned 1 [0253.587] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.587] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.587] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.587] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.587] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.587] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.587] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.587] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594\\temporaryfile")) returned 1 [0253.587] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.587] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.588] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594")) returned 1 [0253.588] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 0 [0253.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.588] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xbe8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xbe8, lpOverlapped=0x0) returned 1 [0253.589] CloseHandle (hObject=0xdc) returned 1 [0253.590] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.590] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f40 [0253.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f48) returned 0x2c8700 [0253.590] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f40, lpOverlapped=0x0) returned 1 [0253.592] CloseHandle (hObject=0xdc) returned 1 [0253.593] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0253.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.593] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.593] GetTickCount () returned 0x4ec22 [0253.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.594] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.595] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594\\....\\temporaryfile")) returned 0 [0253.595] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594\\temporaryfile")) returned 1 [0253.596] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.596] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.596] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.596] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.596] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.596] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.596] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.596] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594\\temporaryfile")) returned 1 [0253.601] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c18b220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c18b220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c18b220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.601] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322594" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322594")) returned 1 [0253.602] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 0 [0253.602] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.602] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca658*, nNumberOfBytesToWrite=0x1f48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca658*, lpNumberOfBytesWritten=0x18fdd8*=0x1f48, lpOverlapped=0x0) returned 1 [0253.603] CloseHandle (hObject=0xdc) returned 1 [0253.603] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.604] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4054 [0253.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x405c) returned 0x2c8700 [0253.604] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4054, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4054, lpOverlapped=0x0) returned 1 [0253.605] CloseHandle (hObject=0xdc) returned 1 [0253.605] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0253.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.606] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.606] GetTickCount () returned 0x4ec32 [0253.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.607] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322610\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322610\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.607] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322610\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322610\\....\\temporaryfile")) returned 0 [0253.607] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322610\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322610\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322610\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322610\\temporaryfile")) returned 1 [0253.609] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322610\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1b1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1b1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1b1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.609] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1b1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1b1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1b1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.609] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1b1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1b1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1b1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.609] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322610\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1b1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1b1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1b1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.609] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1b1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1b1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1b1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.609] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1b1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1b1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1b1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.609] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.609] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322610\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322610\\temporaryfile")) returned 1 [0253.609] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1b1380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1b1380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1b1380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.609] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.609] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322610" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322610")) returned 1 [0253.609] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 0 [0253.610] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.611] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc770*, nNumberOfBytesToWrite=0x4058, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc770*, lpNumberOfBytesWritten=0x18fdd8*=0x4058, lpOverlapped=0x0) returned 1 [0253.612] CloseHandle (hObject=0xdc) returned 1 [0253.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.613] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1acc [0253.613] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ad4) returned 0x2c4a70 [0253.613] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1acc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1acc, lpOverlapped=0x0) returned 1 [0253.614] CloseHandle (hObject=0xdc) returned 1 [0253.614] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0253.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.615] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.616] GetTickCount () returned 0x4ec41 [0253.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.616] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625\\....\\temporaryfile")) returned 0 [0253.617] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625\\temporaryfile")) returned 1 [0253.618] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.618] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.618] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.618] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.618] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.618] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.618] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.618] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625\\temporaryfile")) returned 1 [0253.619] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.619] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.619] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625")) returned 1 [0253.619] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 0 [0253.619] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.620] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1ad0, lpOverlapped=0x0) returned 1 [0253.621] CloseHandle (hObject=0xdc) returned 1 [0253.621] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.622] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1918 [0253.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1920) returned 0x2c4a70 [0253.622] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1918, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1918, lpOverlapped=0x0) returned 1 [0253.623] CloseHandle (hObject=0xdc) returned 1 [0253.623] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0253.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.624] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.624] GetTickCount () returned 0x4ec41 [0253.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.625] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625\\....\\temporaryfile")) returned 0 [0253.625] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625\\temporaryfile")) returned 1 [0253.627] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.627] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.627] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.627] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.627] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.627] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.627] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.627] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625\\temporaryfile")) returned 1 [0253.628] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1d74e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1d74e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1d74e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.628] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.628] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322625" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322625")) returned 1 [0253.628] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 0 [0253.628] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.629] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1920, lpOverlapped=0x0) returned 1 [0253.630] CloseHandle (hObject=0xdc) returned 1 [0253.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.630] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x22a0 [0253.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22a8) returned 0x2c8700 [0253.630] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x22a0, lpOverlapped=0x0) returned 1 [0253.632] CloseHandle (hObject=0xdc) returned 1 [0253.632] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0253.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.633] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.633] GetTickCount () returned 0x4ec51 [0253.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.633] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.634] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641\\....\\temporaryfile")) returned 0 [0253.634] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641\\temporaryfile")) returned 1 [0253.635] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.635] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.635] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.635] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.635] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.635] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.635] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.636] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641\\temporaryfile")) returned 1 [0253.636] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.636] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.636] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641")) returned 1 [0253.636] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 0 [0253.636] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.637] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca9b8*, nNumberOfBytesToWrite=0x22a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca9b8*, lpNumberOfBytesWritten=0x18fdd8*=0x22a8, lpOverlapped=0x0) returned 1 [0253.638] CloseHandle (hObject=0xdc) returned 1 [0253.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.639] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1068 [0253.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1070) returned 0x25b528 [0253.639] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1068, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1068, lpOverlapped=0x0) returned 1 [0253.640] CloseHandle (hObject=0xdc) returned 1 [0253.640] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0253.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.641] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.641] GetTickCount () returned 0x4ec51 [0253.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.641] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.642] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641\\....\\temporaryfile")) returned 0 [0253.642] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641\\temporaryfile")) returned 1 [0253.644] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.644] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.644] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.644] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.644] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.644] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.644] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.644] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641\\temporaryfile")) returned 1 [0253.644] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c1fd640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c1fd640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c1fd640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.644] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.644] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322641" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322641")) returned 1 [0253.645] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 0 [0253.645] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.645] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1070, lpOverlapped=0x0) returned 1 [0253.646] CloseHandle (hObject=0xdc) returned 1 [0253.646] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.647] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a54 [0253.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a5c) returned 0x2c8700 [0253.647] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2a54, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2a54, lpOverlapped=0x0) returned 1 [0253.648] CloseHandle (hObject=0xdc) returned 1 [0253.648] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0253.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.649] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.649] GetTickCount () returned 0x4ec60 [0253.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.650] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322656\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322656\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322656\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322656\\....\\temporaryfile")) returned 0 [0253.650] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322656\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322656\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322656\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322656\\temporaryfile")) returned 1 [0253.652] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322656\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2237a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2237a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2237a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.652] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2237a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2237a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2237a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.652] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2237a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2237a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2237a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.652] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322656\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2237a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2237a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2237a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.652] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2237a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2237a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2237a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.652] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2237a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2237a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2237a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.652] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.652] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322656\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322656\\temporaryfile")) returned 1 [0253.656] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2237a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2237a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2237a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.656] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.656] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322656" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322656")) returned 1 [0253.656] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 0 [0253.657] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.657] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb170*, nNumberOfBytesToWrite=0x2a58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb170*, lpNumberOfBytesWritten=0x18fdd8*=0x2a58, lpOverlapped=0x0) returned 1 [0253.658] CloseHandle (hObject=0xdc) returned 1 [0253.658] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.659] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2c8c [0253.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c94) returned 0x2c8700 [0253.659] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2c8c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2c8c, lpOverlapped=0x0) returned 1 [0253.660] CloseHandle (hObject=0xdc) returned 1 [0253.660] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0253.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.661] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.661] GetTickCount () returned 0x4ec70 [0253.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.662] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672\\....\\temporaryfile")) returned 0 [0253.662] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672\\temporaryfile")) returned 1 [0253.664] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.664] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.664] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.664] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.664] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.664] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.664] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.664] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672\\temporaryfile")) returned 1 [0253.664] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.664] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.664] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672")) returned 1 [0253.665] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 0 [0253.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.666] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb3a8*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb3a8*, lpNumberOfBytesWritten=0x18fdd8*=0x2c90, lpOverlapped=0x0) returned 1 [0253.667] CloseHandle (hObject=0xdc) returned 1 [0253.667] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.668] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2fac [0253.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2fb4) returned 0x2c8700 [0253.668] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2fac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2fac, lpOverlapped=0x0) returned 1 [0253.670] CloseHandle (hObject=0xdc) returned 1 [0253.670] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0253.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.671] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.671] GetTickCount () returned 0x4ec70 [0253.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.671] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672\\....\\temporaryfile")) returned 0 [0253.672] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672\\temporaryfile")) returned 1 [0253.673] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.673] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.673] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.674] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.674] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.674] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.674] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.674] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672\\temporaryfile")) returned 1 [0253.674] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c249900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c249900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c249900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.674] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.674] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322672" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322672")) returned 1 [0253.674] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 0 [0253.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.675] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb6c8*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb6c8*, lpNumberOfBytesWritten=0x18fdd8*=0x2fb0, lpOverlapped=0x0) returned 1 [0253.676] CloseHandle (hObject=0xdc) returned 1 [0253.677] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.678] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x36b8 [0253.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36c0) returned 0x2c8700 [0253.678] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x36b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x36b8, lpOverlapped=0x0) returned 1 [0253.679] CloseHandle (hObject=0xdc) returned 1 [0253.679] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0253.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.680] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.680] GetTickCount () returned 0x4ec80 [0253.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.681] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688\\....\\temporaryfile")) returned 0 [0253.681] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688\\temporaryfile")) returned 1 [0253.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.683] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.683] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.683] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.683] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688\\temporaryfile")) returned 1 [0253.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.683] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.683] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688")) returned 1 [0253.684] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 0 [0253.684] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.684] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbdd0*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbdd0*, lpNumberOfBytesWritten=0x18fdd8*=0x36c0, lpOverlapped=0x0) returned 1 [0253.686] CloseHandle (hObject=0xdc) returned 1 [0253.686] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.686] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f0c [0253.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f14) returned 0x2c8700 [0253.686] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f0c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f0c, lpOverlapped=0x0) returned 1 [0253.688] CloseHandle (hObject=0xdc) returned 1 [0253.688] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0253.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.689] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.689] GetTickCount () returned 0x4ec80 [0253.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.689] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.690] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688\\....\\temporaryfile")) returned 0 [0253.690] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688\\temporaryfile")) returned 1 [0253.692] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c295bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c295bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.692] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c295bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c295bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.692] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.692] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.692] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.692] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.692] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.692] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688\\temporaryfile")) returned 1 [0253.692] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c26fa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c26fa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c26fa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.692] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.692] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322688" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322688")) returned 1 [0253.692] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 0 [0253.693] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.693] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca628*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca628*, lpNumberOfBytesWritten=0x18fdd8*=0x1f10, lpOverlapped=0x0) returned 1 [0253.694] CloseHandle (hObject=0xdc) returned 1 [0253.694] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.695] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a88 [0253.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a90) returned 0x2c4a70 [0253.695] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1a88, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a88, lpOverlapped=0x0) returned 1 [0253.696] CloseHandle (hObject=0xdc) returned 1 [0253.696] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0253.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.697] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.697] GetTickCount () returned 0x4ec8f [0253.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.698] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322703\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322703\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322703\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322703\\....\\temporaryfile")) returned 0 [0253.699] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322703\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322703\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322703\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322703\\temporaryfile")) returned 1 [0253.700] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322703\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c295bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c295bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c295bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.700] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c295bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c295bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c295bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.700] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c295bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c295bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c295bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.700] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322703\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c295bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c295bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c295bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.700] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c295bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c295bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c295bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.700] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c295bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c295bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c295bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.700] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.700] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322703\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322703\\temporaryfile")) returned 1 [0253.701] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c295bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c295bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c295bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.701] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.701] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322703" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322703")) returned 1 [0253.701] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 0 [0253.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.702] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1a90, lpOverlapped=0x0) returned 1 [0253.703] CloseHandle (hObject=0xdc) returned 1 [0253.703] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.703] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6890 [0253.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6898) returned 0x2c8700 [0253.703] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6890, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6890, lpOverlapped=0x0) returned 1 [0253.705] CloseHandle (hObject=0xdc) returned 1 [0253.705] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0253.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.706] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.706] GetTickCount () returned 0x4ec9f [0253.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.707] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.707] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719\\....\\temporaryfile")) returned 0 [0253.707] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719\\temporaryfile")) returned 1 [0253.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.708] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.708] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.709] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.709] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.709] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.709] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719\\temporaryfile")) returned 1 [0253.709] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.709] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.709] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719")) returned 1 [0253.709] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 0 [0253.710] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.710] WriteFile (in: hFile=0xdc, lpBuffer=0x2cefa8*, nNumberOfBytesToWrite=0x6898, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cefa8*, lpNumberOfBytesWritten=0x18fdd8*=0x6898, lpOverlapped=0x0) returned 1 [0253.711] CloseHandle (hObject=0xdc) returned 1 [0253.712] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.712] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ba0 [0253.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ba8) returned 0x2c4a70 [0253.712] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1ba0, lpOverlapped=0x0) returned 1 [0253.714] CloseHandle (hObject=0xdc) returned 1 [0253.714] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0253.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.715] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.715] GetTickCount () returned 0x4ec9f [0253.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.715] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719\\....\\temporaryfile")) returned 0 [0253.716] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719\\temporaryfile")) returned 1 [0253.717] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.717] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.717] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.717] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.717] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.717] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.717] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.718] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719\\temporaryfile")) returned 1 [0253.718] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2bbd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2bbd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2bbd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.718] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.718] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322719" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322719")) returned 1 [0253.718] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 0 [0253.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.719] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1ba8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1ba8, lpOverlapped=0x0) returned 1 [0253.720] CloseHandle (hObject=0xdc) returned 1 [0253.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.723] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x12c8 [0253.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12d0) returned 0x25b528 [0253.723] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12c8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x12c8, lpOverlapped=0x0) returned 1 [0253.724] CloseHandle (hObject=0xdc) returned 1 [0253.725] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0253.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.725] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.725] GetTickCount () returned 0x4ecae [0253.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.726] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.726] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734\\....\\temporaryfile")) returned 0 [0253.727] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734\\temporaryfile")) returned 1 [0253.728] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.728] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.728] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.728] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.728] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.728] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.728] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.728] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734\\temporaryfile")) returned 1 [0253.728] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.728] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.728] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734")) returned 1 [0253.729] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 0 [0253.729] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.729] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x12d0, lpOverlapped=0x0) returned 1 [0253.730] CloseHandle (hObject=0xdc) returned 1 [0253.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.731] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x121c [0253.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1224) returned 0x25b528 [0253.731] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x121c, lpOverlapped=0x0) returned 1 [0253.733] CloseHandle (hObject=0xdc) returned 1 [0253.733] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0253.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.734] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.734] GetTickCount () returned 0x4ecae [0253.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.734] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734\\....\\temporaryfile")) returned 0 [0253.735] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734\\temporaryfile")) returned 1 [0253.736] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.737] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.737] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734\\temporaryfile")) returned 1 [0253.737] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c2e1e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c2e1e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c2e1e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.737] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322734" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322734")) returned 1 [0253.737] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 0 [0253.738] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.738] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1220, lpOverlapped=0x0) returned 1 [0253.739] CloseHandle (hObject=0xdc) returned 1 [0253.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.740] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xed8 [0253.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xee0) returned 0x2350048 [0253.740] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xed8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xed8, lpOverlapped=0x0) returned 1 [0253.741] CloseHandle (hObject=0xdc) returned 1 [0253.741] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0253.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.742] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.742] GetTickCount () returned 0x4ecbe [0253.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.743] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750\\....\\temporaryfile")) returned 0 [0253.744] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750\\temporaryfile")) returned 1 [0253.745] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.745] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.745] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.745] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.745] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.745] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.745] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750\\temporaryfile")) returned 1 [0253.745] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.745] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750")) returned 1 [0253.746] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 0 [0253.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.746] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xee0, lpOverlapped=0x0) returned 1 [0253.747] CloseHandle (hObject=0xdc) returned 1 [0253.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.749] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2044 [0253.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x204c) returned 0x2c8700 [0253.749] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2044, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2044, lpOverlapped=0x0) returned 1 [0253.751] CloseHandle (hObject=0xdc) returned 1 [0253.751] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0253.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.752] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.752] GetTickCount () returned 0x4ecbe [0253.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.752] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.752] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750\\....\\temporaryfile")) returned 0 [0253.753] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750\\temporaryfile")) returned 1 [0253.754] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c32e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c32e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.754] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c32e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c32e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.755] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.755] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.755] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.755] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.755] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750\\temporaryfile")) returned 1 [0253.755] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c307fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c307fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c307fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.755] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.755] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322750" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322750")) returned 1 [0253.755] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 0 [0253.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.756] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca760*, nNumberOfBytesToWrite=0x2048, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca760*, lpNumberOfBytesWritten=0x18fdd8*=0x2048, lpOverlapped=0x0) returned 1 [0253.757] CloseHandle (hObject=0xdc) returned 1 [0253.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.758] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b68 [0253.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b70) returned 0x2c4a70 [0253.758] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b68, lpOverlapped=0x0) returned 1 [0253.759] CloseHandle (hObject=0xdc) returned 1 [0253.759] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0253.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.760] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.760] GetTickCount () returned 0x4ecce [0253.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.761] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322766\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322766\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322766\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322766\\....\\temporaryfile")) returned 0 [0253.762] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322766\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322766\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322766\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322766\\temporaryfile")) returned 1 [0253.763] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322766\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c32e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c32e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c32e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.763] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c32e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c32e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c32e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.763] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c32e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c32e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c32e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.763] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322766\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c32e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c32e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c32e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.763] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c32e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c32e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c32e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.763] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c32e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c32e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c32e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.763] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322766\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322766\\temporaryfile")) returned 1 [0253.764] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c32e140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c32e140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c32e140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.764] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.764] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322766" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322766")) returned 1 [0253.764] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 0 [0253.764] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.765] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b70, lpOverlapped=0x0) returned 1 [0253.766] CloseHandle (hObject=0xdc) returned 1 [0253.766] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.766] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1574 [0253.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x157c) returned 0x29b460 [0253.766] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1574, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1574, lpOverlapped=0x0) returned 1 [0253.768] CloseHandle (hObject=0xdc) returned 1 [0253.768] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0253.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.769] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.769] GetTickCount () returned 0x4ecdd [0253.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.769] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781\\....\\temporaryfile")) returned 0 [0253.770] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781\\temporaryfile")) returned 1 [0253.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.771] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.771] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.771] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781\\temporaryfile")) returned 1 [0253.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.772] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781")) returned 1 [0253.772] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 0 [0253.772] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.773] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1578, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1578, lpOverlapped=0x0) returned 1 [0253.774] CloseHandle (hObject=0xdc) returned 1 [0253.774] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.775] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbf4 [0253.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbfc) returned 0x2350048 [0253.775] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xbf4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xbf4, lpOverlapped=0x0) returned 1 [0253.776] CloseHandle (hObject=0xdc) returned 1 [0253.776] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0253.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.777] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.777] GetTickCount () returned 0x4ecdd [0253.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.778] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781\\....\\temporaryfile")) returned 0 [0253.778] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781\\temporaryfile")) returned 1 [0253.780] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.780] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.780] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.780] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.780] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.780] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.780] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.780] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781\\temporaryfile")) returned 1 [0253.780] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3542a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3542a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3542a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.780] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.780] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322781" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322781")) returned 1 [0253.781] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 0 [0253.781] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.781] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xbf8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xbf8, lpOverlapped=0x0) returned 1 [0253.782] CloseHandle (hObject=0xdc) returned 1 [0253.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.788] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc44 [0253.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc4c) returned 0x2350048 [0253.788] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xc44, lpOverlapped=0x0) returned 1 [0253.789] CloseHandle (hObject=0xdc) returned 1 [0253.789] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0253.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.790] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.790] GetTickCount () returned 0x4eced [0253.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.791] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797\\....\\temporaryfile")) returned 0 [0253.791] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797\\temporaryfile")) returned 1 [0253.792] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.793] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.793] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.793] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.793] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.793] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.793] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.793] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797\\temporaryfile")) returned 1 [0253.793] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.793] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.793] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797")) returned 1 [0253.793] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 0 [0253.794] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.794] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xc48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xc48, lpOverlapped=0x0) returned 1 [0253.795] CloseHandle (hObject=0xdc) returned 1 [0253.795] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.796] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe3c [0253.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe44) returned 0x2350048 [0253.796] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe3c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe3c, lpOverlapped=0x0) returned 1 [0253.797] CloseHandle (hObject=0xdc) returned 1 [0253.797] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0253.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.798] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.798] GetTickCount () returned 0x4eced [0253.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.799] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797\\....\\temporaryfile")) returned 0 [0253.800] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797\\temporaryfile")) returned 1 [0253.801] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3a0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3a0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.801] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3a0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3a0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.801] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.801] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.801] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.801] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.801] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.801] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797\\temporaryfile")) returned 1 [0253.801] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c37a400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c37a400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c37a400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.801] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.802] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322797" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322797")) returned 1 [0253.802] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 0 [0253.802] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.802] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe40, lpOverlapped=0x0) returned 1 [0253.803] CloseHandle (hObject=0xdc) returned 1 [0253.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.805] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x138c [0253.805] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1394) returned 0x25b528 [0253.805] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x138c, lpOverlapped=0x0) returned 1 [0253.807] CloseHandle (hObject=0xdc) returned 1 [0253.807] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0253.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.807] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.808] GetTickCount () returned 0x4ecfc [0253.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.808] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322812\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322812\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322812\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322812\\....\\temporaryfile")) returned 0 [0253.809] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322812\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322812\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322812\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322812\\temporaryfile")) returned 1 [0253.810] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322812\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3a0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3a0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3a0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3a0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3a0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3a0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3a0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3a0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3a0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.810] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322812\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3a0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3a0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3a0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.810] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3a0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3a0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3a0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.810] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3a0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3a0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3a0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.810] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.810] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322812\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322812\\temporaryfile")) returned 1 [0253.811] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3a0560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3a0560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3a0560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.811] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.811] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322812" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322812")) returned 1 [0253.811] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 0 [0253.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.812] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1390, lpOverlapped=0x0) returned 1 [0253.813] CloseHandle (hObject=0xdc) returned 1 [0253.813] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.813] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x12b4 [0253.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12bc) returned 0x25b528 [0253.813] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x12b4, lpOverlapped=0x0) returned 1 [0253.815] CloseHandle (hObject=0xdc) returned 1 [0253.815] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0253.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.816] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.816] GetTickCount () returned 0x4ed0c [0253.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.817] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828\\....\\temporaryfile")) returned 0 [0253.817] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828\\temporaryfile")) returned 1 [0253.818] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.818] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.819] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.819] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.819] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.819] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.819] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828\\temporaryfile")) returned 1 [0253.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.819] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.819] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828")) returned 1 [0253.819] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 0 [0253.820] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.820] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x12b8, lpOverlapped=0x0) returned 1 [0253.821] CloseHandle (hObject=0xdc) returned 1 [0253.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.822] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2020 [0253.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2028) returned 0x2c8700 [0253.822] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2020, lpOverlapped=0x0) returned 1 [0253.823] CloseHandle (hObject=0xdc) returned 1 [0253.823] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0253.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.824] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.824] GetTickCount () returned 0x4ed0c [0253.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.825] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828\\....\\temporaryfile")) returned 0 [0253.826] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828\\temporaryfile")) returned 1 [0253.827] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.827] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.827] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.827] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.827] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.827] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.827] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.827] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828\\temporaryfile")) returned 1 [0253.827] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3c66c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3c66c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3c66c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.827] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.828] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322828" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322828")) returned 1 [0253.828] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 0 [0253.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.829] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca738*, nNumberOfBytesToWrite=0x2028, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca738*, lpNumberOfBytesWritten=0x18fdd8*=0x2028, lpOverlapped=0x0) returned 1 [0253.830] CloseHandle (hObject=0xdc) returned 1 [0253.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.830] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x126c [0253.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1274) returned 0x25b528 [0253.830] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x126c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x126c, lpOverlapped=0x0) returned 1 [0253.832] CloseHandle (hObject=0xdc) returned 1 [0253.832] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0253.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.833] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.833] GetTickCount () returned 0x4ed1c [0253.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.833] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844\\....\\temporaryfile")) returned 0 [0253.834] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844\\temporaryfile")) returned 1 [0253.835] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.835] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.835] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.835] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.835] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.835] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.835] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.836] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844\\temporaryfile")) returned 1 [0253.836] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.836] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.836] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844")) returned 1 [0253.836] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 0 [0253.836] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.837] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1270, lpOverlapped=0x0) returned 1 [0253.838] CloseHandle (hObject=0xdc) returned 1 [0253.838] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.840] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4146 [0253.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x414e) returned 0x2c8700 [0253.840] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4146, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4146, lpOverlapped=0x0) returned 1 [0253.841] CloseHandle (hObject=0xdc) returned 1 [0253.841] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0253.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.842] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.842] GetTickCount () returned 0x4ed1c [0253.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.843] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844\\....\\temporaryfile")) returned 0 [0253.843] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844\\temporaryfile")) returned 1 [0253.845] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.845] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.845] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.845] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.845] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.845] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.845] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.845] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844\\temporaryfile")) returned 1 [0253.845] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c3ec820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c3ec820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c3ec820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.845] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.845] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322844" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322844")) returned 1 [0253.846] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 0 [0253.846] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.847] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc860*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc860*, lpNumberOfBytesWritten=0x18fdd8*=0x4150, lpOverlapped=0x0) returned 1 [0253.848] CloseHandle (hObject=0xdc) returned 1 [0253.848] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.849] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9d27 [0253.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9d2f) returned 0x2c8700 [0253.849] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x9d27, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x9d27, lpOverlapped=0x0) returned 1 [0253.853] CloseHandle (hObject=0xdc) returned 1 [0253.853] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0253.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.854] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.854] GetTickCount () returned 0x4ed2b [0253.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.855] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322859\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322859\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322859\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322859\\....\\temporaryfile")) returned 0 [0253.855] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322859\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322859\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322859\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322859\\temporaryfile")) returned 1 [0253.856] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322859\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c412980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c412980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c412980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c412980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c412980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c412980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c412980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c412980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c412980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.857] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322859\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c412980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c412980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c412980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.857] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c412980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c412980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c412980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.857] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c412980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c412980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c412980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.857] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.857] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322859\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322859\\temporaryfile")) returned 1 [0253.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c412980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c412980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c412980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.857] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.857] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322859" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322859")) returned 1 [0253.857] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 0 [0253.858] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.859] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2440*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2440*, lpNumberOfBytesWritten=0x18fdd8*=0x9d30, lpOverlapped=0x0) returned 1 [0253.860] CloseHandle (hObject=0xdc) returned 1 [0253.860] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.861] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8379 [0253.861] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8381) returned 0x2c8700 [0253.861] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8379, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8379, lpOverlapped=0x0) returned 1 [0253.862] CloseHandle (hObject=0xdc) returned 1 [0253.862] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0253.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.863] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.863] GetTickCount () returned 0x4ed3b [0253.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.864] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875\\....\\temporaryfile")) returned 0 [0253.865] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875\\temporaryfile")) returned 1 [0253.866] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.866] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.866] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.866] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.866] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.866] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.866] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875\\temporaryfile")) returned 1 [0253.866] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.866] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875")) returned 1 [0253.867] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 0 [0253.867] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.868] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0a98*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0a98*, lpNumberOfBytesWritten=0x18fdd8*=0x8380, lpOverlapped=0x0) returned 1 [0253.869] CloseHandle (hObject=0xdc) returned 1 [0253.869] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.870] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf0c1 [0253.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf0c9) returned 0x2c8700 [0253.870] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xf0c1, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xf0c1, lpOverlapped=0x0) returned 1 [0253.872] CloseHandle (hObject=0xdc) returned 1 [0253.872] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0253.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.873] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.874] GetTickCount () returned 0x4ed3b [0253.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.874] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875\\....\\temporaryfile")) returned 0 [0253.875] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875\\temporaryfile")) returned 1 [0253.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.876] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.876] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.876] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.876] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.876] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.876] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875\\temporaryfile")) returned 1 [0253.877] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c438ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c438ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c438ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.877] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322875" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322875")) returned 1 [0253.877] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 0 [0253.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.879] WriteFile (in: hFile=0xdc, lpBuffer=0x2d77e0*, nNumberOfBytesToWrite=0xf0c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d77e0*, lpNumberOfBytesWritten=0x18fdd8*=0xf0c8, lpOverlapped=0x0) returned 1 [0253.880] CloseHandle (hObject=0xdc) returned 1 [0253.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.881] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc056 [0253.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc05e) returned 0x2c8700 [0253.881] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xc056, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xc056, lpOverlapped=0x0) returned 1 [0253.883] CloseHandle (hObject=0xdc) returned 1 [0253.883] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0253.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.884] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.884] GetTickCount () returned 0x4ed4a [0253.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.885] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322890\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322890\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322890\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322890\\....\\temporaryfile")) returned 0 [0253.885] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322890\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322890\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322890\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322890\\temporaryfile")) returned 1 [0253.886] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322890\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c45ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c45ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c45ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.887] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c45ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c45ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c45ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.887] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c45ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c45ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c45ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.887] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322890\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c45ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c45ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c45ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.887] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c45ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c45ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c45ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.887] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c45ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c45ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c45ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.887] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.887] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322890\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322890\\temporaryfile")) returned 1 [0253.887] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c45ec40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c45ec40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c45ec40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.887] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.887] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322890" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322890")) returned 1 [0253.887] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 0 [0253.888] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.889] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4770*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4770*, lpNumberOfBytesWritten=0x18fdd8*=0xc060, lpOverlapped=0x0) returned 1 [0253.891] CloseHandle (hObject=0xdc) returned 1 [0253.891] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.891] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5285 [0253.891] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x528d) returned 0x2c8700 [0253.891] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5285, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5285, lpOverlapped=0x0) returned 1 [0253.893] CloseHandle (hObject=0xdc) returned 1 [0253.893] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0253.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.894] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.894] GetTickCount () returned 0x4ed5a [0253.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.895] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.895] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906\\....\\temporaryfile")) returned 0 [0253.895] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906\\temporaryfile")) returned 1 [0253.896] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.897] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.897] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.897] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.897] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.897] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.897] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.897] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906\\temporaryfile")) returned 1 [0253.897] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.897] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.897] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906")) returned 1 [0253.897] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 0 [0253.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.898] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd9a0*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd9a0*, lpNumberOfBytesWritten=0x18fdd8*=0x5290, lpOverlapped=0x0) returned 1 [0253.899] CloseHandle (hObject=0xdc) returned 1 [0253.900] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.900] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x45cb [0253.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x45d3) returned 0x2c8700 [0253.900] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x45cb, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x45cb, lpOverlapped=0x0) returned 1 [0253.902] CloseHandle (hObject=0xdc) returned 1 [0253.902] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0253.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.903] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.903] GetTickCount () returned 0x4ed5a [0253.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.903] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906\\....\\temporaryfile")) returned 0 [0253.904] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906\\temporaryfile")) returned 1 [0253.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.905] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.905] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.906] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.906] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.906] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906\\temporaryfile")) returned 1 [0253.906] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c484da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c484da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c484da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.906] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322906" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322906")) returned 1 [0253.906] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 0 [0253.907] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.907] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccce8*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccce8*, lpNumberOfBytesWritten=0x18fdd8*=0x45d0, lpOverlapped=0x0) returned 1 [0253.908] CloseHandle (hObject=0xdc) returned 1 [0253.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.909] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c6a [0253.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c72) returned 0x2c8700 [0253.909] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7c6a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7c6a, lpOverlapped=0x0) returned 1 [0253.911] CloseHandle (hObject=0xdc) returned 1 [0253.911] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0253.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.912] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.912] GetTickCount () returned 0x4ed6a [0253.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.912] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922\\....\\temporaryfile")) returned 0 [0253.913] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922\\temporaryfile")) returned 1 [0253.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.914] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.914] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.914] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.914] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.914] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922\\temporaryfile")) returned 1 [0253.915] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.915] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.915] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922")) returned 1 [0253.915] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 0 [0253.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.916] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0388*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0388*, lpNumberOfBytesWritten=0x18fdd8*=0x7c70, lpOverlapped=0x0) returned 1 [0253.917] CloseHandle (hObject=0xdc) returned 1 [0253.918] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.918] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8fd4 [0253.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8fdc) returned 0x2c8700 [0253.918] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8fd4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8fd4, lpOverlapped=0x0) returned 1 [0253.920] CloseHandle (hObject=0xdc) returned 1 [0253.920] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0253.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.921] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.921] GetTickCount () returned 0x4ed6a [0253.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.921] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922\\....\\temporaryfile")) returned 0 [0253.926] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922\\temporaryfile")) returned 1 [0253.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4d1060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4d1060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4d1060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4d1060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.927] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.927] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.927] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.927] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922\\temporaryfile")) returned 1 [0253.928] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4aaf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4aaf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4aaf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.928] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322922" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322922")) returned 1 [0253.928] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 0 [0253.929] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.929] WriteFile (in: hFile=0xdc, lpBuffer=0x2d16f0*, nNumberOfBytesToWrite=0x8fd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d16f0*, lpNumberOfBytesWritten=0x18fdd8*=0x8fd8, lpOverlapped=0x0) returned 1 [0253.930] CloseHandle (hObject=0xdc) returned 1 [0253.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.932] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8fb8 [0253.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8fc0) returned 0x2c8700 [0253.932] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8fb8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8fb8, lpOverlapped=0x0) returned 1 [0253.933] CloseHandle (hObject=0xdc) returned 1 [0253.933] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0253.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.935] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.935] GetTickCount () returned 0x4ed79 [0253.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.935] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322937\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322937\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322937\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322937\\....\\temporaryfile")) returned 0 [0253.936] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322937\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322937\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322937\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322937\\temporaryfile")) returned 1 [0253.937] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322937\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4d1060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4d1060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4d1060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.937] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4d1060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4d1060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4d1060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.937] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4d1060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4d1060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4d1060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.937] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322937\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4d1060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4d1060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4d1060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.937] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4d1060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4d1060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4d1060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.937] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4d1060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4d1060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4d1060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.938] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.938] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322937\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322937\\temporaryfile")) returned 1 [0253.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4d1060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4d1060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4d1060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.938] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.938] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322937" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322937")) returned 1 [0253.938] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 0 [0253.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.939] WriteFile (in: hFile=0xdc, lpBuffer=0x2d16d0*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d16d0*, lpNumberOfBytesWritten=0x18fdd8*=0x8fc0, lpOverlapped=0x0) returned 1 [0253.941] CloseHandle (hObject=0xdc) returned 1 [0253.941] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.942] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8a5b [0253.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8a63) returned 0x2c8700 [0253.942] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8a5b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8a5b, lpOverlapped=0x0) returned 1 [0253.944] CloseHandle (hObject=0xdc) returned 1 [0253.944] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0253.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.945] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.945] GetTickCount () returned 0x4ed89 [0253.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.945] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953\\....\\temporaryfile")) returned 0 [0253.946] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953\\temporaryfile")) returned 1 [0253.947] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4f71c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4f71c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4f71c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.947] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4f71c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4f71c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4f71c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.947] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4f71c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4f71c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4f71c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.947] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4f71c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4f71c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4f71c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.948] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4f71c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4f71c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4f71c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.948] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4f71c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4f71c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4f71c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.948] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.948] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953\\temporaryfile")) returned 1 [0253.948] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4f71c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c4f71c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c4f71c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.948] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.948] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953")) returned 1 [0253.948] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 0 [0253.949] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.949] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1178*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1178*, lpNumberOfBytesWritten=0x18fdd8*=0x8a60, lpOverlapped=0x0) returned 1 [0253.951] CloseHandle (hObject=0xdc) returned 1 [0253.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.952] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x84a6 [0253.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x84ae) returned 0x2c8700 [0253.952] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x84a6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x84a6, lpOverlapped=0x0) returned 1 [0253.954] CloseHandle (hObject=0xdc) returned 1 [0253.954] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0253.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.955] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.955] GetTickCount () returned 0x4ed89 [0253.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.955] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953\\....\\temporaryfile")) returned 0 [0253.956] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953\\temporaryfile")) returned 1 [0253.957] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4f71c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.958] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c4f71c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.958] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.958] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.958] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.958] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.958] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.958] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953\\temporaryfile")) returned 1 [0253.958] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.958] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.958] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322953" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322953")) returned 1 [0253.958] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 0 [0253.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.960] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0bc0*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0bc0*, lpNumberOfBytesWritten=0x18fdd8*=0x84b0, lpOverlapped=0x0) returned 1 [0253.961] CloseHandle (hObject=0xdc) returned 1 [0253.961] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.962] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9a76 [0253.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9a7e) returned 0x2c8700 [0253.962] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x9a76, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x9a76, lpOverlapped=0x0) returned 1 [0253.963] CloseHandle (hObject=0xdc) returned 1 [0253.964] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0253.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.965] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.965] GetTickCount () returned 0x4ed98 [0253.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.965] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322968\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322968\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322968\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322968\\....\\temporaryfile")) returned 0 [0253.966] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322968\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322968\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322968\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322968\\temporaryfile")) returned 1 [0253.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322968\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.967] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.967] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322968\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.967] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.968] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.968] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.968] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322968\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322968\\temporaryfile")) returned 1 [0253.968] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c51d320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c51d320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c51d320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.968] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.968] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322968" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322968")) returned 1 [0253.968] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 0 [0253.969] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.969] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2190*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2190*, lpNumberOfBytesWritten=0x18fdd8*=0x9a80, lpOverlapped=0x0) returned 1 [0253.971] CloseHandle (hObject=0xdc) returned 1 [0253.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.971] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb5ac [0253.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb5b4) returned 0x2c8700 [0253.972] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb5ac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb5ac, lpOverlapped=0x0) returned 1 [0253.973] CloseHandle (hObject=0xdc) returned 1 [0253.973] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0253.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0253.974] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.974] GetTickCount () returned 0x4eda8 [0253.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.975] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984\\...."), lpSecurityAttributes=0x256210) returned 1 [0253.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984\\....\\temporaryfile")) returned 0 [0253.975] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984\\temporaryfile")) returned 1 [0253.976] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.977] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.977] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.977] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.977] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.977] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.977] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.977] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984\\temporaryfile")) returned 1 [0253.977] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.977] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.977] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984")) returned 1 [0253.977] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 0 [0253.978] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.979] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3cc8*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3cc8*, lpNumberOfBytesWritten=0x18fdd8*=0xb5b0, lpOverlapped=0x0) returned 1 [0253.980] CloseHandle (hObject=0xdc) returned 1 [0253.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.981] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaa9a [0253.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaaa2) returned 0x2c8700 [0253.981] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xaa9a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xaa9a, lpOverlapped=0x0) returned 1 [0253.983] CloseHandle (hObject=0xdc) returned 1 [0253.983] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0253.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0253.984] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0253.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0253.984] GetTickCount () returned 0x4eda8 [0253.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0253.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0253.985] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0253.985] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984\\...."), lpSecurityAttributes=0x256228) returned 1 [0253.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984\\....\\temporaryfile")) returned 0 [0253.985] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984\\temporaryfile")) returned 1 [0253.987] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0253.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0253.987] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0253.987] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.987] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0253.987] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0253.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984\\temporaryfile")) returned 1 [0253.988] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c543480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c543480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c543480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0253.988] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0253.988] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18322984" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18322984")) returned 1 [0253.988] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 0 [0253.989] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.989] WriteFile (in: hFile=0xdc, lpBuffer=0x2d31b8*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d31b8*, lpNumberOfBytesWritten=0x18fdd8*=0xaaa0, lpOverlapped=0x0) returned 1 [0253.991] CloseHandle (hObject=0xdc) returned 1 [0253.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0253.991] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x107d4 [0253.991] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x107dc) returned 0x2c8700 [0253.991] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x107d4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x107d4, lpOverlapped=0x0) returned 1 [0254.030] CloseHandle (hObject=0xdc) returned 1 [0254.030] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0254.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.039] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.040] GetTickCount () returned 0x4ede6 [0254.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.047] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323046\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323046\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323046\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323046\\....\\temporaryfile")) returned 0 [0254.056] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323046\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323046\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323046\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323046\\temporaryfile")) returned 1 [0254.072] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323046\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c5dba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c601b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c601b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.072] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c5dba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c601b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c601b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.072] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c5dba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c5dba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c5dba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.072] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323046\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c5dba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c5dba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c5dba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.072] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c5dba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c5dba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c5dba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.072] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c5dba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c5dba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c5dba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.072] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.072] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323046\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323046\\temporaryfile")) returned 1 [0254.072] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c5dba00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c5dba00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c5dba00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.072] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.072] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323046" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323046")) returned 1 [0254.073] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 0 [0254.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.075] WriteFile (in: hFile=0xdc, lpBuffer=0x2d8ef0*, nNumberOfBytesToWrite=0x107d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d8ef0*, lpNumberOfBytesWritten=0x18fdd8*=0x107d8, lpOverlapped=0x0) returned 1 [0254.076] CloseHandle (hObject=0xdc) returned 1 [0254.077] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.077] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x955d [0254.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9565) returned 0x2c8700 [0254.077] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x955d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x955d, lpOverlapped=0x0) returned 1 [0254.079] CloseHandle (hObject=0xdc) returned 1 [0254.079] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0254.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.080] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.080] GetTickCount () returned 0x4ee15 [0254.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.081] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323093\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323093\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323093\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323093\\....\\temporaryfile")) returned 0 [0254.081] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323093\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323093\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323093\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323093\\temporaryfile")) returned 1 [0254.083] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323093\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c64de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c64de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c64de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.083] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c64de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c64de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c64de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.083] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c64de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c64de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c64de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.083] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323093\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c64de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c64de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c64de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.083] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c64de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c64de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c64de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.083] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c64de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c64de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c64de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.083] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.083] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323093\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323093\\temporaryfile")) returned 1 [0254.083] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c64de20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c64de20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c64de20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.083] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.084] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323093" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323093")) returned 1 [0254.084] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 0 [0254.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.085] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1c78*, nNumberOfBytesToWrite=0x9568, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1c78*, lpNumberOfBytesWritten=0x18fdd8*=0x9568, lpOverlapped=0x0) returned 1 [0254.086] CloseHandle (hObject=0xdc) returned 1 [0254.087] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.088] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6b01 [0254.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6b09) returned 0x2c8700 [0254.088] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6b01, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6b01, lpOverlapped=0x0) returned 1 [0254.118] CloseHandle (hObject=0xdc) returned 1 [0254.118] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0254.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.119] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.119] GetTickCount () returned 0x4ee34 [0254.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.120] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323124\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323124\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323124\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323124\\....\\temporaryfile")) returned 0 [0254.121] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323124\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323124\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323124\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323124\\temporaryfile")) returned 1 [0254.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323124\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c69a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c69a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c69a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.122] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c69a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c69a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c69a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.122] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c69a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c69a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c69a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323124\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c69a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c69a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c69a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.122] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c69a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c69a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c69a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.122] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c69a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c69a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c69a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.123] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.123] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323124\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323124\\temporaryfile")) returned 1 [0254.123] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c69a0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c69a0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c69a0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.123] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.123] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323124" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323124")) returned 1 [0254.123] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 0 [0254.124] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.125] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf220*, nNumberOfBytesToWrite=0x6b08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf220*, lpNumberOfBytesWritten=0x18fdd8*=0x6b08, lpOverlapped=0x0) returned 1 [0254.126] CloseHandle (hObject=0xdc) returned 1 [0254.126] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.133] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xfd22 [0254.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfd2a) returned 0x2c8700 [0254.133] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xfd22, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xfd22, lpOverlapped=0x0) returned 1 [0254.135] CloseHandle (hObject=0xdc) returned 1 [0254.135] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0254.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.137] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.137] GetTickCount () returned 0x4ee44 [0254.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.137] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323140\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323140\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323140\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323140\\....\\temporaryfile")) returned 0 [0254.138] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323140\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323140\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323140\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323140\\temporaryfile")) returned 1 [0254.139] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323140\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6c0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6c0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6c0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.139] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6c0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6c0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6c0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.140] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6c0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6c0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6c0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.140] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323140\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6c0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6c0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6c0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.140] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6c0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6c0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6c0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.140] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6c0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6c0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6c0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.140] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.140] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323140\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323140\\temporaryfile")) returned 1 [0254.140] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6c0240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6c0240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6c0240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.140] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.140] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323140" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323140")) returned 1 [0254.140] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 0 [0254.142] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.142] WriteFile (in: hFile=0xdc, lpBuffer=0x2d8440*, nNumberOfBytesToWrite=0xfd28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d8440*, lpNumberOfBytesWritten=0x18fdd8*=0xfd28, lpOverlapped=0x0) returned 1 [0254.144] CloseHandle (hObject=0xdc) returned 1 [0254.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.145] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb544 [0254.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb54c) returned 0x2c8700 [0254.145] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb544, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb544, lpOverlapped=0x0) returned 1 [0254.146] CloseHandle (hObject=0xdc) returned 1 [0254.146] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0254.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.148] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.148] GetTickCount () returned 0x4ee54 [0254.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.148] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156\\....\\temporaryfile")) returned 0 [0254.149] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156\\temporaryfile")) returned 1 [0254.150] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6e63a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6e63a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6e63a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.150] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6e63a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6e63a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6e63a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.150] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6e63a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6e63a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6e63a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.151] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6e63a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6e63a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6e63a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.151] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6e63a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6e63a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6e63a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.151] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6e63a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6e63a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6e63a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.151] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.151] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156\\temporaryfile")) returned 1 [0254.151] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6e63a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c6e63a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c6e63a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.151] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.151] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156")) returned 1 [0254.151] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 0 [0254.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.153] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3c60*, nNumberOfBytesToWrite=0xb548, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3c60*, lpNumberOfBytesWritten=0x18fdd8*=0xb548, lpOverlapped=0x0) returned 1 [0254.154] CloseHandle (hObject=0xdc) returned 1 [0254.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.155] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x212e [0254.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2136) returned 0x2c8700 [0254.155] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x212e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x212e, lpOverlapped=0x0) returned 1 [0254.156] CloseHandle (hObject=0xdc) returned 1 [0254.156] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0254.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.157] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.157] GetTickCount () returned 0x4ee54 [0254.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.158] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156\\....\\temporaryfile")) returned 0 [0254.166] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156\\temporaryfile")) returned 1 [0254.168] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6e63a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c70c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c70c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.168] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c6e63a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c70c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c70c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.168] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c70c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c70c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c70c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.168] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c70c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c70c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c70c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.168] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c70c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c70c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c70c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.168] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c70c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c70c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c70c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.168] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.168] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156\\temporaryfile")) returned 1 [0254.169] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c70c500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c70c500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c70c500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.169] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.169] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323156" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323156")) returned 1 [0254.169] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 0 [0254.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.170] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca848*, nNumberOfBytesToWrite=0x2138, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca848*, lpNumberOfBytesWritten=0x18fdd8*=0x2138, lpOverlapped=0x0) returned 1 [0254.171] CloseHandle (hObject=0xdc) returned 1 [0254.171] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.178] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1104 [0254.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x110c) returned 0x25b528 [0254.178] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1104, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1104, lpOverlapped=0x0) returned 1 [0254.179] CloseHandle (hObject=0xdc) returned 1 [0254.180] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0254.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.180] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.181] GetTickCount () returned 0x4ee73 [0254.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.181] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323187\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323187\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323187\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323187\\....\\temporaryfile")) returned 0 [0254.182] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323187\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323187\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323187\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323187\\temporaryfile")) returned 1 [0254.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323187\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c732660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c732660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c732660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c732660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c732660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c732660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c732660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c732660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c732660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323187\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c732660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c732660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c732660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c732660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c732660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c732660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c732660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c732660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c732660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.183] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.183] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323187\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323187\\temporaryfile")) returned 1 [0254.184] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c732660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c732660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c732660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.184] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323187" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323187")) returned 1 [0254.184] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 0 [0254.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.188] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1108, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1108, lpOverlapped=0x0) returned 1 [0254.189] CloseHandle (hObject=0xdc) returned 1 [0254.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.190] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3c68 [0254.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3c70) returned 0x2c8700 [0254.190] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3c68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3c68, lpOverlapped=0x0) returned 1 [0254.191] CloseHandle (hObject=0xdc) returned 1 [0254.191] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0254.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.192] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.192] GetTickCount () returned 0x4ee82 [0254.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.193] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323202\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323202\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323202\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323202\\....\\temporaryfile")) returned 0 [0254.194] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323202\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323202\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323202\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323202\\temporaryfile")) returned 1 [0254.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323202\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7587c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7587c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7587c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7587c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7587c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7587c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7587c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7587c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7587c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323202\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7587c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7587c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7587c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.195] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7587c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7587c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7587c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.195] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7587c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7587c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7587c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.195] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.195] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323202\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323202\\temporaryfile")) returned 1 [0254.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7587c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7587c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7587c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.195] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.196] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323202" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323202")) returned 1 [0254.196] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 0 [0254.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.197] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc380*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc380*, lpNumberOfBytesWritten=0x18fdd8*=0x3c70, lpOverlapped=0x0) returned 1 [0254.198] CloseHandle (hObject=0xdc) returned 1 [0254.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.206] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4844 [0254.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x484c) returned 0x2c8700 [0254.206] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4844, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4844, lpOverlapped=0x0) returned 1 [0254.207] CloseHandle (hObject=0xdc) returned 1 [0254.208] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0254.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.209] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.209] GetTickCount () returned 0x4ee92 [0254.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.209] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218\\....\\temporaryfile")) returned 0 [0254.210] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218\\temporaryfile")) returned 1 [0254.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.212] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.212] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.212] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218\\temporaryfile")) returned 1 [0254.212] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.212] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218")) returned 1 [0254.212] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 0 [0254.213] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.213] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccf60*, nNumberOfBytesToWrite=0x4848, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccf60*, lpNumberOfBytesWritten=0x18fdd8*=0x4848, lpOverlapped=0x0) returned 1 [0254.214] CloseHandle (hObject=0xdc) returned 1 [0254.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.216] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3928 [0254.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3930) returned 0x2c8700 [0254.216] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3928, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3928, lpOverlapped=0x0) returned 1 [0254.217] CloseHandle (hObject=0xdc) returned 1 [0254.218] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0254.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.218] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.218] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.219] GetTickCount () returned 0x4ee92 [0254.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.219] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218\\....\\temporaryfile")) returned 0 [0254.220] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218\\temporaryfile")) returned 1 [0254.221] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.221] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.221] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.221] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.222] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.222] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.222] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.222] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218\\temporaryfile")) returned 1 [0254.222] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c77e920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c77e920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c77e920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.222] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.222] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323218" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323218")) returned 1 [0254.222] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 0 [0254.223] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.223] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc040*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc040*, lpNumberOfBytesWritten=0x18fdd8*=0x3930, lpOverlapped=0x0) returned 1 [0254.224] CloseHandle (hObject=0xdc) returned 1 [0254.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.225] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a60 [0254.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a68) returned 0x2c4a70 [0254.225] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1a60, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a60, lpOverlapped=0x0) returned 1 [0254.226] CloseHandle (hObject=0xdc) returned 1 [0254.226] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0254.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.227] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.227] GetTickCount () returned 0x4eea2 [0254.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.228] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234\\....\\temporaryfile")) returned 0 [0254.228] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234\\temporaryfile")) returned 1 [0254.230] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7a4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7a4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7a4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.230] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7a4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7a4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7a4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.230] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7a4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7a4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7a4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.230] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7a4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7a4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7a4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.230] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7a4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7a4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7a4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.230] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7a4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7a4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7a4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.230] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.230] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234\\temporaryfile")) returned 1 [0254.230] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7a4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7a4a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7a4a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.230] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.230] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234")) returned 1 [0254.231] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 0 [0254.231] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.232] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1a68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1a68, lpOverlapped=0x0) returned 1 [0254.232] CloseHandle (hObject=0xdc) returned 1 [0254.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.233] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2988 [0254.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2990) returned 0x2c8700 [0254.233] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2988, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2988, lpOverlapped=0x0) returned 1 [0254.234] CloseHandle (hObject=0xdc) returned 1 [0254.235] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0254.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.235] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.235] GetTickCount () returned 0x4eea2 [0254.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.236] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.237] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234\\....\\temporaryfile")) returned 0 [0254.237] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234\\temporaryfile")) returned 1 [0254.238] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7a4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.239] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7a4a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.239] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.239] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.239] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.239] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.239] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.239] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234\\temporaryfile")) returned 1 [0254.239] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.239] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.239] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323234" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323234")) returned 1 [0254.239] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 0 [0254.240] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.240] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb0a0*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb0a0*, lpNumberOfBytesWritten=0x18fdd8*=0x2990, lpOverlapped=0x0) returned 1 [0254.241] CloseHandle (hObject=0xdc) returned 1 [0254.241] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.242] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3394 [0254.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x339c) returned 0x2c8700 [0254.242] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3394, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3394, lpOverlapped=0x0) returned 1 [0254.245] CloseHandle (hObject=0xdc) returned 1 [0254.245] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0254.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.246] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.246] GetTickCount () returned 0x4eeb1 [0254.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.246] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323249\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323249\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323249\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323249\\....\\temporaryfile")) returned 0 [0254.247] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323249\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323249\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323249\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323249\\temporaryfile")) returned 1 [0254.248] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323249\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.249] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.249] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.249] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323249\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.249] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323249\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323249\\temporaryfile")) returned 1 [0254.249] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7cabe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7cabe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7cabe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.249] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323249" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323249")) returned 1 [0254.249] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 0 [0254.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.250] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbab0*, nNumberOfBytesToWrite=0x3398, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbab0*, lpNumberOfBytesWritten=0x18fdd8*=0x3398, lpOverlapped=0x0) returned 1 [0254.251] CloseHandle (hObject=0xdc) returned 1 [0254.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.252] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3418 [0254.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3420) returned 0x2c8700 [0254.252] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3418, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3418, lpOverlapped=0x0) returned 1 [0254.254] CloseHandle (hObject=0xdc) returned 1 [0254.254] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0254.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.255] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.255] GetTickCount () returned 0x4eec1 [0254.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.255] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265\\....\\temporaryfile")) returned 0 [0254.256] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265\\temporaryfile")) returned 1 [0254.257] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.257] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.257] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.257] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.257] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.257] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.257] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.257] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265\\temporaryfile")) returned 1 [0254.258] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.258] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.258] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265")) returned 1 [0254.258] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 0 [0254.258] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.259] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbb30*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbb30*, lpNumberOfBytesWritten=0x18fdd8*=0x3420, lpOverlapped=0x0) returned 1 [0254.260] CloseHandle (hObject=0xdc) returned 1 [0254.260] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.261] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a00 [0254.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a08) returned 0x2c8700 [0254.261] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2a00, lpOverlapped=0x0) returned 1 [0254.262] CloseHandle (hObject=0xdc) returned 1 [0254.262] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0254.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.263] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.263] GetTickCount () returned 0x4eec1 [0254.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.264] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265\\....\\temporaryfile")) returned 0 [0254.265] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265\\temporaryfile")) returned 1 [0254.266] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.266] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.266] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.266] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.266] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.266] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265\\temporaryfile")) returned 1 [0254.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c7f0d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c7f0d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c7f0d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.267] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.267] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323265" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323265")) returned 1 [0254.267] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 0 [0254.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.268] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb118*, nNumberOfBytesToWrite=0x2a08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb118*, lpNumberOfBytesWritten=0x18fdd8*=0x2a08, lpOverlapped=0x0) returned 1 [0254.269] CloseHandle (hObject=0xdc) returned 1 [0254.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.270] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x610c [0254.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6114) returned 0x2c8700 [0254.270] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x610c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x610c, lpOverlapped=0x0) returned 1 [0254.271] CloseHandle (hObject=0xdc) returned 1 [0254.271] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0254.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.272] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.272] GetTickCount () returned 0x4eed0 [0254.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.273] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280\\....\\temporaryfile")) returned 0 [0254.273] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280\\temporaryfile")) returned 1 [0254.275] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.275] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.275] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.275] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.275] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.275] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.275] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.275] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280\\temporaryfile")) returned 1 [0254.275] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.275] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.275] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280")) returned 1 [0254.276] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 0 [0254.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.277] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce828*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce828*, lpNumberOfBytesWritten=0x18fdd8*=0x6110, lpOverlapped=0x0) returned 1 [0254.278] CloseHandle (hObject=0xdc) returned 1 [0254.278] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.279] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3734 [0254.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x373c) returned 0x2c8700 [0254.279] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3734, lpOverlapped=0x0) returned 1 [0254.280] CloseHandle (hObject=0xdc) returned 1 [0254.280] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0254.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.281] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.281] GetTickCount () returned 0x4eed0 [0254.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.282] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280\\....\\temporaryfile")) returned 0 [0254.283] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280\\temporaryfile")) returned 1 [0254.284] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c83d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c83d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.284] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c83d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c83d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.284] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.284] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.284] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.284] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.284] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.284] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280\\temporaryfile")) returned 1 [0254.285] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c816ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c816ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c816ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.285] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.285] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323280" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323280")) returned 1 [0254.285] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 0 [0254.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.286] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbe50*, nNumberOfBytesToWrite=0x3738, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbe50*, lpNumberOfBytesWritten=0x18fdd8*=0x3738, lpOverlapped=0x0) returned 1 [0254.287] CloseHandle (hObject=0xdc) returned 1 [0254.287] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.287] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x406c [0254.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4074) returned 0x2c8700 [0254.288] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x406c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x406c, lpOverlapped=0x0) returned 1 [0254.289] CloseHandle (hObject=0xdc) returned 1 [0254.289] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0254.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.290] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.290] GetTickCount () returned 0x4eee0 [0254.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.291] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323296\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323296\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.291] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323296\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323296\\....\\temporaryfile")) returned 0 [0254.291] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323296\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323296\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323296\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323296\\temporaryfile")) returned 1 [0254.292] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323296\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c83d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c83d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c83d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c83d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c83d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c83d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c83d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c83d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c83d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.293] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323296\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c83d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c83d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c83d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.293] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c83d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c83d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c83d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.293] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c83d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c83d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c83d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.293] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.293] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323296\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323296\\temporaryfile")) returned 1 [0254.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c83d000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c83d000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c83d000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.293] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.293] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323296" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323296")) returned 1 [0254.293] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 0 [0254.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.294] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc788*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc788*, lpNumberOfBytesWritten=0x18fdd8*=0x4070, lpOverlapped=0x0) returned 1 [0254.295] CloseHandle (hObject=0xdc) returned 1 [0254.296] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.296] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2c4c [0254.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c54) returned 0x2c8700 [0254.296] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2c4c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2c4c, lpOverlapped=0x0) returned 1 [0254.297] CloseHandle (hObject=0xdc) returned 1 [0254.297] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0254.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.299] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.299] GetTickCount () returned 0x4eef0 [0254.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.299] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312\\....\\temporaryfile")) returned 0 [0254.300] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312\\temporaryfile")) returned 1 [0254.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.301] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312\\temporaryfile")) returned 1 [0254.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.301] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.302] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312")) returned 1 [0254.302] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 0 [0254.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.303] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb368*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb368*, lpNumberOfBytesWritten=0x18fdd8*=0x2c50, lpOverlapped=0x0) returned 1 [0254.304] CloseHandle (hObject=0xdc) returned 1 [0254.304] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.304] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4030 [0254.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4038) returned 0x2c8700 [0254.304] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4030, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4030, lpOverlapped=0x0) returned 1 [0254.306] CloseHandle (hObject=0xdc) returned 1 [0254.306] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0254.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.307] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.307] GetTickCount () returned 0x4eef0 [0254.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.307] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312\\....\\temporaryfile")) returned 0 [0254.308] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312\\temporaryfile")) returned 1 [0254.309] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.309] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.309] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.309] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.310] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.310] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.310] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.310] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312\\temporaryfile")) returned 1 [0254.310] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c863160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c863160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c863160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.310] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.310] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323312" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323312")) returned 1 [0254.310] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 0 [0254.311] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.311] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc748*, nNumberOfBytesToWrite=0x4038, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc748*, lpNumberOfBytesWritten=0x18fdd8*=0x4038, lpOverlapped=0x0) returned 1 [0254.312] CloseHandle (hObject=0xdc) returned 1 [0254.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.313] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3eb4 [0254.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ebc) returned 0x2c8700 [0254.313] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3eb4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3eb4, lpOverlapped=0x0) returned 1 [0254.314] CloseHandle (hObject=0xdc) returned 1 [0254.314] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0254.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.315] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.315] GetTickCount () returned 0x4eeff [0254.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.316] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327\\....\\temporaryfile")) returned 0 [0254.316] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327\\temporaryfile")) returned 1 [0254.318] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.318] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.318] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.318] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.318] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.318] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327\\temporaryfile")) returned 1 [0254.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.318] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.318] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327")) returned 1 [0254.319] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 0 [0254.319] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.320] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc5d0*, nNumberOfBytesToWrite=0x3eb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc5d0*, lpNumberOfBytesWritten=0x18fdd8*=0x3eb8, lpOverlapped=0x0) returned 1 [0254.321] CloseHandle (hObject=0xdc) returned 1 [0254.321] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.321] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a80 [0254.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a88) returned 0x2c8700 [0254.321] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2a80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2a80, lpOverlapped=0x0) returned 1 [0254.323] CloseHandle (hObject=0xdc) returned 1 [0254.323] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0254.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.324] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.324] GetTickCount () returned 0x4eeff [0254.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.324] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327\\....\\temporaryfile")) returned 0 [0254.328] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327\\temporaryfile")) returned 1 [0254.330] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.330] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.330] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.330] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.330] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.330] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327\\temporaryfile")) returned 1 [0254.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8892c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8892c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8892c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.330] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.330] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323327" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323327")) returned 1 [0254.331] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 0 [0254.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.332] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb198*, nNumberOfBytesToWrite=0x2a88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb198*, lpNumberOfBytesWritten=0x18fdd8*=0x2a88, lpOverlapped=0x0) returned 1 [0254.333] CloseHandle (hObject=0xdc) returned 1 [0254.333] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.334] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe70 [0254.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe78) returned 0x2350048 [0254.334] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe70, lpOverlapped=0x0) returned 1 [0254.335] CloseHandle (hObject=0xdc) returned 1 [0254.335] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0254.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.336] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.336] GetTickCount () returned 0x4ef0f [0254.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.337] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343\\....\\temporaryfile")) returned 0 [0254.337] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343\\temporaryfile")) returned 1 [0254.338] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8af420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8af420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8af420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.339] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8af420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8af420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8af420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.339] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8af420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8af420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8af420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.339] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8af420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8af420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8af420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.339] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8af420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8af420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8af420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.339] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8af420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8af420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8af420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.339] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.339] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343\\temporaryfile")) returned 1 [0254.339] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8af420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8af420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8af420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.339] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.339] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343")) returned 1 [0254.339] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 0 [0254.340] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.340] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe78, lpOverlapped=0x0) returned 1 [0254.341] CloseHandle (hObject=0xdc) returned 1 [0254.341] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.342] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd28 [0254.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd30) returned 0x2350048 [0254.342] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd28, lpOverlapped=0x0) returned 1 [0254.344] CloseHandle (hObject=0xdc) returned 1 [0254.344] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0254.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.345] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.345] GetTickCount () returned 0x4ef0f [0254.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.345] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343\\....\\temporaryfile")) returned 0 [0254.346] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343\\temporaryfile")) returned 1 [0254.347] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8af420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.347] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8af420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.347] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.348] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.348] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.348] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.348] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.348] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343\\temporaryfile")) returned 1 [0254.348] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.348] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.348] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323343" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323343")) returned 1 [0254.348] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 0 [0254.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.349] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd30, lpOverlapped=0x0) returned 1 [0254.350] CloseHandle (hObject=0xdc) returned 1 [0254.350] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.351] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2ab4 [0254.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2abc) returned 0x2c8700 [0254.351] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2ab4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2ab4, lpOverlapped=0x0) returned 1 [0254.352] CloseHandle (hObject=0xdc) returned 1 [0254.352] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0254.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.353] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.353] GetTickCount () returned 0x4ef1e [0254.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.354] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323358\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323358\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323358\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323358\\....\\temporaryfile")) returned 0 [0254.354] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323358\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323358\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323358\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323358\\temporaryfile")) returned 1 [0254.356] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323358\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.356] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.356] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.356] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323358\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.356] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.356] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.356] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.356] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323358\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323358\\temporaryfile")) returned 1 [0254.356] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8d5580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8d5580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8d5580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.356] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.356] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323358" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323358")) returned 1 [0254.357] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 0 [0254.357] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.357] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb1d0*, nNumberOfBytesToWrite=0x2ab8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb1d0*, lpNumberOfBytesWritten=0x18fdd8*=0x2ab8, lpOverlapped=0x0) returned 1 [0254.358] CloseHandle (hObject=0xdc) returned 1 [0254.359] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.359] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18c4 [0254.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18cc) returned 0x2c4a70 [0254.359] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x18c4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x18c4, lpOverlapped=0x0) returned 1 [0254.360] CloseHandle (hObject=0xdc) returned 1 [0254.360] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0254.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.361] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.362] GetTickCount () returned 0x4ef2e [0254.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.362] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374\\....\\temporaryfile")) returned 0 [0254.363] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374\\temporaryfile")) returned 1 [0254.364] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.364] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.364] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.364] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.364] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.364] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.364] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.364] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374\\temporaryfile")) returned 1 [0254.364] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.364] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.365] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374")) returned 1 [0254.365] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 0 [0254.365] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.366] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x18c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x18c8, lpOverlapped=0x0) returned 1 [0254.366] CloseHandle (hObject=0xdc) returned 1 [0254.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.367] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2628 [0254.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2630) returned 0x2c8700 [0254.367] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2628, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2628, lpOverlapped=0x0) returned 1 [0254.368] CloseHandle (hObject=0xdc) returned 1 [0254.369] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0254.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.370] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.370] GetTickCount () returned 0x4ef2e [0254.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.370] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374\\....\\temporaryfile")) returned 0 [0254.371] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374\\temporaryfile")) returned 1 [0254.372] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.372] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.372] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.372] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.372] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.372] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.373] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.373] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374\\temporaryfile")) returned 1 [0254.373] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c8fb6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c8fb6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c8fb6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.373] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.373] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323374" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323374")) returned 1 [0254.373] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 0 [0254.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.374] WriteFile (in: hFile=0xdc, lpBuffer=0x2cad40*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cad40*, lpNumberOfBytesWritten=0x18fdd8*=0x2630, lpOverlapped=0x0) returned 1 [0254.375] CloseHandle (hObject=0xdc) returned 1 [0254.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.376] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1884 [0254.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x188c) returned 0x2c4a70 [0254.376] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1884, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1884, lpOverlapped=0x0) returned 1 [0254.377] CloseHandle (hObject=0xdc) returned 1 [0254.377] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0254.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.378] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.378] GetTickCount () returned 0x4ef3e [0254.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.379] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390\\....\\temporaryfile")) returned 0 [0254.379] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390\\temporaryfile")) returned 1 [0254.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.381] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.381] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.381] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.381] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.381] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.381] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390\\temporaryfile")) returned 1 [0254.381] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.381] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390")) returned 1 [0254.381] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 0 [0254.382] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.382] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1888, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1888, lpOverlapped=0x0) returned 1 [0254.383] CloseHandle (hObject=0xdc) returned 1 [0254.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.384] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x40f8 [0254.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4100) returned 0x2c8700 [0254.384] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x40f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x40f8, lpOverlapped=0x0) returned 1 [0254.386] CloseHandle (hObject=0xdc) returned 1 [0254.386] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0254.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.387] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.387] GetTickCount () returned 0x4ef3e [0254.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.387] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390\\....\\temporaryfile")) returned 0 [0254.388] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390\\temporaryfile")) returned 1 [0254.389] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.390] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.390] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.390] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.390] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.390] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.390] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390\\temporaryfile")) returned 1 [0254.390] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c921840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c921840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c921840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.390] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.390] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323390" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323390")) returned 1 [0254.390] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 0 [0254.391] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.391] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc810*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc810*, lpNumberOfBytesWritten=0x18fdd8*=0x4100, lpOverlapped=0x0) returned 1 [0254.392] CloseHandle (hObject=0xdc) returned 1 [0254.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.393] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3094 [0254.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x309c) returned 0x2c8700 [0254.393] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3094, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3094, lpOverlapped=0x0) returned 1 [0254.395] CloseHandle (hObject=0xdc) returned 1 [0254.395] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0254.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.396] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.396] GetTickCount () returned 0x4ef4d [0254.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.396] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405\\....\\temporaryfile")) returned 0 [0254.397] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405\\temporaryfile")) returned 1 [0254.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.398] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.398] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.398] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.398] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405\\temporaryfile")) returned 1 [0254.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.399] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405")) returned 1 [0254.399] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 0 [0254.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.400] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb7b0*, nNumberOfBytesToWrite=0x3098, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb7b0*, lpNumberOfBytesWritten=0x18fdd8*=0x3098, lpOverlapped=0x0) returned 1 [0254.401] CloseHandle (hObject=0xdc) returned 1 [0254.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.401] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1748 [0254.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1750) returned 0x2c4a70 [0254.402] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1748, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1748, lpOverlapped=0x0) returned 1 [0254.403] CloseHandle (hObject=0xdc) returned 1 [0254.403] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 1 [0254.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.404] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.404] GetTickCount () returned 0x4ef4d [0254.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.404] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405\\....\\temporaryfile")) returned 0 [0254.405] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405\\temporaryfile")) returned 1 [0254.406] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.406] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.406] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.406] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.407] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.407] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.407] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.407] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405\\temporaryfile")) returned 1 [0254.407] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9479a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9479a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9479a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.407] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.407] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323405" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323405")) returned 1 [0254.407] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 0 [0254.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.408] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1750, lpOverlapped=0x0) returned 1 [0254.409] CloseHandle (hObject=0xdc) returned 1 [0254.409] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.410] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2584 [0254.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x258c) returned 0x2c8700 [0254.410] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2584, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2584, lpOverlapped=0x0) returned 1 [0254.412] CloseHandle (hObject=0xdc) returned 1 [0254.412] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0254.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.413] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.413] GetTickCount () returned 0x4ef5d [0254.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.413] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.414] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421\\....\\temporaryfile")) returned 0 [0254.414] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421\\temporaryfile")) returned 1 [0254.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.415] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.415] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.415] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421\\temporaryfile")) returned 1 [0254.416] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.416] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.416] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421")) returned 1 [0254.416] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 0 [0254.416] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.417] WriteFile (in: hFile=0xdc, lpBuffer=0x2caca0*, nNumberOfBytesToWrite=0x2588, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caca0*, lpNumberOfBytesWritten=0x18fdd8*=0x2588, lpOverlapped=0x0) returned 1 [0254.418] CloseHandle (hObject=0xdc) returned 1 [0254.418] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.418] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6688 [0254.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6690) returned 0x2c8700 [0254.418] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6688, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6688, lpOverlapped=0x0) returned 1 [0254.420] CloseHandle (hObject=0xdc) returned 1 [0254.420] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0254.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.421] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.421] GetTickCount () returned 0x4ef5d [0254.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.421] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421\\....\\temporaryfile")) returned 0 [0254.422] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421\\temporaryfile")) returned 1 [0254.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.424] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.424] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.424] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.424] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.424] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.424] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.424] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421\\temporaryfile")) returned 1 [0254.424] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c96db00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c96db00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c96db00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.424] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.424] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323421" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323421")) returned 1 [0254.424] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 0 [0254.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.426] WriteFile (in: hFile=0xdc, lpBuffer=0x2ceda0*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ceda0*, lpNumberOfBytesWritten=0x18fdd8*=0x6690, lpOverlapped=0x0) returned 1 [0254.427] CloseHandle (hObject=0xdc) returned 1 [0254.427] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.427] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x785c [0254.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7864) returned 0x2c8700 [0254.427] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x785c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x785c, lpOverlapped=0x0) returned 1 [0254.429] CloseHandle (hObject=0xdc) returned 1 [0254.429] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0254.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.430] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.430] GetTickCount () returned 0x4ef6c [0254.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.431] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323436\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323436\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.431] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323436\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323436\\....\\temporaryfile")) returned 0 [0254.431] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323436\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323436\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323436\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323436\\temporaryfile")) returned 1 [0254.432] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323436\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c993c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c993c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c993c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.432] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c993c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c993c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c993c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.433] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c993c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c993c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c993c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.433] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323436\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c993c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c993c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c993c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.433] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c993c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c993c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c993c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.433] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c993c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c993c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c993c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.433] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.433] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323436\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323436\\temporaryfile")) returned 1 [0254.433] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c993c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c993c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c993c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.433] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.433] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323436" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323436")) returned 1 [0254.433] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 0 [0254.434] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.434] WriteFile (in: hFile=0xdc, lpBuffer=0x2cff78*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cff78*, lpNumberOfBytesWritten=0x18fdd8*=0x7860, lpOverlapped=0x0) returned 1 [0254.436] CloseHandle (hObject=0xdc) returned 1 [0254.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.436] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8774 [0254.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x877c) returned 0x2c8700 [0254.436] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8774, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8774, lpOverlapped=0x0) returned 1 [0254.440] CloseHandle (hObject=0xdc) returned 1 [0254.440] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0254.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.441] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.441] GetTickCount () returned 0x4ef7c [0254.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.442] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.442] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452\\....\\temporaryfile")) returned 0 [0254.442] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452\\temporaryfile")) returned 1 [0254.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.444] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.444] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452\\temporaryfile")) returned 1 [0254.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.444] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.444] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452")) returned 1 [0254.444] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 0 [0254.445] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.446] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0e90*, nNumberOfBytesToWrite=0x8778, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0e90*, lpNumberOfBytesWritten=0x18fdd8*=0x8778, lpOverlapped=0x0) returned 1 [0254.447] CloseHandle (hObject=0xdc) returned 1 [0254.447] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.448] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4f4 [0254.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4fc) returned 0x259e70 [0254.448] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x4f4, lpOverlapped=0x0) returned 1 [0254.449] CloseHandle (hObject=0xdc) returned 1 [0254.449] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0254.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.450] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.450] GetTickCount () returned 0x4ef7c [0254.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.451] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.451] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452\\....\\temporaryfile")) returned 0 [0254.452] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452\\temporaryfile")) returned 1 [0254.453] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.453] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.453] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.453] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.453] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.453] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.453] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.453] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452\\temporaryfile")) returned 1 [0254.453] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9b9dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9b9dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9b9dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.454] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.454] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323452" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323452")) returned 1 [0254.454] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 0 [0254.454] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.458] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x4f8, lpOverlapped=0x0) returned 1 [0254.459] CloseHandle (hObject=0xdc) returned 1 [0254.459] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.460] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x544 [0254.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54c) returned 0x259e70 [0254.460] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x544, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x544, lpOverlapped=0x0) returned 1 [0254.461] CloseHandle (hObject=0xdc) returned 1 [0254.461] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0254.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.462] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.462] GetTickCount () returned 0x4ef8c [0254.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.463] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323468\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323468\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.463] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323468\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323468\\....\\temporaryfile")) returned 0 [0254.463] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323468\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323468\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323468\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323468\\temporaryfile")) returned 1 [0254.464] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323468\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9dff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9dff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9dff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.465] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9dff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9dff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9dff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.465] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9dff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9dff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9dff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.465] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323468\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9dff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9dff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9dff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.465] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9dff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9dff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9dff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.465] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9dff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9dff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9dff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.465] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.465] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323468\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323468\\temporaryfile")) returned 1 [0254.465] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9c9dff20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9c9dff20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9c9dff20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.465] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.465] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323468" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323468")) returned 1 [0254.465] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 0 [0254.466] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.466] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x548, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x548, lpOverlapped=0x0) returned 1 [0254.467] CloseHandle (hObject=0xdc) returned 1 [0254.467] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.468] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c98 [0254.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ca0) returned 0x2c8700 [0254.468] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1c98, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1c98, lpOverlapped=0x0) returned 1 [0254.470] CloseHandle (hObject=0xdc) returned 1 [0254.470] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0254.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.471] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.471] GetTickCount () returned 0x4ef9b [0254.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.472] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483\\....\\temporaryfile")) returned 0 [0254.472] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483\\temporaryfile")) returned 1 [0254.474] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.474] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.474] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.474] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.474] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.474] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.474] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.474] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483\\temporaryfile")) returned 1 [0254.474] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.474] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.474] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483")) returned 1 [0254.474] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 0 [0254.475] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.475] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca3b0*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca3b0*, lpNumberOfBytesWritten=0x18fdd8*=0x1ca0, lpOverlapped=0x0) returned 1 [0254.476] CloseHandle (hObject=0xdc) returned 1 [0254.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.477] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4b8 [0254.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c0) returned 0x259e70 [0254.477] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x4b8, lpOverlapped=0x0) returned 1 [0254.481] CloseHandle (hObject=0xdc) returned 1 [0254.481] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0254.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.482] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.482] GetTickCount () returned 0x4ef9b [0254.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.483] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483\\....\\temporaryfile")) returned 0 [0254.484] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483\\temporaryfile")) returned 1 [0254.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.485] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.485] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.485] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.485] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483\\temporaryfile")) returned 1 [0254.485] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca06080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca06080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca06080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.486] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.486] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323483" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323483")) returned 1 [0254.486] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 0 [0254.486] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.487] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x4c0, lpOverlapped=0x0) returned 1 [0254.488] CloseHandle (hObject=0xdc) returned 1 [0254.488] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.489] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4b8 [0254.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c0) returned 0x259e70 [0254.489] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x4b8, lpOverlapped=0x0) returned 1 [0254.490] CloseHandle (hObject=0xdc) returned 1 [0254.490] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 1 [0254.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.491] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.491] GetTickCount () returned 0x4efab [0254.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.492] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.492] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499\\....\\temporaryfile")) returned 0 [0254.492] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499\\temporaryfile")) returned 1 [0254.493] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.493] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.494] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.494] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.494] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.494] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.494] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.494] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499\\temporaryfile")) returned 1 [0254.494] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.494] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.494] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499")) returned 1 [0254.494] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 0 [0254.495] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.495] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x4c0, lpOverlapped=0x0) returned 1 [0254.496] CloseHandle (hObject=0xdc) returned 1 [0254.496] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.497] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x674 [0254.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x67c) returned 0x259e70 [0254.497] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x674, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x674, lpOverlapped=0x0) returned 1 [0254.498] CloseHandle (hObject=0xdc) returned 1 [0254.498] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0254.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.499] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.499] GetTickCount () returned 0x4efab [0254.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.499] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.500] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499\\....\\temporaryfile")) returned 0 [0254.500] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499\\temporaryfile")) returned 1 [0254.502] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.502] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.502] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.502] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.502] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.502] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.502] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.502] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499\\temporaryfile")) returned 1 [0254.502] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca2c1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca2c1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca2c1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.502] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.503] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323499" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323499")) returned 1 [0254.503] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 0 [0254.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.503] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x678, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x678, lpOverlapped=0x0) returned 1 [0254.504] CloseHandle (hObject=0xdc) returned 1 [0254.504] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.505] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x132c [0254.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1334) returned 0x25b528 [0254.505] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x132c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x132c, lpOverlapped=0x0) returned 1 [0254.506] CloseHandle (hObject=0xdc) returned 1 [0254.506] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0254.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.507] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.507] GetTickCount () returned 0x4efba [0254.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.508] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514\\....\\temporaryfile")) returned 0 [0254.508] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514\\temporaryfile")) returned 1 [0254.510] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.510] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.510] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.510] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.510] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.510] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.510] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.510] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514\\temporaryfile")) returned 1 [0254.510] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.510] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.510] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514")) returned 1 [0254.511] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 0 [0254.511] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.511] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1330, lpOverlapped=0x0) returned 1 [0254.512] CloseHandle (hObject=0xdc) returned 1 [0254.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.513] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x11e4 [0254.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11ec) returned 0x25b528 [0254.513] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11e4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x11e4, lpOverlapped=0x0) returned 1 [0254.514] CloseHandle (hObject=0xdc) returned 1 [0254.514] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0254.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.515] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.515] GetTickCount () returned 0x4efba [0254.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.516] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514\\....\\temporaryfile")) returned 0 [0254.517] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514\\temporaryfile")) returned 1 [0254.518] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.518] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.518] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.518] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.518] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.518] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.518] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.518] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514\\temporaryfile")) returned 1 [0254.519] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca52340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca52340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca52340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.519] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.519] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323514" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323514")) returned 1 [0254.519] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 0 [0254.519] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.520] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x11e8, lpOverlapped=0x0) returned 1 [0254.521] CloseHandle (hObject=0xdc) returned 1 [0254.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.521] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b6c [0254.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b74) returned 0x2c4a70 [0254.521] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b6c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b6c, lpOverlapped=0x0) returned 1 [0254.523] CloseHandle (hObject=0xdc) returned 1 [0254.523] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0254.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.524] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.524] GetTickCount () returned 0x4efca [0254.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.524] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323530\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323530\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323530\\....\\temporaryfile")) returned 0 [0254.525] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323530\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323530\\temporaryfile")) returned 1 [0254.526] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323530\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca784a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca784a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca784a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.526] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca784a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca784a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca784a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.526] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca784a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca784a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca784a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.527] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323530\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca784a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca784a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca784a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.527] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca784a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca784a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca784a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.527] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca784a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca784a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca784a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.527] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.527] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323530\\temporaryfile")) returned 1 [0254.527] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca784a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca784a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca784a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.527] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.527] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323530" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323530")) returned 1 [0254.527] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 0 [0254.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.528] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b70, lpOverlapped=0x0) returned 1 [0254.529] CloseHandle (hObject=0xdc) returned 1 [0254.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.530] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ec4 [0254.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ecc) returned 0x2c8700 [0254.530] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1ec4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1ec4, lpOverlapped=0x0) returned 1 [0254.532] CloseHandle (hObject=0xdc) returned 1 [0254.532] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0254.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.533] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.533] GetTickCount () returned 0x4efda [0254.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.533] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546\\....\\temporaryfile")) returned 0 [0254.534] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546\\temporaryfile")) returned 1 [0254.535] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.535] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.535] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.535] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.535] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.536] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.536] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.536] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546\\temporaryfile")) returned 1 [0254.536] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.536] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.536] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546")) returned 1 [0254.536] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 0 [0254.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.537] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca5e0*, nNumberOfBytesToWrite=0x1ec8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca5e0*, lpNumberOfBytesWritten=0x18fdd8*=0x1ec8, lpOverlapped=0x0) returned 1 [0254.538] CloseHandle (hObject=0xdc) returned 1 [0254.538] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.539] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3a28 [0254.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3a30) returned 0x2c8700 [0254.539] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3a28, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3a28, lpOverlapped=0x0) returned 1 [0254.540] CloseHandle (hObject=0xdc) returned 1 [0254.540] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0254.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.541] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.541] GetTickCount () returned 0x4efda [0254.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.542] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546\\....\\temporaryfile")) returned 0 [0254.542] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546\\temporaryfile")) returned 1 [0254.544] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.544] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.544] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.544] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.544] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.544] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.544] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.544] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546\\temporaryfile")) returned 1 [0254.544] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ca9e600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ca9e600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ca9e600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.544] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.544] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323546" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323546")) returned 1 [0254.545] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 0 [0254.545] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.546] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc140*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc140*, lpNumberOfBytesWritten=0x18fdd8*=0x3a30, lpOverlapped=0x0) returned 1 [0254.547] CloseHandle (hObject=0xdc) returned 1 [0254.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.547] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2370 [0254.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2378) returned 0x2c8700 [0254.547] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2370, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2370, lpOverlapped=0x0) returned 1 [0254.549] CloseHandle (hObject=0xdc) returned 1 [0254.549] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0254.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.550] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.550] GetTickCount () returned 0x4efe9 [0254.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.550] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561\\....\\temporaryfile")) returned 0 [0254.551] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561\\temporaryfile")) returned 1 [0254.552] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.552] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.553] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.553] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561\\temporaryfile")) returned 1 [0254.553] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.553] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.553] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561")) returned 1 [0254.553] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 0 [0254.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.554] WriteFile (in: hFile=0xdc, lpBuffer=0x2caa88*, nNumberOfBytesToWrite=0x2378, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caa88*, lpNumberOfBytesWritten=0x18fdd8*=0x2378, lpOverlapped=0x0) returned 1 [0254.555] CloseHandle (hObject=0xdc) returned 1 [0254.555] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.556] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b2c [0254.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b34) returned 0x2c4a70 [0254.556] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b2c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b2c, lpOverlapped=0x0) returned 1 [0254.557] CloseHandle (hObject=0xdc) returned 1 [0254.557] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 1 [0254.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.558] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.558] GetTickCount () returned 0x4efe9 [0254.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.559] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561\\....\\temporaryfile")) returned 0 [0254.559] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561\\temporaryfile")) returned 1 [0254.561] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.561] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.561] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.561] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.561] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.561] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.561] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561\\temporaryfile")) returned 1 [0254.561] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cac4760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cac4760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cac4760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.561] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323561" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323561")) returned 1 [0254.562] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 0 [0254.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.571] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b30, lpOverlapped=0x0) returned 1 [0254.572] CloseHandle (hObject=0xdc) returned 1 [0254.572] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.574] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x794 [0254.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x79c) returned 0x2350048 [0254.574] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x794, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x794, lpOverlapped=0x0) returned 1 [0254.575] CloseHandle (hObject=0xdc) returned 1 [0254.575] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 1 [0254.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.576] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.576] GetTickCount () returned 0x4eff9 [0254.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.577] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323577\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323577\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323577\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323577\\....\\temporaryfile")) returned 0 [0254.577] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323577\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323577\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323577\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323577\\temporaryfile")) returned 1 [0254.579] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323577\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9caea8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9caea8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9caea8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.579] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9caea8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9caea8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9caea8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.579] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9caea8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9caea8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9caea8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.579] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323577\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9caea8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9caea8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9caea8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.579] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9caea8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9caea8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9caea8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.579] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9caea8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9caea8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9caea8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.579] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.579] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323577\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323577\\temporaryfile")) returned 1 [0254.579] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9caea8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9caea8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9caea8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.579] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.580] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323577" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323577")) returned 1 [0254.580] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 0 [0254.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.581] WriteFile (in: hFile=0xdc, lpBuffer=0x23507f8*, nNumberOfBytesToWrite=0x798, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23507f8*, lpNumberOfBytesWritten=0x18fdd8*=0x798, lpOverlapped=0x0) returned 1 [0254.581] CloseHandle (hObject=0xdc) returned 1 [0254.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.582] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x29ac [0254.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x29b4) returned 0x2c8700 [0254.582] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x29ac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x29ac, lpOverlapped=0x0) returned 1 [0254.583] CloseHandle (hObject=0xdc) returned 1 [0254.583] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 1 [0254.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.584] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.584] GetTickCount () returned 0x4f008 [0254.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.585] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592\\....\\temporaryfile")) returned 0 [0254.586] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592\\temporaryfile")) returned 1 [0254.587] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.587] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.587] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.587] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.587] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.587] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.587] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.587] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592\\temporaryfile")) returned 1 [0254.587] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.588] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.588] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592")) returned 1 [0254.588] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 0 [0254.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.589] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb0c8*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb0c8*, lpNumberOfBytesWritten=0x18fdd8*=0x29b0, lpOverlapped=0x0) returned 1 [0254.590] CloseHandle (hObject=0xdc) returned 1 [0254.590] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.590] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2c54 [0254.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c5c) returned 0x2c8700 [0254.590] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2c54, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2c54, lpOverlapped=0x0) returned 1 [0254.592] CloseHandle (hObject=0xdc) returned 1 [0254.592] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 1 [0254.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.593] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.593] GetTickCount () returned 0x4f008 [0254.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.593] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592\\....\\temporaryfile")) returned 0 [0254.594] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592\\temporaryfile")) returned 1 [0254.604] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb36b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb36b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.604] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb36b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb36b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.604] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.604] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.604] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.604] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.604] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.605] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592\\temporaryfile")) returned 1 [0254.605] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb10a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb10a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb10a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.605] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.605] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323592" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323592")) returned 1 [0254.605] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 0 [0254.605] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.606] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb370*, nNumberOfBytesToWrite=0x2c58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb370*, lpNumberOfBytesWritten=0x18fdd8*=0x2c58, lpOverlapped=0x0) returned 1 [0254.607] CloseHandle (hObject=0xdc) returned 1 [0254.607] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.608] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1190 [0254.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1198) returned 0x25b528 [0254.608] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1190, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1190, lpOverlapped=0x0) returned 1 [0254.609] CloseHandle (hObject=0xdc) returned 1 [0254.609] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 1 [0254.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.610] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.610] GetTickCount () returned 0x4f018 [0254.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.611] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323608\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323608\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323608\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323608\\....\\temporaryfile")) returned 0 [0254.611] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323608\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323608\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323608\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323608\\temporaryfile")) returned 1 [0254.613] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323608\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.613] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.613] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.613] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323608\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.613] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.613] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.613] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.613] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323608\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323608\\temporaryfile")) returned 1 [0254.614] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.614] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.614] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323608" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323608")) returned 1 [0254.614] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 0 [0254.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.615] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1198, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1198, lpOverlapped=0x0) returned 1 [0254.616] CloseHandle (hObject=0xdc) returned 1 [0254.616] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.617] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x812c [0254.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8134) returned 0x2c8700 [0254.617] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x812c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x812c, lpOverlapped=0x0) returned 1 [0254.619] CloseHandle (hObject=0xdc) returned 1 [0254.619] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 1 [0254.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.620] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.620] GetTickCount () returned 0x4f028 [0254.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.620] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323624\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323624\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323624\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323624\\....\\temporaryfile")) returned 0 [0254.621] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323624\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323624\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323624\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323624\\temporaryfile")) returned 1 [0254.623] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323624\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.623] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.623] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.623] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323624\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.623] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.623] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.623] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.623] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323624\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323624\\temporaryfile")) returned 1 [0254.623] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb5cce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb5cce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb5cce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.623] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.623] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323624" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323624")) returned 1 [0254.624] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 0 [0254.624] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.625] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0848*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0848*, lpNumberOfBytesWritten=0x18fdd8*=0x8130, lpOverlapped=0x0) returned 1 [0254.626] CloseHandle (hObject=0xdc) returned 1 [0254.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.627] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x778 [0254.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x780) returned 0x2350048 [0254.627] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x778, lpOverlapped=0x0) returned 1 [0254.628] CloseHandle (hObject=0xdc) returned 1 [0254.628] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 1 [0254.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.629] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.629] GetTickCount () returned 0x4f037 [0254.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.629] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.630] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639\\....\\temporaryfile")) returned 0 [0254.631] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639\\temporaryfile")) returned 1 [0254.632] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.632] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.632] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.632] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.632] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.633] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.633] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.633] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639\\temporaryfile")) returned 1 [0254.633] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.633] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.633] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639")) returned 1 [0254.633] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 0 [0254.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.634] WriteFile (in: hFile=0xdc, lpBuffer=0x23507d8*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23507d8*, lpNumberOfBytesWritten=0x18fdd8*=0x780, lpOverlapped=0x0) returned 1 [0254.635] CloseHandle (hObject=0xdc) returned 1 [0254.635] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.635] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ea8 [0254.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1eb0) returned 0x2c8700 [0254.636] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1ea8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1ea8, lpOverlapped=0x0) returned 1 [0254.637] CloseHandle (hObject=0xdc) returned 1 [0254.637] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 1 [0254.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.638] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.638] GetTickCount () returned 0x4f037 [0254.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.638] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639\\....\\temporaryfile")) returned 0 [0254.639] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639\\temporaryfile")) returned 1 [0254.640] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.641] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.641] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.641] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.641] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.641] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.641] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.641] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639\\temporaryfile")) returned 1 [0254.641] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cb82e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cb82e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cb82e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.641] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.641] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323639" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323639")) returned 1 [0254.641] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 0 [0254.642] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.643] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca5c0*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca5c0*, lpNumberOfBytesWritten=0x18fdd8*=0x1eb0, lpOverlapped=0x0) returned 1 [0254.643] CloseHandle (hObject=0xdc) returned 1 [0254.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.645] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1fc8 [0254.645] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1fd0) returned 0x2c8700 [0254.645] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1fc8, lpOverlapped=0x0) returned 1 [0254.646] CloseHandle (hObject=0xdc) returned 1 [0254.646] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 1 [0254.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.647] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.647] GetTickCount () returned 0x4f047 [0254.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.648] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655\\....\\temporaryfile")) returned 0 [0254.648] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655\\temporaryfile")) returned 1 [0254.650] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.650] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.650] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.650] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.650] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.650] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.650] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.650] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655\\temporaryfile")) returned 1 [0254.650] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.650] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.650] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655")) returned 1 [0254.650] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 0 [0254.651] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.651] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca6e0*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca6e0*, lpNumberOfBytesWritten=0x18fdd8*=0x1fd0, lpOverlapped=0x0) returned 1 [0254.652] CloseHandle (hObject=0xdc) returned 1 [0254.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.653] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x22b0 [0254.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22b8) returned 0x2c8700 [0254.653] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x22b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x22b0, lpOverlapped=0x0) returned 1 [0254.654] CloseHandle (hObject=0xdc) returned 1 [0254.655] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 1 [0254.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.655] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.655] GetTickCount () returned 0x4f047 [0254.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.656] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655\\....\\temporaryfile")) returned 0 [0254.657] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655\\temporaryfile")) returned 1 [0254.658] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.658] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.658] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.658] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.658] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.658] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.658] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.659] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655\\temporaryfile")) returned 1 [0254.659] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cba8fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cba8fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cba8fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.659] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.659] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323655" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323655")) returned 1 [0254.659] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 0 [0254.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.660] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca9c8*, nNumberOfBytesToWrite=0x22b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca9c8*, lpNumberOfBytesWritten=0x18fdd8*=0x22b8, lpOverlapped=0x0) returned 1 [0254.661] CloseHandle (hObject=0xdc) returned 1 [0254.661] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.662] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe78 [0254.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe80) returned 0x2350048 [0254.662] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe78, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe78, lpOverlapped=0x0) returned 1 [0254.663] CloseHandle (hObject=0xdc) returned 1 [0254.663] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 1 [0254.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.664] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.664] GetTickCount () returned 0x4f056 [0254.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.665] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.665] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670\\....\\temporaryfile")) returned 0 [0254.665] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670\\temporaryfile")) returned 1 [0254.667] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbcf100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbcf100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbcf100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.667] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbcf100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbcf100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbcf100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.667] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbcf100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbcf100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbcf100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.667] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbcf100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbcf100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbcf100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.667] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbcf100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbcf100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbcf100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.667] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbcf100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbcf100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbcf100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.667] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.667] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670\\temporaryfile")) returned 1 [0254.667] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbcf100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbcf100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbcf100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.667] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.667] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670")) returned 1 [0254.668] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 0 [0254.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.668] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe80, lpOverlapped=0x0) returned 1 [0254.669] CloseHandle (hObject=0xdc) returned 1 [0254.669] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.670] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbc0 [0254.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbc8) returned 0x2350048 [0254.670] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xbc0, lpOverlapped=0x0) returned 1 [0254.671] CloseHandle (hObject=0xdc) returned 1 [0254.671] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 1 [0254.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.672] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.672] GetTickCount () returned 0x4f056 [0254.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.673] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.673] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.673] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670\\....\\temporaryfile")) returned 0 [0254.674] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670\\temporaryfile")) returned 1 [0254.675] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbcf100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.675] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbcf100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.675] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.675] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.675] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.675] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.675] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.675] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670\\temporaryfile")) returned 1 [0254.676] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.676] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.676] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323670" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323670")) returned 1 [0254.676] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 0 [0254.676] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.677] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xbc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xbc8, lpOverlapped=0x0) returned 1 [0254.678] CloseHandle (hObject=0xdc) returned 1 [0254.678] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.678] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4e80 [0254.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4e88) returned 0x2c8700 [0254.678] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4e80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4e80, lpOverlapped=0x0) returned 1 [0254.680] CloseHandle (hObject=0xdc) returned 1 [0254.680] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 1 [0254.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.681] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.681] GetTickCount () returned 0x4f066 [0254.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.681] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323686\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323686\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323686\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323686\\....\\temporaryfile")) returned 0 [0254.682] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323686\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323686\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323686\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323686\\temporaryfile")) returned 1 [0254.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323686\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.684] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323686\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.684] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.684] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.684] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.684] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323686\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323686\\temporaryfile")) returned 1 [0254.684] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cbf5260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cbf5260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cbf5260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.684] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.684] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323686" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323686")) returned 1 [0254.684] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 0 [0254.685] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.685] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd598*, nNumberOfBytesToWrite=0x4e88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd598*, lpNumberOfBytesWritten=0x18fdd8*=0x4e88, lpOverlapped=0x0) returned 1 [0254.686] CloseHandle (hObject=0xdc) returned 1 [0254.687] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.687] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8f0c [0254.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8f14) returned 0x2c8700 [0254.687] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8f0c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8f0c, lpOverlapped=0x0) returned 1 [0254.688] CloseHandle (hObject=0xdc) returned 1 [0254.689] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 1 [0254.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.690] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.690] GetTickCount () returned 0x4f076 [0254.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.690] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702\\....\\temporaryfile")) returned 0 [0254.691] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702\\temporaryfile")) returned 1 [0254.692] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.692] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.692] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.692] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.692] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.692] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.692] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.692] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702\\temporaryfile")) returned 1 [0254.693] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.693] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.693] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702")) returned 1 [0254.693] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 0 [0254.694] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.694] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1628*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1628*, lpNumberOfBytesWritten=0x18fdd8*=0x8f10, lpOverlapped=0x0) returned 1 [0254.695] CloseHandle (hObject=0xdc) returned 1 [0254.696] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.697] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7850 [0254.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7858) returned 0x2c8700 [0254.697] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7850, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7850, lpOverlapped=0x0) returned 1 [0254.700] CloseHandle (hObject=0xdc) returned 1 [0254.700] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 1 [0254.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.701] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.701] GetTickCount () returned 0x4f076 [0254.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.702] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702\\....\\temporaryfile")) returned 0 [0254.703] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702\\temporaryfile")) returned 1 [0254.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.705] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.705] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.705] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.705] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702\\temporaryfile")) returned 1 [0254.705] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc1b3c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc1b3c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc1b3c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.705] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.705] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323702" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323702")) returned 1 [0254.705] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 0 [0254.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.706] WriteFile (in: hFile=0xdc, lpBuffer=0x2cff68*, nNumberOfBytesToWrite=0x7858, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cff68*, lpNumberOfBytesWritten=0x18fdd8*=0x7858, lpOverlapped=0x0) returned 1 [0254.708] CloseHandle (hObject=0xdc) returned 1 [0254.708] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.708] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9658 [0254.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9660) returned 0x2c8700 [0254.708] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x9658, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x9658, lpOverlapped=0x0) returned 1 [0254.710] CloseHandle (hObject=0xdc) returned 1 [0254.710] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 1 [0254.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.711] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.711] GetTickCount () returned 0x4f085 [0254.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.712] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323717\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323717\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.712] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323717\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323717\\....\\temporaryfile")) returned 0 [0254.712] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323717\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323717\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323717\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323717\\temporaryfile")) returned 1 [0254.713] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323717\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc41520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc41520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc41520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc41520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc41520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc41520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc41520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc41520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc41520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.714] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323717\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc41520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc41520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc41520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.714] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc41520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc41520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc41520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.714] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc41520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc41520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc41520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.714] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.714] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323717\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323717\\temporaryfile")) returned 1 [0254.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc41520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc41520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc41520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.714] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.714] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323717" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323717")) returned 1 [0254.714] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 0 [0254.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.716] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1d70*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1d70*, lpNumberOfBytesWritten=0x18fdd8*=0x9660, lpOverlapped=0x0) returned 1 [0254.717] CloseHandle (hObject=0xdc) returned 1 [0254.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.718] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3c58 [0254.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3c60) returned 0x2c8700 [0254.718] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3c58, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3c58, lpOverlapped=0x0) returned 1 [0254.720] CloseHandle (hObject=0xdc) returned 1 [0254.721] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 1 [0254.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.721] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.722] GetTickCount () returned 0x4f095 [0254.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.722] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733\\....\\temporaryfile")) returned 0 [0254.723] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733\\temporaryfile")) returned 1 [0254.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.724] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.724] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.724] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.724] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733\\temporaryfile")) returned 1 [0254.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.725] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733")) returned 1 [0254.725] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 0 [0254.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.726] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc370*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc370*, lpNumberOfBytesWritten=0x18fdd8*=0x3c60, lpOverlapped=0x0) returned 1 [0254.727] CloseHandle (hObject=0xdc) returned 1 [0254.727] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.727] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4238 [0254.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4240) returned 0x2c8700 [0254.727] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4238, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4238, lpOverlapped=0x0) returned 1 [0254.729] CloseHandle (hObject=0xdc) returned 1 [0254.729] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 1 [0254.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.730] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.730] GetTickCount () returned 0x4f095 [0254.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.730] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733\\....\\temporaryfile")) returned 0 [0254.731] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733\\temporaryfile")) returned 1 [0254.736] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.736] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.736] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.736] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.736] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.736] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733\\temporaryfile")) returned 1 [0254.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc67680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc67680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc67680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.736] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.736] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323733" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323733")) returned 1 [0254.737] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 0 [0254.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.738] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc950*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc950*, lpNumberOfBytesWritten=0x18fdd8*=0x4240, lpOverlapped=0x0) returned 1 [0254.739] CloseHandle (hObject=0xdc) returned 1 [0254.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.739] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4464 [0254.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x446c) returned 0x2c8700 [0254.739] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4464, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4464, lpOverlapped=0x0) returned 1 [0254.741] CloseHandle (hObject=0xdc) returned 1 [0254.741] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 1 [0254.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.742] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.742] GetTickCount () returned 0x4f0a4 [0254.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.742] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323748\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323748\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323748\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323748\\....\\temporaryfile")) returned 0 [0254.743] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323748\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323748\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323748\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323748\\temporaryfile")) returned 1 [0254.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323748\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc8d7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc8d7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc8d7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.744] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc8d7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc8d7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc8d7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.744] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc8d7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc8d7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc8d7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323748\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc8d7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc8d7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc8d7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.744] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc8d7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc8d7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc8d7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.744] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc8d7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc8d7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc8d7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.744] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.744] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323748\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323748\\temporaryfile")) returned 1 [0254.745] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cc8d7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cc8d7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cc8d7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.745] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323748" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323748")) returned 1 [0254.745] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 0 [0254.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.746] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccb80*, nNumberOfBytesToWrite=0x4468, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccb80*, lpNumberOfBytesWritten=0x18fdd8*=0x4468, lpOverlapped=0x0) returned 1 [0254.747] CloseHandle (hObject=0xdc) returned 1 [0254.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.748] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x85d0 [0254.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x85d8) returned 0x2c8700 [0254.748] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x85d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x85d0, lpOverlapped=0x0) returned 1 [0254.750] CloseHandle (hObject=0xdc) returned 1 [0254.750] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 1 [0254.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.751] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.751] GetTickCount () returned 0x4f0b4 [0254.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.751] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764\\....\\temporaryfile")) returned 0 [0254.752] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764\\temporaryfile")) returned 1 [0254.753] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.753] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.753] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.753] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.753] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.753] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.753] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.754] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764\\temporaryfile")) returned 1 [0254.754] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.754] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.754] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764")) returned 1 [0254.754] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 0 [0254.755] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.755] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0ce8*, nNumberOfBytesToWrite=0x85d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0ce8*, lpNumberOfBytesWritten=0x18fdd8*=0x85d8, lpOverlapped=0x0) returned 1 [0254.757] CloseHandle (hObject=0xdc) returned 1 [0254.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.757] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x31d0 [0254.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x31d8) returned 0x2c8700 [0254.757] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x31d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x31d0, lpOverlapped=0x0) returned 1 [0254.759] CloseHandle (hObject=0xdc) returned 1 [0254.759] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 1 [0254.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.760] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.760] GetTickCount () returned 0x4f0b4 [0254.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.761] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764\\....\\temporaryfile")) returned 0 [0254.761] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764\\temporaryfile")) returned 1 [0254.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.763] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.763] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.763] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.763] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.763] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.763] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764\\temporaryfile")) returned 1 [0254.763] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccb3940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccb3940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccb3940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.763] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323764" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323764")) returned 1 [0254.763] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 0 [0254.764] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.764] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb8e8*, nNumberOfBytesToWrite=0x31d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb8e8*, lpNumberOfBytesWritten=0x18fdd8*=0x31d8, lpOverlapped=0x0) returned 1 [0254.765] CloseHandle (hObject=0xdc) returned 1 [0254.766] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.766] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d08 [0254.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d10) returned 0x2c8700 [0254.766] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1d08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1d08, lpOverlapped=0x0) returned 1 [0254.768] CloseHandle (hObject=0xdc) returned 1 [0254.768] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 1 [0254.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.769] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.769] GetTickCount () returned 0x4f0c4 [0254.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.769] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780\\....\\temporaryfile")) returned 0 [0254.770] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780\\temporaryfile")) returned 1 [0254.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.771] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.771] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.771] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780\\temporaryfile")) returned 1 [0254.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.772] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.772] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780")) returned 1 [0254.772] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 0 [0254.772] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.773] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca420*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca420*, lpNumberOfBytesWritten=0x18fdd8*=0x1d10, lpOverlapped=0x0) returned 1 [0254.775] CloseHandle (hObject=0xdc) returned 1 [0254.775] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.775] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30f0 [0254.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30f8) returned 0x2c8700 [0254.775] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x30f0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x30f0, lpOverlapped=0x0) returned 1 [0254.777] CloseHandle (hObject=0xdc) returned 1 [0254.777] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 1 [0254.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.778] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.778] GetTickCount () returned 0x4f0c4 [0254.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.778] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.779] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780\\....\\temporaryfile")) returned 0 [0254.779] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780\\temporaryfile")) returned 1 [0254.780] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.781] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.781] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.781] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.781] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.781] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780\\temporaryfile")) returned 1 [0254.781] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccd9aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccd9aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccd9aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.781] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.781] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323780" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323780")) returned 1 [0254.781] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 0 [0254.782] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.782] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb808*, nNumberOfBytesToWrite=0x30f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb808*, lpNumberOfBytesWritten=0x18fdd8*=0x30f8, lpOverlapped=0x0) returned 1 [0254.783] CloseHandle (hObject=0xdc) returned 1 [0254.784] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.785] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x560 [0254.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x568) returned 0x259e70 [0254.785] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x560, lpOverlapped=0x0) returned 1 [0254.786] CloseHandle (hObject=0xdc) returned 1 [0254.786] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 1 [0254.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.787] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.787] GetTickCount () returned 0x4f0d3 [0254.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.787] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795\\....\\temporaryfile")) returned 0 [0254.788] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795\\temporaryfile")) returned 1 [0254.789] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.789] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.789] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.789] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.790] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.790] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.790] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.790] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795\\temporaryfile")) returned 1 [0254.790] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.790] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.790] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795")) returned 1 [0254.790] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 0 [0254.790] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.791] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x568, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x568, lpOverlapped=0x0) returned 1 [0254.792] CloseHandle (hObject=0xdc) returned 1 [0254.792] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.793] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb66e [0254.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb676) returned 0x2c8700 [0254.793] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb66e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb66e, lpOverlapped=0x0) returned 1 [0254.795] CloseHandle (hObject=0xdc) returned 1 [0254.795] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 1 [0254.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.796] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.796] GetTickCount () returned 0x4f0d3 [0254.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.796] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.797] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795\\....\\temporaryfile")) returned 0 [0254.797] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795\\temporaryfile")) returned 1 [0254.799] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.799] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.799] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.799] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.799] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.799] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.799] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.799] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795\\temporaryfile")) returned 1 [0254.799] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ccffc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ccffc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ccffc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.799] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.799] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323795" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323795")) returned 1 [0254.799] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 0 [0254.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.801] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3d88*, nNumberOfBytesToWrite=0xb678, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3d88*, lpNumberOfBytesWritten=0x18fdd8*=0xb678, lpOverlapped=0x0) returned 1 [0254.802] CloseHandle (hObject=0xdc) returned 1 [0254.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.803] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x54d4 [0254.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54dc) returned 0x2c8700 [0254.803] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x54d4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x54d4, lpOverlapped=0x0) returned 1 [0254.805] CloseHandle (hObject=0xdc) returned 1 [0254.805] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 1 [0254.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.806] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.806] GetTickCount () returned 0x4f0e3 [0254.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.806] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323811\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323811\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323811\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323811\\....\\temporaryfile")) returned 0 [0254.807] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323811\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323811\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323811\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323811\\temporaryfile")) returned 1 [0254.808] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323811\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd25d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd25d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd25d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.809] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd25d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd25d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd25d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.809] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd25d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd25d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd25d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.809] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323811\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd25d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd25d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd25d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.809] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd25d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd25d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd25d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.809] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd25d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd25d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd25d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.809] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.809] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323811\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323811\\temporaryfile")) returned 1 [0254.809] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd25d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd25d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd25d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.809] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.809] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323811" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323811")) returned 1 [0254.809] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 0 [0254.810] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.810] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdbf0*, nNumberOfBytesToWrite=0x54d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdbf0*, lpNumberOfBytesWritten=0x18fdd8*=0x54d8, lpOverlapped=0x0) returned 1 [0254.811] CloseHandle (hObject=0xdc) returned 1 [0254.812] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.812] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x45f8 [0254.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4600) returned 0x2c8700 [0254.812] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x45f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x45f8, lpOverlapped=0x0) returned 1 [0254.813] CloseHandle (hObject=0xdc) returned 1 [0254.813] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 1 [0254.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.814] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.814] GetTickCount () returned 0x4f0f2 [0254.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.815] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.815] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826\\....\\temporaryfile")) returned 0 [0254.816] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826\\temporaryfile")) returned 1 [0254.817] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.817] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.817] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.817] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.817] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.817] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.817] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.817] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826\\temporaryfile")) returned 1 [0254.818] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.818] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.818] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826")) returned 1 [0254.818] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 0 [0254.818] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.819] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccd10*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccd10*, lpNumberOfBytesWritten=0x18fdd8*=0x4600, lpOverlapped=0x0) returned 1 [0254.820] CloseHandle (hObject=0xdc) returned 1 [0254.820] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.820] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2c84 [0254.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c8c) returned 0x2c8700 [0254.821] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2c84, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2c84, lpOverlapped=0x0) returned 1 [0254.822] CloseHandle (hObject=0xdc) returned 1 [0254.822] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 1 [0254.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.823] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.823] GetTickCount () returned 0x4f0f2 [0254.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.823] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.824] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826\\....\\temporaryfile")) returned 0 [0254.824] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826\\temporaryfile")) returned 1 [0254.825] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.825] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.825] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.825] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.826] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.826] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.826] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.826] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826\\temporaryfile")) returned 1 [0254.826] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd4bec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd4bec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd4bec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.826] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.826] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323826" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323826")) returned 1 [0254.826] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 0 [0254.826] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.827] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb3a0*, nNumberOfBytesToWrite=0x2c88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb3a0*, lpNumberOfBytesWritten=0x18fdd8*=0x2c88, lpOverlapped=0x0) returned 1 [0254.828] CloseHandle (hObject=0xdc) returned 1 [0254.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.829] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x48dc [0254.829] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48e4) returned 0x2c8700 [0254.829] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x48dc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x48dc, lpOverlapped=0x0) returned 1 [0254.830] CloseHandle (hObject=0xdc) returned 1 [0254.830] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 1 [0254.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.831] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.831] GetTickCount () returned 0x4f102 [0254.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.832] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842\\....\\temporaryfile")) returned 0 [0254.832] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842\\temporaryfile")) returned 1 [0254.834] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.834] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.834] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.834] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.834] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842\\temporaryfile")) returned 1 [0254.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.834] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842")) returned 1 [0254.834] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 0 [0254.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.835] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccff8*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccff8*, lpNumberOfBytesWritten=0x18fdd8*=0x48e0, lpOverlapped=0x0) returned 1 [0254.837] CloseHandle (hObject=0xdc) returned 1 [0254.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.838] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x462e [0254.838] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4636) returned 0x2c8700 [0254.838] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x462e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x462e, lpOverlapped=0x0) returned 1 [0254.839] CloseHandle (hObject=0xdc) returned 1 [0254.839] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 1 [0254.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.840] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.840] GetTickCount () returned 0x4f102 [0254.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.841] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842\\....\\temporaryfile")) returned 0 [0254.841] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842\\temporaryfile")) returned 1 [0254.843] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.843] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.843] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.843] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.843] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.843] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.843] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.843] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842\\temporaryfile")) returned 1 [0254.843] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd72020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd72020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd72020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.843] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.843] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323842" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323842")) returned 1 [0254.844] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 0 [0254.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.845] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccd48*, nNumberOfBytesToWrite=0x4638, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccd48*, lpNumberOfBytesWritten=0x18fdd8*=0x4638, lpOverlapped=0x0) returned 1 [0254.846] CloseHandle (hObject=0xdc) returned 1 [0254.846] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.847] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x72de [0254.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x72e6) returned 0x2c8700 [0254.847] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x72de, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x72de, lpOverlapped=0x0) returned 1 [0254.849] CloseHandle (hObject=0xdc) returned 1 [0254.849] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 1 [0254.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.850] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.850] GetTickCount () returned 0x4f112 [0254.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.851] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.851] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858\\....\\temporaryfile")) returned 0 [0254.851] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858\\temporaryfile")) returned 1 [0254.852] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.853] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.853] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.853] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.853] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.853] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.853] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.853] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858\\temporaryfile")) returned 1 [0254.853] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.853] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.853] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858")) returned 1 [0254.853] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 0 [0254.854] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.854] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf9f8*, nNumberOfBytesToWrite=0x72e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf9f8*, lpNumberOfBytesWritten=0x18fdd8*=0x72e8, lpOverlapped=0x0) returned 1 [0254.856] CloseHandle (hObject=0xdc) returned 1 [0254.856] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.856] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb594 [0254.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb59c) returned 0x2c8700 [0254.856] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb594, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb594, lpOverlapped=0x0) returned 1 [0254.858] CloseHandle (hObject=0xdc) returned 1 [0254.858] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 1 [0254.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.859] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.859] GetTickCount () returned 0x4f112 [0254.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.860] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858\\....\\temporaryfile")) returned 0 [0254.861] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858\\temporaryfile")) returned 1 [0254.862] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cdbe2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cdbe2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cdbe2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cdbe2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.862] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.862] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.862] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.862] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858\\temporaryfile")) returned 1 [0254.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cd98180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cd98180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cd98180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.863] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.863] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323858" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323858")) returned 1 [0254.863] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 0 [0254.864] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.867] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3cb0*, nNumberOfBytesToWrite=0xb598, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3cb0*, lpNumberOfBytesWritten=0x18fdd8*=0xb598, lpOverlapped=0x0) returned 1 [0254.869] CloseHandle (hObject=0xdc) returned 1 [0254.869] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.870] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x51aa [0254.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x51b2) returned 0x2c8700 [0254.870] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x51aa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x51aa, lpOverlapped=0x0) returned 1 [0254.871] CloseHandle (hObject=0xdc) returned 1 [0254.871] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 1 [0254.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.872] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.872] GetTickCount () returned 0x4f121 [0254.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.873] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323873\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323873\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323873\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323873\\....\\temporaryfile")) returned 0 [0254.873] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323873\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323873\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323873\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323873\\temporaryfile")) returned 1 [0254.874] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323873\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cdbe2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cdbe2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cdbe2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.875] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cdbe2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cdbe2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cdbe2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.875] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cdbe2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cdbe2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cdbe2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.875] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323873\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cdbe2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cdbe2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cdbe2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.875] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cdbe2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cdbe2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cdbe2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.875] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cdbe2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cdbe2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cdbe2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.875] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.875] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323873\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323873\\temporaryfile")) returned 1 [0254.875] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cdbe2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cdbe2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cdbe2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.875] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.875] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323873" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323873")) returned 1 [0254.875] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 0 [0254.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.877] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd8c8*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd8c8*, lpNumberOfBytesWritten=0x18fdd8*=0x51b0, lpOverlapped=0x0) returned 1 [0254.878] CloseHandle (hObject=0xdc) returned 1 [0254.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.878] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3888 [0254.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3890) returned 0x2c8700 [0254.878] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3888, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3888, lpOverlapped=0x0) returned 1 [0254.880] CloseHandle (hObject=0xdc) returned 1 [0254.880] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 1 [0254.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.881] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.881] GetTickCount () returned 0x4f131 [0254.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.881] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889\\....\\temporaryfile")) returned 0 [0254.882] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889\\temporaryfile")) returned 1 [0254.883] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.883] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.883] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.883] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.884] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.884] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.884] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.884] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889\\temporaryfile")) returned 1 [0254.884] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.884] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.884] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889")) returned 1 [0254.884] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 0 [0254.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.885] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbfa0*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbfa0*, lpNumberOfBytesWritten=0x18fdd8*=0x3890, lpOverlapped=0x0) returned 1 [0254.886] CloseHandle (hObject=0xdc) returned 1 [0254.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.887] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ae8 [0254.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1af0) returned 0x2c4a70 [0254.887] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1ae8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1ae8, lpOverlapped=0x0) returned 1 [0254.888] CloseHandle (hObject=0xdc) returned 1 [0254.888] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 1 [0254.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.889] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.889] GetTickCount () returned 0x4f131 [0254.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.890] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889\\....\\temporaryfile")) returned 0 [0254.890] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889\\temporaryfile")) returned 1 [0254.892] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.892] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.892] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.892] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.892] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.892] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889\\temporaryfile")) returned 1 [0254.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cde4440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cde4440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cde4440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.892] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.892] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323889" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323889")) returned 1 [0254.893] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 0 [0254.893] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.893] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1af0, lpOverlapped=0x0) returned 1 [0254.894] CloseHandle (hObject=0xdc) returned 1 [0254.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.895] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d18 [0254.895] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d20) returned 0x2c8700 [0254.895] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1d18, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1d18, lpOverlapped=0x0) returned 1 [0254.896] CloseHandle (hObject=0xdc) returned 1 [0254.896] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 1 [0254.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.897] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.897] GetTickCount () returned 0x4f140 [0254.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.898] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.898] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904\\....\\temporaryfile")) returned 0 [0254.898] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904\\temporaryfile")) returned 1 [0254.899] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.899] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.900] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.900] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.900] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.900] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.900] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.900] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904\\temporaryfile")) returned 1 [0254.900] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.900] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.900] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904")) returned 1 [0254.900] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 0 [0254.901] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.901] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca430*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca430*, lpNumberOfBytesWritten=0x18fdd8*=0x1d20, lpOverlapped=0x0) returned 1 [0254.902] CloseHandle (hObject=0xdc) returned 1 [0254.902] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.903] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b74 [0254.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b7c) returned 0x2c4a70 [0254.903] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b74, lpOverlapped=0x0) returned 1 [0254.905] CloseHandle (hObject=0xdc) returned 1 [0254.905] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 1 [0254.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.906] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.906] GetTickCount () returned 0x4f140 [0254.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.906] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904\\....\\temporaryfile")) returned 0 [0254.907] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904\\temporaryfile")) returned 1 [0254.908] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce30700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce30700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.908] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce30700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce30700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.908] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.908] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.908] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.908] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.909] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.909] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904\\temporaryfile")) returned 1 [0254.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce0a5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce0a5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce0a5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.909] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.909] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323904" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323904")) returned 1 [0254.909] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 0 [0254.909] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.910] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1b78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b78, lpOverlapped=0x0) returned 1 [0254.911] CloseHandle (hObject=0xdc) returned 1 [0254.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.912] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3198 [0254.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x31a0) returned 0x2c8700 [0254.912] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3198, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3198, lpOverlapped=0x0) returned 1 [0254.914] CloseHandle (hObject=0xdc) returned 1 [0254.914] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 1 [0254.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.915] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.915] GetTickCount () returned 0x4f150 [0254.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.916] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323920\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323920\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323920\\....\\temporaryfile")) returned 0 [0254.917] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323920\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323920\\temporaryfile")) returned 1 [0254.918] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323920\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce30700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce30700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce30700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce30700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce30700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce30700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce30700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce30700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce30700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.918] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323920\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce30700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce30700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce30700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.918] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce30700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce30700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce30700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.918] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce30700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce30700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce30700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.918] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323920\\temporaryfile")) returned 1 [0254.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce30700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce30700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce30700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.918] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.919] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323920" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323920")) returned 1 [0254.919] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 0 [0254.919] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.920] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb8b0*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb8b0*, lpNumberOfBytesWritten=0x18fdd8*=0x31a0, lpOverlapped=0x0) returned 1 [0254.921] CloseHandle (hObject=0xdc) returned 1 [0254.921] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.921] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16e8 [0254.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16f0) returned 0x2c4a70 [0254.921] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16e8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16e8, lpOverlapped=0x0) returned 1 [0254.923] CloseHandle (hObject=0xdc) returned 1 [0254.923] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 1 [0254.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.924] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.924] GetTickCount () returned 0x4f160 [0254.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.924] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936\\....\\temporaryfile")) returned 0 [0254.925] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936\\temporaryfile")) returned 1 [0254.926] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.926] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.926] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.926] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.926] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.926] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.926] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.926] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936\\temporaryfile")) returned 1 [0254.926] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.927] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.927] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936")) returned 1 [0254.927] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 0 [0254.927] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.928] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x16f0, lpOverlapped=0x0) returned 1 [0254.928] CloseHandle (hObject=0xdc) returned 1 [0254.929] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.929] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2608 [0254.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2610) returned 0x2c8700 [0254.929] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2608, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2608, lpOverlapped=0x0) returned 1 [0254.931] CloseHandle (hObject=0xdc) returned 1 [0254.931] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 1 [0254.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.932] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.932] GetTickCount () returned 0x4f160 [0254.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.932] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936\\....\\temporaryfile")) returned 0 [0254.933] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936\\temporaryfile")) returned 1 [0254.934] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.934] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.934] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.934] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.934] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.935] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.935] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.935] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936\\temporaryfile")) returned 1 [0254.935] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce56860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce56860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce56860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.935] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.935] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323936" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323936")) returned 1 [0254.935] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 0 [0254.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.936] WriteFile (in: hFile=0xdc, lpBuffer=0x2cad20*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cad20*, lpNumberOfBytesWritten=0x18fdd8*=0x2610, lpOverlapped=0x0) returned 1 [0254.937] CloseHandle (hObject=0xdc) returned 1 [0254.937] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.938] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13ec [0254.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13f4) returned 0x25b528 [0254.938] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13ec, lpOverlapped=0x0) returned 1 [0254.939] CloseHandle (hObject=0xdc) returned 1 [0254.939] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 1 [0254.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.940] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.940] GetTickCount () returned 0x4f16f [0254.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.941] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951\\....\\temporaryfile")) returned 0 [0254.941] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951\\temporaryfile")) returned 1 [0254.942] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.943] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.943] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.943] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.943] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.943] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.943] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951\\temporaryfile")) returned 1 [0254.943] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.943] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.943] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951")) returned 1 [0254.943] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 0 [0254.944] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.944] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x13f0, lpOverlapped=0x0) returned 1 [0254.945] CloseHandle (hObject=0xdc) returned 1 [0254.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.946] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6196 [0254.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x619e) returned 0x2c8700 [0254.946] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6196, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6196, lpOverlapped=0x0) returned 1 [0254.947] CloseHandle (hObject=0xdc) returned 1 [0254.947] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 1 [0254.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.948] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.948] GetTickCount () returned 0x4f16f [0254.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.949] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951\\....\\temporaryfile")) returned 0 [0254.950] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951\\temporaryfile")) returned 1 [0254.951] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.951] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.951] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.951] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.951] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.951] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.951] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.951] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951\\temporaryfile")) returned 1 [0254.952] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ce7c9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ce7c9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ce7c9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.952] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.952] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323951" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323951")) returned 1 [0254.952] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 0 [0254.952] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.953] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce8b0*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce8b0*, lpNumberOfBytesWritten=0x18fdd8*=0x61a0, lpOverlapped=0x0) returned 1 [0254.954] CloseHandle (hObject=0xdc) returned 1 [0254.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.955] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb57d [0254.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb585) returned 0x2c8700 [0254.955] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb57d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb57d, lpOverlapped=0x0) returned 1 [0254.957] CloseHandle (hObject=0xdc) returned 1 [0254.957] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 1 [0254.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.958] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.958] GetTickCount () returned 0x4f17f [0254.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.958] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.958] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967\\....\\temporaryfile")) returned 0 [0254.959] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967\\temporaryfile")) returned 1 [0254.960] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.960] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.960] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.960] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.960] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.960] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.960] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.960] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967\\temporaryfile")) returned 1 [0254.961] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.961] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.961] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967")) returned 1 [0254.961] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 0 [0254.962] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.962] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3c98*, nNumberOfBytesToWrite=0xb588, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3c98*, lpNumberOfBytesWritten=0x18fdd8*=0xb588, lpOverlapped=0x0) returned 1 [0254.964] CloseHandle (hObject=0xdc) returned 1 [0254.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.964] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x38d8 [0254.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x38e0) returned 0x2c8700 [0254.964] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x38d8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x38d8, lpOverlapped=0x0) returned 1 [0254.966] CloseHandle (hObject=0xdc) returned 1 [0254.966] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 1 [0254.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.967] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.967] GetTickCount () returned 0x4f17f [0254.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.967] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967\\....\\temporaryfile")) returned 0 [0254.968] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967\\temporaryfile")) returned 1 [0254.969] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.970] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.970] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.970] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.970] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.970] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.970] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.970] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967\\temporaryfile")) returned 1 [0254.970] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cea2b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cea2b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cea2b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.970] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.970] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323967" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323967")) returned 1 [0254.970] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 0 [0254.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.971] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbff0*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbff0*, lpNumberOfBytesWritten=0x18fdd8*=0x38e0, lpOverlapped=0x0) returned 1 [0254.973] CloseHandle (hObject=0xdc) returned 1 [0254.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.974] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb12e [0254.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb136) returned 0x2c8700 [0254.974] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb12e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb12e, lpOverlapped=0x0) returned 1 [0254.975] CloseHandle (hObject=0xdc) returned 1 [0254.975] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 1 [0254.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.977] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.977] GetTickCount () returned 0x4f18e [0254.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.977] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323982\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323982\\...."), lpSecurityAttributes=0x256228) returned 1 [0254.978] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323982\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323982\\....\\temporaryfile")) returned 0 [0254.978] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323982\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323982\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323982\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323982\\temporaryfile")) returned 1 [0254.979] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323982\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cec8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cec8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cec8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.979] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cec8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cec8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cec8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.979] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cec8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cec8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cec8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.979] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323982\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cec8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cec8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cec8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.979] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cec8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cec8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cec8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.979] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cec8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cec8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cec8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.979] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.980] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323982\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323982\\temporaryfile")) returned 1 [0254.980] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cec8c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cec8c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cec8c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.980] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.980] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323982" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323982")) returned 1 [0254.980] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 0 [0254.981] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.981] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3848*, nNumberOfBytesToWrite=0xb138, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3848*, lpNumberOfBytesWritten=0x18fdd8*=0xb138, lpOverlapped=0x0) returned 1 [0254.983] CloseHandle (hObject=0xdc) returned 1 [0254.983] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.984] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd902 [0254.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd90a) returned 0x2c8700 [0254.984] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xd902, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xd902, lpOverlapped=0x0) returned 1 [0254.986] CloseHandle (hObject=0xdc) returned 1 [0254.986] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 1 [0254.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0254.987] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.987] GetTickCount () returned 0x4f19e [0254.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0254.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0254.988] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998\\...."), lpSecurityAttributes=0x256210) returned 1 [0254.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998\\....\\temporaryfile")) returned 0 [0254.988] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998\\temporaryfile")) returned 1 [0254.989] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ceeede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ceeede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ceeede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0254.990] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ceeede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ceeede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ceeede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.990] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ceeede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ceeede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ceeede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0254.990] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ceeede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ceeede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ceeede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0254.990] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ceeede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ceeede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ceeede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.990] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ceeede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ceeede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ceeede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0254.990] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0254.990] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998\\temporaryfile")) returned 1 [0254.990] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ceeede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ceeede0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ceeede0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0254.990] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0254.990] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998")) returned 1 [0254.990] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 0 [0254.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.992] WriteFile (in: hFile=0xdc, lpBuffer=0x2d6020*, nNumberOfBytesToWrite=0xd908, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d6020*, lpNumberOfBytesWritten=0x18fdd8*=0xd908, lpOverlapped=0x0) returned 1 [0254.993] CloseHandle (hObject=0xdc) returned 1 [0254.994] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0254.994] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x907d [0254.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9085) returned 0x2c8700 [0254.994] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x907d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x907d, lpOverlapped=0x0) returned 1 [0254.996] CloseHandle (hObject=0xdc) returned 1 [0254.996] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 1 [0254.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0254.997] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0254.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0254.997] GetTickCount () returned 0x4f19e [0254.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0254.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.001] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.001] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998\\....\\temporaryfile")) returned 0 [0255.002] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998\\temporaryfile")) returned 1 [0255.003] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ceeede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.003] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ceeede0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.003] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.003] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.003] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.003] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.003] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.003] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998\\temporaryfile")) returned 1 [0255.003] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.003] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.004] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18323998" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18323998")) returned 1 [0255.004] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 0 [0255.004] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.005] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1798*, nNumberOfBytesToWrite=0x9088, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1798*, lpNumberOfBytesWritten=0x18fdd8*=0x9088, lpOverlapped=0x0) returned 1 [0255.006] CloseHandle (hObject=0xdc) returned 1 [0255.007] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.007] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7214 [0255.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x721c) returned 0x2c8700 [0255.007] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7214, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7214, lpOverlapped=0x0) returned 1 [0255.009] CloseHandle (hObject=0xdc) returned 1 [0255.009] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 1 [0255.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.010] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.010] GetTickCount () returned 0x4f1ae [0255.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.010] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324014\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324014\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.011] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324014\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324014\\....\\temporaryfile")) returned 0 [0255.011] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324014\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324014\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324014\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324014\\temporaryfile")) returned 1 [0255.012] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324014\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.012] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.012] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.012] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324014\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.012] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.012] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.013] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.013] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324014\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324014\\temporaryfile")) returned 1 [0255.013] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf14f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf14f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf14f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.013] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.013] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324014" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324014")) returned 1 [0255.013] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 0 [0255.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.014] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf930*, nNumberOfBytesToWrite=0x7218, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf930*, lpNumberOfBytesWritten=0x18fdd8*=0x7218, lpOverlapped=0x0) returned 1 [0255.015] CloseHandle (hObject=0xdc) returned 1 [0255.016] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.016] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x67a3 [0255.016] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x67ab) returned 0x2c8700 [0255.016] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x67a3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x67a3, lpOverlapped=0x0) returned 1 [0255.018] CloseHandle (hObject=0xdc) returned 1 [0255.018] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 1 [0255.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.019] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.019] GetTickCount () returned 0x4f1bd [0255.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.019] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029\\....\\temporaryfile")) returned 0 [0255.020] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029\\temporaryfile")) returned 1 [0255.021] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.021] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.021] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.021] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.021] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.021] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.021] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.021] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029\\temporaryfile")) returned 1 [0255.022] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.022] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.022] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029")) returned 1 [0255.022] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 0 [0255.022] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.023] WriteFile (in: hFile=0xdc, lpBuffer=0x2ceec0*, nNumberOfBytesToWrite=0x67a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ceec0*, lpNumberOfBytesWritten=0x18fdd8*=0x67a8, lpOverlapped=0x0) returned 1 [0255.024] CloseHandle (hObject=0xdc) returned 1 [0255.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.025] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5de2 [0255.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5dea) returned 0x2c8700 [0255.025] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5de2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5de2, lpOverlapped=0x0) returned 1 [0255.026] CloseHandle (hObject=0xdc) returned 1 [0255.026] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 1 [0255.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.027] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.027] GetTickCount () returned 0x4f1bd [0255.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.028] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029\\....\\temporaryfile")) returned 0 [0255.028] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029\\temporaryfile")) returned 1 [0255.030] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.030] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.030] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.030] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.030] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.030] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.030] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.030] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029\\temporaryfile")) returned 1 [0255.030] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf3b0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf3b0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf3b0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.030] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.030] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324029" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324029")) returned 1 [0255.031] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 0 [0255.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.032] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce500*, nNumberOfBytesToWrite=0x5de8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce500*, lpNumberOfBytesWritten=0x18fdd8*=0x5de8, lpOverlapped=0x0) returned 1 [0255.033] CloseHandle (hObject=0xdc) returned 1 [0255.033] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.033] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5b2a [0255.033] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b32) returned 0x2c8700 [0255.033] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5b2a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5b2a, lpOverlapped=0x0) returned 1 [0255.035] CloseHandle (hObject=0xdc) returned 1 [0255.035] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 1 [0255.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.036] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.036] GetTickCount () returned 0x4f1cd [0255.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.037] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045\\....\\temporaryfile")) returned 0 [0255.037] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045\\temporaryfile")) returned 1 [0255.038] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.038] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.038] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.038] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.039] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.039] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.039] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.039] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045\\temporaryfile")) returned 1 [0255.039] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.039] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.039] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045")) returned 1 [0255.039] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 0 [0255.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.040] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce248*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce248*, lpNumberOfBytesWritten=0x18fdd8*=0x5b30, lpOverlapped=0x0) returned 1 [0255.041] CloseHandle (hObject=0xdc) returned 1 [0255.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.042] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7d26 [0255.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7d2e) returned 0x2c8700 [0255.042] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7d26, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7d26, lpOverlapped=0x0) returned 1 [0255.044] CloseHandle (hObject=0xdc) returned 1 [0255.044] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 1 [0255.045] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.045] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.045] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.045] GetTickCount () returned 0x4f1cd [0255.045] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.045] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.045] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.045] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045\\....\\temporaryfile")) returned 0 [0255.046] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045\\temporaryfile")) returned 1 [0255.048] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.048] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.048] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.048] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.048] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.048] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.048] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.048] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045\\temporaryfile")) returned 1 [0255.048] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf61200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf61200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf61200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.048] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.048] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324045" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324045")) returned 1 [0255.048] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 0 [0255.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.050] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0440*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0440*, lpNumberOfBytesWritten=0x18fdd8*=0x7d30, lpOverlapped=0x0) returned 1 [0255.051] CloseHandle (hObject=0xdc) returned 1 [0255.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.052] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8a0c [0255.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8a14) returned 0x2c8700 [0255.052] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8a0c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8a0c, lpOverlapped=0x0) returned 1 [0255.054] CloseHandle (hObject=0xdc) returned 1 [0255.054] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 1 [0255.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.055] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.055] GetTickCount () returned 0x4f1dc [0255.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.056] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.056] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324060\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324060\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324060\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324060\\....\\temporaryfile")) returned 0 [0255.056] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324060\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324060\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324060\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324060\\temporaryfile")) returned 1 [0255.058] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324060\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf87360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf87360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf87360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.058] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf87360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf87360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf87360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.058] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf87360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf87360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf87360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.058] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324060\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf87360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf87360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf87360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.058] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf87360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf87360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf87360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.058] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf87360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf87360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf87360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.058] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.058] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324060\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324060\\temporaryfile")) returned 1 [0255.058] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cf87360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cf87360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cf87360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.058] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.058] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324060" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324060")) returned 1 [0255.058] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 0 [0255.059] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.060] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1128*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1128*, lpNumberOfBytesWritten=0x18fdd8*=0x8a10, lpOverlapped=0x0) returned 1 [0255.061] CloseHandle (hObject=0xdc) returned 1 [0255.061] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.061] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7d6e [0255.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7d76) returned 0x2c8700 [0255.062] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7d6e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7d6e, lpOverlapped=0x0) returned 1 [0255.063] CloseHandle (hObject=0xdc) returned 1 [0255.063] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 1 [0255.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.064] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.064] GetTickCount () returned 0x4f1ec [0255.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.065] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076\\....\\temporaryfile")) returned 0 [0255.065] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076\\temporaryfile")) returned 1 [0255.066] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.066] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.066] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.066] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.066] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.067] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.067] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.067] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076\\temporaryfile")) returned 1 [0255.067] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.067] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.067] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076")) returned 1 [0255.067] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 0 [0255.068] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.068] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0488*, nNumberOfBytesToWrite=0x7d78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0488*, lpNumberOfBytesWritten=0x18fdd8*=0x7d78, lpOverlapped=0x0) returned 1 [0255.069] CloseHandle (hObject=0xdc) returned 1 [0255.070] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.071] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x40e7 [0255.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40ef) returned 0x2c8700 [0255.071] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x40e7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x40e7, lpOverlapped=0x0) returned 1 [0255.072] CloseHandle (hObject=0xdc) returned 1 [0255.072] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 1 [0255.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.073] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.073] GetTickCount () returned 0x4f1ec [0255.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.074] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.074] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.074] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076\\....\\temporaryfile")) returned 0 [0255.075] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076\\temporaryfile")) returned 1 [0255.076] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.076] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.076] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.076] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.076] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.076] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.076] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.076] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076\\temporaryfile")) returned 1 [0255.076] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfad4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfad4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfad4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.076] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.077] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324076" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324076")) returned 1 [0255.077] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 0 [0255.077] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.078] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc800*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc800*, lpNumberOfBytesWritten=0x18fdd8*=0x40f0, lpOverlapped=0x0) returned 1 [0255.079] CloseHandle (hObject=0xdc) returned 1 [0255.079] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.080] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5f48 [0255.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5f50) returned 0x2c8700 [0255.080] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5f48, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5f48, lpOverlapped=0x0) returned 1 [0255.081] CloseHandle (hObject=0xdc) returned 1 [0255.081] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 1 [0255.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.082] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.082] GetTickCount () returned 0x4f1fc [0255.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.083] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092\\....\\temporaryfile")) returned 0 [0255.083] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092\\temporaryfile")) returned 1 [0255.085] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.085] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.085] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.085] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.085] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.085] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.085] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.085] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092\\temporaryfile")) returned 1 [0255.085] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.085] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.085] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092")) returned 1 [0255.086] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 0 [0255.086] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.087] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce660*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce660*, lpNumberOfBytesWritten=0x18fdd8*=0x5f50, lpOverlapped=0x0) returned 1 [0255.088] CloseHandle (hObject=0xdc) returned 1 [0255.088] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.088] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3b2e [0255.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3b36) returned 0x2c8700 [0255.088] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3b2e, lpOverlapped=0x0) returned 1 [0255.090] CloseHandle (hObject=0xdc) returned 1 [0255.090] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 1 [0255.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.091] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.091] GetTickCount () returned 0x4f1fc [0255.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.092] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092\\....\\temporaryfile")) returned 0 [0255.092] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092\\temporaryfile")) returned 1 [0255.094] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.094] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.094] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.094] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.094] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092\\temporaryfile")) returned 1 [0255.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cfd3620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cfd3620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cfd3620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.094] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324092" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324092")) returned 1 [0255.094] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 0 [0255.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.095] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc248*, nNumberOfBytesToWrite=0x3b38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc248*, lpNumberOfBytesWritten=0x18fdd8*=0x3b38, lpOverlapped=0x0) returned 1 [0255.096] CloseHandle (hObject=0xdc) returned 1 [0255.097] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.097] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e8e [0255.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e96) returned 0x2c8700 [0255.097] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1e8e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1e8e, lpOverlapped=0x0) returned 1 [0255.098] CloseHandle (hObject=0xdc) returned 1 [0255.098] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 1 [0255.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.099] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.099] GetTickCount () returned 0x4f20b [0255.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.100] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107\\....\\temporaryfile")) returned 0 [0255.100] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107\\temporaryfile")) returned 1 [0255.102] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.102] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.102] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.102] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.102] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.102] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.102] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.102] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107\\temporaryfile")) returned 1 [0255.102] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.102] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.102] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107")) returned 1 [0255.103] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 0 [0255.103] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.103] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca5a8*, nNumberOfBytesToWrite=0x1e98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca5a8*, lpNumberOfBytesWritten=0x18fdd8*=0x1e98, lpOverlapped=0x0) returned 1 [0255.104] CloseHandle (hObject=0xdc) returned 1 [0255.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.105] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3ed2 [0255.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3eda) returned 0x2c8700 [0255.105] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3ed2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3ed2, lpOverlapped=0x0) returned 1 [0255.106] CloseHandle (hObject=0xdc) returned 1 [0255.106] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 1 [0255.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.107] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.107] GetTickCount () returned 0x4f20b [0255.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.108] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107\\....\\temporaryfile")) returned 0 [0255.109] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107\\temporaryfile")) returned 1 [0255.110] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.110] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.110] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.110] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.110] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.110] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107\\temporaryfile")) returned 1 [0255.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9cff9780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9cff9780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9cff9780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.111] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.111] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324107" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324107")) returned 1 [0255.111] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 0 [0255.111] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.112] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc5f0*, nNumberOfBytesToWrite=0x3ed8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc5f0*, lpNumberOfBytesWritten=0x18fdd8*=0x3ed8, lpOverlapped=0x0) returned 1 [0255.113] CloseHandle (hObject=0xdc) returned 1 [0255.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.114] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x745c [0255.114] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7464) returned 0x2c8700 [0255.114] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x745c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x745c, lpOverlapped=0x0) returned 1 [0255.116] CloseHandle (hObject=0xdc) returned 1 [0255.116] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 1 [0255.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.117] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.117] GetTickCount () returned 0x4f21b [0255.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.118] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324123\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324123\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324123\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324123\\....\\temporaryfile")) returned 0 [0255.118] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324123\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324123\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324123\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324123\\temporaryfile")) returned 1 [0255.119] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324123\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d01f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d01f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d01f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.119] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d01f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d01f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d01f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.119] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d01f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d01f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d01f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.119] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324123\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d01f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d01f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d01f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.120] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d01f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d01f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d01f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.120] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d01f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d01f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d01f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.120] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.120] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324123\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324123\\temporaryfile")) returned 1 [0255.120] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d01f8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d01f8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d01f8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.120] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.120] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324123" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324123")) returned 1 [0255.120] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 0 [0255.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.121] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfb78*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfb78*, lpNumberOfBytesWritten=0x18fdd8*=0x7460, lpOverlapped=0x0) returned 1 [0255.123] CloseHandle (hObject=0xdc) returned 1 [0255.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.123] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6fd2 [0255.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6fda) returned 0x2c8700 [0255.123] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6fd2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6fd2, lpOverlapped=0x0) returned 1 [0255.125] CloseHandle (hObject=0xdc) returned 1 [0255.125] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 1 [0255.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.126] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.126] GetTickCount () returned 0x4f22a [0255.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.127] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138\\....\\temporaryfile")) returned 0 [0255.127] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138\\temporaryfile")) returned 1 [0255.131] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.132] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.132] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.132] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.132] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.132] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.132] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.132] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138\\temporaryfile")) returned 1 [0255.132] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.132] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.132] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138")) returned 1 [0255.132] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 0 [0255.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.133] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf6f0*, nNumberOfBytesToWrite=0x6fd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf6f0*, lpNumberOfBytesWritten=0x18fdd8*=0x6fd8, lpOverlapped=0x0) returned 1 [0255.135] CloseHandle (hObject=0xdc) returned 1 [0255.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.135] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5f6e [0255.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5f76) returned 0x2c8700 [0255.135] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5f6e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5f6e, lpOverlapped=0x0) returned 1 [0255.137] CloseHandle (hObject=0xdc) returned 1 [0255.137] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 1 [0255.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.138] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.138] GetTickCount () returned 0x4f22a [0255.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.138] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138\\....\\temporaryfile")) returned 0 [0255.139] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138\\temporaryfile")) returned 1 [0255.140] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.140] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.140] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.140] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.141] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.141] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.141] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.141] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138\\temporaryfile")) returned 1 [0255.141] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d045a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d045a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d045a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.141] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.141] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324138" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324138")) returned 1 [0255.141] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 0 [0255.142] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.143] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce688*, nNumberOfBytesToWrite=0x5f78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce688*, lpNumberOfBytesWritten=0x18fdd8*=0x5f78, lpOverlapped=0x0) returned 1 [0255.144] CloseHandle (hObject=0xdc) returned 1 [0255.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.145] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4b4a [0255.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4b52) returned 0x2c8700 [0255.145] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4b4a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4b4a, lpOverlapped=0x0) returned 1 [0255.147] CloseHandle (hObject=0xdc) returned 1 [0255.147] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 1 [0255.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.148] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.148] GetTickCount () returned 0x4f23a [0255.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.149] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324154\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324154\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324154\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324154\\....\\temporaryfile")) returned 0 [0255.149] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324154\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324154\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324154\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324154\\temporaryfile")) returned 1 [0255.150] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324154\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d06bba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d06bba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d06bba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.151] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d06bba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d06bba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d06bba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.151] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d06bba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d06bba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d06bba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.151] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324154\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d06bba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d06bba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d06bba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.151] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d06bba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d06bba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d06bba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.151] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d06bba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d06bba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d06bba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.151] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.151] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324154\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324154\\temporaryfile")) returned 1 [0255.151] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d06bba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d06bba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d06bba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.151] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.151] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324154" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324154")) returned 1 [0255.151] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 0 [0255.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.152] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd268*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd268*, lpNumberOfBytesWritten=0x18fdd8*=0x4b50, lpOverlapped=0x0) returned 1 [0255.153] CloseHandle (hObject=0xdc) returned 1 [0255.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.154] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c88 [0255.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c90) returned 0x2c8700 [0255.154] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1c88, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1c88, lpOverlapped=0x0) returned 1 [0255.155] CloseHandle (hObject=0xdc) returned 1 [0255.155] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 1 [0255.156] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.156] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.156] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.156] GetTickCount () returned 0x4f24a [0255.156] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.156] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.157] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.157] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170\\....\\temporaryfile")) returned 0 [0255.157] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170\\temporaryfile")) returned 1 [0255.159] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.159] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.159] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.159] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.159] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.159] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.159] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.159] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170\\temporaryfile")) returned 1 [0255.159] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.159] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.159] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170")) returned 1 [0255.160] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 0 [0255.160] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.160] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca3a0*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca3a0*, lpNumberOfBytesWritten=0x18fdd8*=0x1c90, lpOverlapped=0x0) returned 1 [0255.161] CloseHandle (hObject=0xdc) returned 1 [0255.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.163] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4e46 [0255.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4e4e) returned 0x2c8700 [0255.163] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4e46, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4e46, lpOverlapped=0x0) returned 1 [0255.164] CloseHandle (hObject=0xdc) returned 1 [0255.164] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 1 [0255.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.165] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.165] GetTickCount () returned 0x4f24a [0255.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.166] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.166] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170\\....\\temporaryfile")) returned 0 [0255.167] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170\\temporaryfile")) returned 1 [0255.168] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.168] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.168] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.168] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.168] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.168] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.168] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.168] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170\\temporaryfile")) returned 1 [0255.169] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d091d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d091d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d091d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.169] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.169] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324170" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324170")) returned 1 [0255.169] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 0 [0255.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.170] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd560*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd560*, lpNumberOfBytesWritten=0x18fdd8*=0x4e50, lpOverlapped=0x0) returned 1 [0255.171] CloseHandle (hObject=0xdc) returned 1 [0255.171] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.172] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x69d8 [0255.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x69e0) returned 0x2c8700 [0255.172] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x69d8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x69d8, lpOverlapped=0x0) returned 1 [0255.173] CloseHandle (hObject=0xdc) returned 1 [0255.173] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 1 [0255.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.174] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.174] GetTickCount () returned 0x4f259 [0255.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.175] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185\\....\\temporaryfile")) returned 0 [0255.175] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185\\temporaryfile")) returned 1 [0255.177] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.177] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.177] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.177] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.177] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.177] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.177] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.177] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185\\temporaryfile")) returned 1 [0255.177] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.177] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.177] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185")) returned 1 [0255.177] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 0 [0255.178] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.179] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf0f0*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf0f0*, lpNumberOfBytesWritten=0x18fdd8*=0x69e0, lpOverlapped=0x0) returned 1 [0255.180] CloseHandle (hObject=0xdc) returned 1 [0255.180] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.181] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x62e0 [0255.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x62e8) returned 0x2c8700 [0255.181] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x62e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x62e0, lpOverlapped=0x0) returned 1 [0255.182] CloseHandle (hObject=0xdc) returned 1 [0255.182] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 1 [0255.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.183] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.183] GetTickCount () returned 0x4f259 [0255.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.184] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.184] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.184] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185\\....\\temporaryfile")) returned 0 [0255.185] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185\\temporaryfile")) returned 1 [0255.186] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.186] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.186] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.186] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.186] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.186] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.186] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.186] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185\\temporaryfile")) returned 1 [0255.186] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0b7e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0b7e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0b7e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.186] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.187] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324185" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324185")) returned 1 [0255.187] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 0 [0255.187] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.188] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce9f8*, nNumberOfBytesToWrite=0x62e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce9f8*, lpNumberOfBytesWritten=0x18fdd8*=0x62e8, lpOverlapped=0x0) returned 1 [0255.189] CloseHandle (hObject=0xdc) returned 1 [0255.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.190] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe956 [0255.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe95e) returned 0x2c8700 [0255.190] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xe956, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xe956, lpOverlapped=0x0) returned 1 [0255.191] CloseHandle (hObject=0xdc) returned 1 [0255.191] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 1 [0255.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.193] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.193] GetTickCount () returned 0x4f269 [0255.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.193] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324201\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324201\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324201\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324201\\....\\temporaryfile")) returned 0 [0255.194] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324201\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324201\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324201\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324201\\temporaryfile")) returned 1 [0255.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324201\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0ddfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0ddfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0ddfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0ddfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0ddfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0ddfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0ddfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0ddfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0ddfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.195] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324201\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0ddfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0ddfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0ddfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.195] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0ddfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0ddfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0ddfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.195] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0ddfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0ddfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0ddfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.195] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.195] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324201\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324201\\temporaryfile")) returned 1 [0255.196] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d0ddfc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d0ddfc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d0ddfc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.196] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.196] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324201" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324201")) returned 1 [0255.196] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 0 [0255.197] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.197] WriteFile (in: hFile=0xdc, lpBuffer=0x2d7070*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d7070*, lpNumberOfBytesWritten=0x18fdd8*=0xe960, lpOverlapped=0x0) returned 1 [0255.199] CloseHandle (hObject=0xdc) returned 1 [0255.199] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.200] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x99a2 [0255.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x99aa) returned 0x2c8700 [0255.200] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x99a2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x99a2, lpOverlapped=0x0) returned 1 [0255.208] CloseHandle (hObject=0xdc) returned 1 [0255.208] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 1 [0255.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.210] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.210] GetTickCount () returned 0x4f278 [0255.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.210] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324216\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324216\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324216\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324216\\....\\temporaryfile")) returned 0 [0255.211] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324216\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324216\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324216\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324216\\temporaryfile")) returned 1 [0255.212] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324216\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d104120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d104120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d104120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.212] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d104120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d104120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d104120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.212] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d104120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d104120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d104120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.212] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324216\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d104120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d104120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d104120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.212] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d104120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d104120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d104120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.212] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d104120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d104120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d104120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.212] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.213] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324216\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324216\\temporaryfile")) returned 1 [0255.213] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d104120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d104120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d104120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.213] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.213] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324216" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324216")) returned 1 [0255.213] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 0 [0255.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.214] WriteFile (in: hFile=0xdc, lpBuffer=0x2d20c0*, nNumberOfBytesToWrite=0x99a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d20c0*, lpNumberOfBytesWritten=0x18fdd8*=0x99a8, lpOverlapped=0x0) returned 1 [0255.216] CloseHandle (hObject=0xdc) returned 1 [0255.216] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.216] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x50b6 [0255.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x50be) returned 0x2c8700 [0255.217] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x50b6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x50b6, lpOverlapped=0x0) returned 1 [0255.220] CloseHandle (hObject=0xdc) returned 1 [0255.220] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 1 [0255.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.221] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.221] GetTickCount () returned 0x4f288 [0255.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.222] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232\\....\\temporaryfile")) returned 0 [0255.222] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232\\temporaryfile")) returned 1 [0255.224] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.224] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.224] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.224] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.224] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.224] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.224] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.224] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232\\temporaryfile")) returned 1 [0255.224] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.224] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.225] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232")) returned 1 [0255.225] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 0 [0255.225] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.226] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd7d0*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd7d0*, lpNumberOfBytesWritten=0x18fdd8*=0x50c0, lpOverlapped=0x0) returned 1 [0255.227] CloseHandle (hObject=0xdc) returned 1 [0255.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.228] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x650c [0255.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6514) returned 0x2c8700 [0255.228] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x650c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x650c, lpOverlapped=0x0) returned 1 [0255.229] CloseHandle (hObject=0xdc) returned 1 [0255.229] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 1 [0255.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.230] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.230] GetTickCount () returned 0x4f288 [0255.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.231] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232\\....\\temporaryfile")) returned 0 [0255.232] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232\\temporaryfile")) returned 1 [0255.233] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.233] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.233] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.233] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.233] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.233] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.233] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.233] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232\\temporaryfile")) returned 1 [0255.234] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d12a280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d12a280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d12a280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.234] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.234] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324232" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324232")) returned 1 [0255.234] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 0 [0255.235] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.235] WriteFile (in: hFile=0xdc, lpBuffer=0x2cec28*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cec28*, lpNumberOfBytesWritten=0x18fdd8*=0x6510, lpOverlapped=0x0) returned 1 [0255.236] CloseHandle (hObject=0xdc) returned 1 [0255.236] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.237] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8420 [0255.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8428) returned 0x2c8700 [0255.237] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8420, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8420, lpOverlapped=0x0) returned 1 [0255.238] CloseHandle (hObject=0xdc) returned 1 [0255.238] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 1 [0255.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.239] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.239] GetTickCount () returned 0x4f298 [0255.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.240] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248\\....\\temporaryfile")) returned 0 [0255.240] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248\\temporaryfile")) returned 1 [0255.242] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.242] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.242] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.242] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.242] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.242] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.242] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.242] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248\\temporaryfile")) returned 1 [0255.242] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.242] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.242] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248")) returned 1 [0255.242] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 0 [0255.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.244] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0b38*, nNumberOfBytesToWrite=0x8428, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0b38*, lpNumberOfBytesWritten=0x18fdd8*=0x8428, lpOverlapped=0x0) returned 1 [0255.245] CloseHandle (hObject=0xdc) returned 1 [0255.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.246] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5eae [0255.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5eb6) returned 0x2c8700 [0255.246] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5eae, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5eae, lpOverlapped=0x0) returned 1 [0255.248] CloseHandle (hObject=0xdc) returned 1 [0255.248] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 1 [0255.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.249] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.249] GetTickCount () returned 0x4f298 [0255.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.249] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248\\....\\temporaryfile")) returned 0 [0255.250] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248\\temporaryfile")) returned 1 [0255.251] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d176540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d176540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.251] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d176540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d176540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.251] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.251] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.252] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.252] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.252] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.252] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248\\temporaryfile")) returned 1 [0255.252] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1503e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1503e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1503e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.252] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.252] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324248" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324248")) returned 1 [0255.252] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 0 [0255.253] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.253] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce5c8*, nNumberOfBytesToWrite=0x5eb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce5c8*, lpNumberOfBytesWritten=0x18fdd8*=0x5eb8, lpOverlapped=0x0) returned 1 [0255.254] CloseHandle (hObject=0xdc) returned 1 [0255.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.255] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x773a [0255.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7742) returned 0x2c8700 [0255.255] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x773a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x773a, lpOverlapped=0x0) returned 1 [0255.257] CloseHandle (hObject=0xdc) returned 1 [0255.257] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 1 [0255.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.258] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.258] GetTickCount () returned 0x4f2a7 [0255.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.258] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324263\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324263\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324263\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324263\\....\\temporaryfile")) returned 0 [0255.259] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324263\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324263\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324263\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324263\\temporaryfile")) returned 1 [0255.260] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324263\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d176540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d176540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d176540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.260] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d176540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d176540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d176540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.261] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d176540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d176540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d176540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.261] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324263\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d176540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d176540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d176540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.261] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d176540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d176540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d176540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.261] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d176540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d176540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d176540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.261] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.261] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324263\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324263\\temporaryfile")) returned 1 [0255.261] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d176540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d176540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d176540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.261] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.261] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324263" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324263")) returned 1 [0255.261] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 0 [0255.262] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.263] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfe58*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfe58*, lpNumberOfBytesWritten=0x18fdd8*=0x7740, lpOverlapped=0x0) returned 1 [0255.264] CloseHandle (hObject=0xdc) returned 1 [0255.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.265] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8b8e [0255.265] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8b96) returned 0x2c8700 [0255.265] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8b8e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8b8e, lpOverlapped=0x0) returned 1 [0255.266] CloseHandle (hObject=0xdc) returned 1 [0255.266] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 1 [0255.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.267] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.267] GetTickCount () returned 0x4f2b7 [0255.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.268] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279\\....\\temporaryfile")) returned 0 [0255.268] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279\\temporaryfile")) returned 1 [0255.269] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.270] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.270] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.270] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.270] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.270] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.270] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.270] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279\\temporaryfile")) returned 1 [0255.270] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.270] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.270] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279")) returned 1 [0255.270] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 0 [0255.271] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.275] WriteFile (in: hFile=0xdc, lpBuffer=0x2d12a8*, nNumberOfBytesToWrite=0x8b98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d12a8*, lpNumberOfBytesWritten=0x18fdd8*=0x8b98, lpOverlapped=0x0) returned 1 [0255.276] CloseHandle (hObject=0xdc) returned 1 [0255.277] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.277] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e74 [0255.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e7c) returned 0x2c8700 [0255.277] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1e74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1e74, lpOverlapped=0x0) returned 1 [0255.279] CloseHandle (hObject=0xdc) returned 1 [0255.279] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 1 [0255.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.280] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.280] GetTickCount () returned 0x4f2b7 [0255.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.280] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279\\....\\temporaryfile")) returned 0 [0255.281] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279\\temporaryfile")) returned 1 [0255.283] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.283] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.283] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279\\temporaryfile")) returned 1 [0255.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d19c6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d19c6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d19c6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.283] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324279" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324279")) returned 1 [0255.283] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 0 [0255.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.284] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca590*, nNumberOfBytesToWrite=0x1e78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca590*, lpNumberOfBytesWritten=0x18fdd8*=0x1e78, lpOverlapped=0x0) returned 1 [0255.285] CloseHandle (hObject=0xdc) returned 1 [0255.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.287] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2182 [0255.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x218a) returned 0x2c8700 [0255.287] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2182, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2182, lpOverlapped=0x0) returned 1 [0255.288] CloseHandle (hObject=0xdc) returned 1 [0255.288] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 1 [0255.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.289] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.289] GetTickCount () returned 0x4f2c6 [0255.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.290] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324294\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.290] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324294\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324294\\....\\temporaryfile")) returned 0 [0255.290] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324294\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324294\\temporaryfile")) returned 1 [0255.292] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324294\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1c2800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1c2800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1c2800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.292] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1c2800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1c2800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1c2800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.292] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1c2800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1c2800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1c2800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.292] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324294\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1c2800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1c2800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1c2800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.292] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1c2800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1c2800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1c2800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.292] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1c2800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1c2800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1c2800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.292] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.292] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324294\\temporaryfile")) returned 1 [0255.292] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1c2800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1c2800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1c2800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.292] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.292] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324294" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324294")) returned 1 [0255.293] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 0 [0255.293] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.294] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca8a0*, nNumberOfBytesToWrite=0x2188, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca8a0*, lpNumberOfBytesWritten=0x18fdd8*=0x2188, lpOverlapped=0x0) returned 1 [0255.295] CloseHandle (hObject=0xdc) returned 1 [0255.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.296] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x37e4 [0255.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x37ec) returned 0x2c8700 [0255.296] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x37e4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x37e4, lpOverlapped=0x0) returned 1 [0255.297] CloseHandle (hObject=0xdc) returned 1 [0255.298] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 1 [0255.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.299] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.299] GetTickCount () returned 0x4f2d6 [0255.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.299] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310\\....\\temporaryfile")) returned 0 [0255.300] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310\\temporaryfile")) returned 1 [0255.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.301] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310\\temporaryfile")) returned 1 [0255.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.302] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.302] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310")) returned 1 [0255.302] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 0 [0255.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.303] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbf00*, nNumberOfBytesToWrite=0x37e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbf00*, lpNumberOfBytesWritten=0x18fdd8*=0x37e8, lpOverlapped=0x0) returned 1 [0255.304] CloseHandle (hObject=0xdc) returned 1 [0255.304] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.305] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x21da [0255.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x21e2) returned 0x2c8700 [0255.305] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x21da, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x21da, lpOverlapped=0x0) returned 1 [0255.306] CloseHandle (hObject=0xdc) returned 1 [0255.306] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 1 [0255.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.307] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.307] GetTickCount () returned 0x4f2d6 [0255.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.308] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310\\....\\temporaryfile")) returned 0 [0255.308] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310\\temporaryfile")) returned 1 [0255.309] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.310] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.310] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.310] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.310] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.310] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.310] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.310] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310\\temporaryfile")) returned 1 [0255.310] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d1e8960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d1e8960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d1e8960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.310] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.310] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324310" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324310")) returned 1 [0255.310] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 0 [0255.311] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.311] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca8f8*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca8f8*, lpNumberOfBytesWritten=0x18fdd8*=0x21e0, lpOverlapped=0x0) returned 1 [0255.312] CloseHandle (hObject=0xdc) returned 1 [0255.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.313] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x843a [0255.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8442) returned 0x2c8700 [0255.313] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x843a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x843a, lpOverlapped=0x0) returned 1 [0255.314] CloseHandle (hObject=0xdc) returned 1 [0255.314] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 1 [0255.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.315] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.315] GetTickCount () returned 0x4f2e6 [0255.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.316] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.316] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326\\....\\temporaryfile")) returned 0 [0255.316] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326\\temporaryfile")) returned 1 [0255.318] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.318] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.318] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.318] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.318] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.318] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326\\temporaryfile")) returned 1 [0255.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.318] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.318] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326")) returned 1 [0255.319] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 0 [0255.319] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.320] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0b58*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0b58*, lpNumberOfBytesWritten=0x18fdd8*=0x8440, lpOverlapped=0x0) returned 1 [0255.321] CloseHandle (hObject=0xdc) returned 1 [0255.321] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.322] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x44fe [0255.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4506) returned 0x2c8700 [0255.322] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x44fe, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x44fe, lpOverlapped=0x0) returned 1 [0255.323] CloseHandle (hObject=0xdc) returned 1 [0255.323] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 1 [0255.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.324] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.324] GetTickCount () returned 0x4f2e6 [0255.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.325] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326\\....\\temporaryfile")) returned 0 [0255.325] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326\\temporaryfile")) returned 1 [0255.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.327] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.327] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.327] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.327] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.327] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326\\temporaryfile")) returned 1 [0255.327] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d20eac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d20eac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d20eac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.327] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.327] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324326" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324326")) returned 1 [0255.328] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 0 [0255.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.329] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccc18*, nNumberOfBytesToWrite=0x4508, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccc18*, lpNumberOfBytesWritten=0x18fdd8*=0x4508, lpOverlapped=0x0) returned 1 [0255.330] CloseHandle (hObject=0xdc) returned 1 [0255.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.331] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4724 [0255.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x472c) returned 0x2c8700 [0255.331] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4724, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4724, lpOverlapped=0x0) returned 1 [0255.333] CloseHandle (hObject=0xdc) returned 1 [0255.333] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 1 [0255.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.334] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.334] GetTickCount () returned 0x4f2f5 [0255.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.334] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341\\....\\temporaryfile")) returned 0 [0255.335] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341\\temporaryfile")) returned 1 [0255.336] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.336] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.336] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.336] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.336] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.336] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.336] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341\\temporaryfile")) returned 1 [0255.337] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.337] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.337] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341")) returned 1 [0255.337] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 0 [0255.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.338] WriteFile (in: hFile=0xdc, lpBuffer=0x2cce40*, nNumberOfBytesToWrite=0x4728, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cce40*, lpNumberOfBytesWritten=0x18fdd8*=0x4728, lpOverlapped=0x0) returned 1 [0255.339] CloseHandle (hObject=0xdc) returned 1 [0255.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.340] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x19c4 [0255.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19cc) returned 0x2c4a70 [0255.340] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x19c4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x19c4, lpOverlapped=0x0) returned 1 [0255.342] CloseHandle (hObject=0xdc) returned 1 [0255.342] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 1 [0255.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.342] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.343] GetTickCount () returned 0x4f2f5 [0255.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.343] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341\\....\\temporaryfile")) returned 0 [0255.344] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341\\temporaryfile")) returned 1 [0255.345] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d25ad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d25ad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.345] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d25ad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d25ad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.345] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.345] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.345] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.345] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.346] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.346] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341\\temporaryfile")) returned 1 [0255.346] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d234c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d234c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d234c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.346] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.346] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324341" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324341")) returned 1 [0255.346] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 0 [0255.346] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.347] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x19c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x19c8, lpOverlapped=0x0) returned 1 [0255.348] CloseHandle (hObject=0xdc) returned 1 [0255.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.348] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1500 [0255.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1508) returned 0x29b460 [0255.348] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1500, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1500, lpOverlapped=0x0) returned 1 [0255.351] CloseHandle (hObject=0xdc) returned 1 [0255.351] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 1 [0255.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.352] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.352] GetTickCount () returned 0x4f305 [0255.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.353] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324357\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324357\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324357\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324357\\....\\temporaryfile")) returned 0 [0255.354] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324357\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324357\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324357\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324357\\temporaryfile")) returned 1 [0255.355] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324357\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d25ad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d25ad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d25ad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.355] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d25ad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d25ad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d25ad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.355] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d25ad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d25ad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d25ad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.355] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324357\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d25ad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d25ad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d25ad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.355] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d25ad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d25ad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d25ad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.355] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d25ad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d25ad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d25ad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.355] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.355] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324357\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324357\\temporaryfile")) returned 1 [0255.356] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d25ad80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d25ad80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d25ad80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.356] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.356] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324357" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324357")) returned 1 [0255.356] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 0 [0255.356] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.357] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1508, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1508, lpOverlapped=0x0) returned 1 [0255.358] CloseHandle (hObject=0xdc) returned 1 [0255.358] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.358] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2d7c [0255.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d84) returned 0x2c8700 [0255.358] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2d7c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2d7c, lpOverlapped=0x0) returned 1 [0255.360] CloseHandle (hObject=0xdc) returned 1 [0255.360] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 1 [0255.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.361] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.361] GetTickCount () returned 0x4f314 [0255.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.362] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372\\....\\temporaryfile")) returned 0 [0255.362] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372\\temporaryfile")) returned 1 [0255.363] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.364] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.364] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.364] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.364] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.364] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.364] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.364] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372\\temporaryfile")) returned 1 [0255.364] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.364] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.364] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372")) returned 1 [0255.364] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 0 [0255.365] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.365] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb498*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb498*, lpNumberOfBytesWritten=0x18fdd8*=0x2d80, lpOverlapped=0x0) returned 1 [0255.366] CloseHandle (hObject=0xdc) returned 1 [0255.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.368] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2870 [0255.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2878) returned 0x2c8700 [0255.368] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2870, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2870, lpOverlapped=0x0) returned 1 [0255.369] CloseHandle (hObject=0xdc) returned 1 [0255.369] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 1 [0255.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.370] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.370] GetTickCount () returned 0x4f314 [0255.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.371] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372\\....\\temporaryfile")) returned 0 [0255.372] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372\\temporaryfile")) returned 1 [0255.373] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.373] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.373] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.373] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.373] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.373] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.373] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.373] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372\\temporaryfile")) returned 1 [0255.374] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d280ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d280ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d280ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.374] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.374] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324372" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324372")) returned 1 [0255.374] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 0 [0255.374] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.375] WriteFile (in: hFile=0xdc, lpBuffer=0x2caf88*, nNumberOfBytesToWrite=0x2878, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caf88*, lpNumberOfBytesWritten=0x18fdd8*=0x2878, lpOverlapped=0x0) returned 1 [0255.376] CloseHandle (hObject=0xdc) returned 1 [0255.376] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.376] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d4c [0255.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d54) returned 0x2c8700 [0255.376] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1d4c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1d4c, lpOverlapped=0x0) returned 1 [0255.378] CloseHandle (hObject=0xdc) returned 1 [0255.378] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 1 [0255.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.379] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.379] GetTickCount () returned 0x4f324 [0255.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.379] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388\\....\\temporaryfile")) returned 0 [0255.380] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388\\temporaryfile")) returned 1 [0255.381] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.381] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.381] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.381] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.381] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.381] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.382] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.382] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388\\temporaryfile")) returned 1 [0255.382] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.382] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.382] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388")) returned 1 [0255.382] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 0 [0255.382] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.383] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca468*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca468*, lpNumberOfBytesWritten=0x18fdd8*=0x1d50, lpOverlapped=0x0) returned 1 [0255.384] CloseHandle (hObject=0xdc) returned 1 [0255.384] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.384] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3040 [0255.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3048) returned 0x2c8700 [0255.384] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3040, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3040, lpOverlapped=0x0) returned 1 [0255.386] CloseHandle (hObject=0xdc) returned 1 [0255.386] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 1 [0255.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.387] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.387] GetTickCount () returned 0x4f324 [0255.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.387] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388\\....\\temporaryfile")) returned 0 [0255.388] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388\\temporaryfile")) returned 1 [0255.389] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.389] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.390] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.390] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.390] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.390] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388\\temporaryfile")) returned 1 [0255.390] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2a7040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2a7040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2a7040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.390] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.390] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324388" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324388")) returned 1 [0255.390] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 0 [0255.391] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.391] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb758*, nNumberOfBytesToWrite=0x3048, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb758*, lpNumberOfBytesWritten=0x18fdd8*=0x3048, lpOverlapped=0x0) returned 1 [0255.392] CloseHandle (hObject=0xdc) returned 1 [0255.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.393] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2480 [0255.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2488) returned 0x2c8700 [0255.393] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2480, lpOverlapped=0x0) returned 1 [0255.395] CloseHandle (hObject=0xdc) returned 1 [0255.395] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 1 [0255.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.396] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.396] GetTickCount () returned 0x4f334 [0255.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.396] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404\\....\\temporaryfile")) returned 0 [0255.397] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404\\temporaryfile")) returned 1 [0255.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.398] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.398] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.398] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.398] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404\\temporaryfile")) returned 1 [0255.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.399] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404")) returned 1 [0255.399] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 0 [0255.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.400] WriteFile (in: hFile=0xdc, lpBuffer=0x2cab98*, nNumberOfBytesToWrite=0x2488, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cab98*, lpNumberOfBytesWritten=0x18fdd8*=0x2488, lpOverlapped=0x0) returned 1 [0255.401] CloseHandle (hObject=0xdc) returned 1 [0255.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.402] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3fe2 [0255.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3fea) returned 0x2c8700 [0255.402] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3fe2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3fe2, lpOverlapped=0x0) returned 1 [0255.403] CloseHandle (hObject=0xdc) returned 1 [0255.403] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 1 [0255.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.404] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.404] GetTickCount () returned 0x4f334 [0255.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.405] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404\\....\\temporaryfile")) returned 0 [0255.405] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404\\temporaryfile")) returned 1 [0255.410] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2f3300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2f3300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.410] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2f3300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2f3300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.410] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.410] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.410] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.410] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.410] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.410] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404\\temporaryfile")) returned 1 [0255.411] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2cd1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2cd1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2cd1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.411] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.411] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324404" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324404")) returned 1 [0255.411] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 0 [0255.411] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.412] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc700*, nNumberOfBytesToWrite=0x3fe8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc700*, lpNumberOfBytesWritten=0x18fdd8*=0x3fe8, lpOverlapped=0x0) returned 1 [0255.413] CloseHandle (hObject=0xdc) returned 1 [0255.413] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.414] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14fc [0255.414] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1504) returned 0x29b460 [0255.414] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x14fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x14fc, lpOverlapped=0x0) returned 1 [0255.416] CloseHandle (hObject=0xdc) returned 1 [0255.416] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 1 [0255.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.417] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.417] GetTickCount () returned 0x4f343 [0255.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.418] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324419\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324419\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324419\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324419\\....\\temporaryfile")) returned 0 [0255.419] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324419\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324419\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324419\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324419\\temporaryfile")) returned 1 [0255.420] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324419\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2f3300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2f3300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2f3300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.420] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2f3300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2f3300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2f3300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.420] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2f3300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2f3300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2f3300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.420] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324419\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2f3300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2f3300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2f3300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.420] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2f3300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2f3300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2f3300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.420] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2f3300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2f3300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2f3300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.420] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.420] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324419\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324419\\temporaryfile")) returned 1 [0255.421] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d2f3300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d2f3300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d2f3300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.421] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.421] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324419" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324419")) returned 1 [0255.421] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 0 [0255.421] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.422] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1500, lpOverlapped=0x0) returned 1 [0255.423] CloseHandle (hObject=0xdc) returned 1 [0255.423] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.423] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1bcc [0255.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1bd4) returned 0x2c4a70 [0255.423] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1bcc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1bcc, lpOverlapped=0x0) returned 1 [0255.425] CloseHandle (hObject=0xdc) returned 1 [0255.425] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 1 [0255.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.426] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.426] GetTickCount () returned 0x4f353 [0255.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.427] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435\\....\\temporaryfile")) returned 0 [0255.427] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435\\temporaryfile")) returned 1 [0255.428] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.429] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.429] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.429] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.429] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.429] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.429] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435\\temporaryfile")) returned 1 [0255.429] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.429] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435")) returned 1 [0255.429] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 0 [0255.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.430] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1bd0, lpOverlapped=0x0) returned 1 [0255.431] CloseHandle (hObject=0xdc) returned 1 [0255.431] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.432] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d94 [0255.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d9c) returned 0x2c8700 [0255.433] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1d94, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1d94, lpOverlapped=0x0) returned 1 [0255.434] CloseHandle (hObject=0xdc) returned 1 [0255.434] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 1 [0255.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.435] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.435] GetTickCount () returned 0x4f353 [0255.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.435] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435\\....\\temporaryfile")) returned 0 [0255.436] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435\\temporaryfile")) returned 1 [0255.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.437] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.438] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.438] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.438] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.438] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.438] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435\\temporaryfile")) returned 1 [0255.438] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d319460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d319460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d319460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.438] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324435" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324435")) returned 1 [0255.438] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 0 [0255.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.439] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca4b0*, nNumberOfBytesToWrite=0x1d98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca4b0*, lpNumberOfBytesWritten=0x18fdd8*=0x1d98, lpOverlapped=0x0) returned 1 [0255.440] CloseHandle (hObject=0xdc) returned 1 [0255.440] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.441] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x221c [0255.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2224) returned 0x2c8700 [0255.441] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x221c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x221c, lpOverlapped=0x0) returned 1 [0255.442] CloseHandle (hObject=0xdc) returned 1 [0255.442] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 1 [0255.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.443] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.443] GetTickCount () returned 0x4f362 [0255.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.444] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.444] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450\\....\\temporaryfile")) returned 0 [0255.444] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450\\temporaryfile")) returned 1 [0255.445] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.446] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.446] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.446] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.446] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.446] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.446] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.446] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450\\temporaryfile")) returned 1 [0255.446] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.446] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.446] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450")) returned 1 [0255.446] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 0 [0255.447] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.447] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca938*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca938*, lpNumberOfBytesWritten=0x18fdd8*=0x2220, lpOverlapped=0x0) returned 1 [0255.448] CloseHandle (hObject=0xdc) returned 1 [0255.448] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.449] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaac [0255.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xab4) returned 0x2350048 [0255.449] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xaac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xaac, lpOverlapped=0x0) returned 1 [0255.450] CloseHandle (hObject=0xdc) returned 1 [0255.450] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 1 [0255.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.451] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.451] GetTickCount () returned 0x4f362 [0255.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.452] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450\\....\\temporaryfile")) returned 0 [0255.453] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450\\temporaryfile")) returned 1 [0255.454] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.454] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.454] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.454] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.454] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.454] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.454] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.454] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450\\temporaryfile")) returned 1 [0255.455] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d33f5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d33f5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d33f5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.455] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.455] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324450" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324450")) returned 1 [0255.455] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 0 [0255.455] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.456] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xab0, lpOverlapped=0x0) returned 1 [0255.456] CloseHandle (hObject=0xdc) returned 1 [0255.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.458] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2394 [0255.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x239c) returned 0x2c8700 [0255.458] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2394, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2394, lpOverlapped=0x0) returned 1 [0255.459] CloseHandle (hObject=0xdc) returned 1 [0255.459] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 1 [0255.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.460] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.460] GetTickCount () returned 0x4f372 [0255.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.461] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324466\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324466\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324466\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324466\\....\\temporaryfile")) returned 0 [0255.461] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324466\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324466\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324466\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324466\\temporaryfile")) returned 1 [0255.463] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324466\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d365720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d365720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d365720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d365720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d365720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d365720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d365720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d365720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d365720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.463] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324466\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d365720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d365720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d365720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.463] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d365720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d365720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d365720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.463] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d365720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d365720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d365720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.463] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.463] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324466\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324466\\temporaryfile")) returned 1 [0255.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d365720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d365720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d365720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.463] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.463] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324466" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324466")) returned 1 [0255.464] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 0 [0255.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.464] WriteFile (in: hFile=0xdc, lpBuffer=0x2caab0*, nNumberOfBytesToWrite=0x2398, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caab0*, lpNumberOfBytesWritten=0x18fdd8*=0x2398, lpOverlapped=0x0) returned 1 [0255.466] CloseHandle (hObject=0xdc) returned 1 [0255.466] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.467] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a44 [0255.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a4c) returned 0x2c8700 [0255.467] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2a44, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2a44, lpOverlapped=0x0) returned 1 [0255.468] CloseHandle (hObject=0xdc) returned 1 [0255.468] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 1 [0255.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.469] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.469] GetTickCount () returned 0x4f382 [0255.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.470] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.470] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482\\....\\temporaryfile")) returned 0 [0255.470] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482\\temporaryfile")) returned 1 [0255.471] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.471] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.471] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.472] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.472] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.472] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.472] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.472] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482\\temporaryfile")) returned 1 [0255.472] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.472] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.472] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482")) returned 1 [0255.472] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 0 [0255.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.473] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb160*, nNumberOfBytesToWrite=0x2a48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb160*, lpNumberOfBytesWritten=0x18fdd8*=0x2a48, lpOverlapped=0x0) returned 1 [0255.474] CloseHandle (hObject=0xdc) returned 1 [0255.474] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.475] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1258 [0255.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1260) returned 0x25b528 [0255.475] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1258, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1258, lpOverlapped=0x0) returned 1 [0255.476] CloseHandle (hObject=0xdc) returned 1 [0255.476] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 1 [0255.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.477] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.477] GetTickCount () returned 0x4f382 [0255.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.478] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.478] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482\\....\\temporaryfile")) returned 0 [0255.478] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482\\temporaryfile")) returned 1 [0255.480] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.480] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.480] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.480] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482\\temporaryfile")) returned 1 [0255.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d38b880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d38b880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d38b880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.480] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.480] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324482" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324482")) returned 1 [0255.480] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 0 [0255.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.481] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1260, lpOverlapped=0x0) returned 1 [0255.482] CloseHandle (hObject=0xdc) returned 1 [0255.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.484] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x834 [0255.484] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x83c) returned 0x2350048 [0255.484] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x834, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x834, lpOverlapped=0x0) returned 1 [0255.485] CloseHandle (hObject=0xdc) returned 1 [0255.485] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 1 [0255.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.486] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.486] GetTickCount () returned 0x4f391 [0255.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.487] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497\\....\\temporaryfile")) returned 0 [0255.487] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497\\temporaryfile")) returned 1 [0255.488] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.488] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.488] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.488] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.489] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.489] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.489] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497\\temporaryfile")) returned 1 [0255.489] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.489] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497")) returned 1 [0255.489] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 0 [0255.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.490] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x838, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x838, lpOverlapped=0x0) returned 1 [0255.491] CloseHandle (hObject=0xdc) returned 1 [0255.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.492] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15f4 [0255.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15fc) returned 0x2c4a70 [0255.492] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x15f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x15f4, lpOverlapped=0x0) returned 1 [0255.493] CloseHandle (hObject=0xdc) returned 1 [0255.493] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 1 [0255.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.494] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.494] GetTickCount () returned 0x4f391 [0255.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.495] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497\\....\\temporaryfile")) returned 0 [0255.495] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497\\temporaryfile")) returned 1 [0255.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.497] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497\\temporaryfile")) returned 1 [0255.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3b19e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3b19e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3b19e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.497] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324497" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324497")) returned 1 [0255.497] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 0 [0255.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.498] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x15f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x15f8, lpOverlapped=0x0) returned 1 [0255.499] CloseHandle (hObject=0xdc) returned 1 [0255.500] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.500] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd90 [0255.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd98) returned 0x2350048 [0255.500] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd90, lpOverlapped=0x0) returned 1 [0255.501] CloseHandle (hObject=0xdc) returned 1 [0255.502] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 1 [0255.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.502] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.502] GetTickCount () returned 0x4f3a1 [0255.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.502] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.503] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.503] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513\\....\\temporaryfile")) returned 0 [0255.503] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513\\temporaryfile")) returned 1 [0255.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.505] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.505] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.505] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.505] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.505] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.505] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513\\temporaryfile")) returned 1 [0255.505] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.505] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.505] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513")) returned 1 [0255.506] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 0 [0255.506] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.506] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xd98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xd98, lpOverlapped=0x0) returned 1 [0255.507] CloseHandle (hObject=0xdc) returned 1 [0255.507] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.509] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1388 [0255.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1390) returned 0x25b528 [0255.509] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1388, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1388, lpOverlapped=0x0) returned 1 [0255.510] CloseHandle (hObject=0xdc) returned 1 [0255.510] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 1 [0255.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.511] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.511] GetTickCount () returned 0x4f3a1 [0255.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.511] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513\\....\\temporaryfile")) returned 0 [0255.512] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513\\temporaryfile")) returned 1 [0255.513] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.513] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.513] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.513] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.514] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.514] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.514] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513\\temporaryfile")) returned 1 [0255.514] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3d7b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3d7b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3d7b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.514] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324513" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324513")) returned 1 [0255.514] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 0 [0255.514] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.515] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1390, lpOverlapped=0x0) returned 1 [0255.516] CloseHandle (hObject=0xdc) returned 1 [0255.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.517] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x29dc [0255.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x29e4) returned 0x2c8700 [0255.517] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x29dc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x29dc, lpOverlapped=0x0) returned 1 [0255.518] CloseHandle (hObject=0xdc) returned 1 [0255.519] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 1 [0255.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.519] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.520] GetTickCount () returned 0x4f3b0 [0255.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.520] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528\\....\\temporaryfile")) returned 0 [0255.521] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528\\temporaryfile")) returned 1 [0255.522] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.522] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.522] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.522] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.522] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.522] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.522] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.522] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528\\temporaryfile")) returned 1 [0255.523] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.523] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.523] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528")) returned 1 [0255.523] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 0 [0255.523] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.524] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb0f8*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb0f8*, lpNumberOfBytesWritten=0x18fdd8*=0x29e0, lpOverlapped=0x0) returned 1 [0255.525] CloseHandle (hObject=0xdc) returned 1 [0255.525] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.525] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3004 [0255.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x300c) returned 0x2c8700 [0255.525] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3004, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3004, lpOverlapped=0x0) returned 1 [0255.527] CloseHandle (hObject=0xdc) returned 1 [0255.527] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 1 [0255.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.528] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.528] GetTickCount () returned 0x4f3b0 [0255.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.528] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528\\....\\temporaryfile")) returned 0 [0255.529] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528\\temporaryfile")) returned 1 [0255.530] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.530] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.530] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.530] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.530] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.531] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.531] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.531] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528\\temporaryfile")) returned 1 [0255.531] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d3fdca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d3fdca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d3fdca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.531] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.531] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324528" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324528")) returned 1 [0255.531] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 0 [0255.532] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.532] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb720*, nNumberOfBytesToWrite=0x3008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb720*, lpNumberOfBytesWritten=0x18fdd8*=0x3008, lpOverlapped=0x0) returned 1 [0255.533] CloseHandle (hObject=0xdc) returned 1 [0255.533] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.534] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16c0 [0255.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16c8) returned 0x2c4a70 [0255.534] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16c0, lpOverlapped=0x0) returned 1 [0255.535] CloseHandle (hObject=0xdc) returned 1 [0255.535] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 1 [0255.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.536] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.536] GetTickCount () returned 0x4f3c0 [0255.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.540] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324544\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324544\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324544\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324544\\....\\temporaryfile")) returned 0 [0255.541] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324544\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324544\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324544\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324544\\temporaryfile")) returned 1 [0255.542] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324544\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d423e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d423e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d423e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.542] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d423e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d423e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d423e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.542] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d423e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d423e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d423e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.542] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324544\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d423e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d423e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d423e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.542] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d423e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d423e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d423e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.542] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d423e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d423e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d423e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.542] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.542] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324544\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324544\\temporaryfile")) returned 1 [0255.542] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d423e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d423e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d423e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.542] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.543] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324544" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324544")) returned 1 [0255.543] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 0 [0255.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.544] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x16c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x16c8, lpOverlapped=0x0) returned 1 [0255.545] CloseHandle (hObject=0xdc) returned 1 [0255.545] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.545] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3b5c [0255.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3b64) returned 0x2c8700 [0255.545] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3b5c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3b5c, lpOverlapped=0x0) returned 1 [0255.547] CloseHandle (hObject=0xdc) returned 1 [0255.547] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 1 [0255.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.548] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.548] GetTickCount () returned 0x4f3d0 [0255.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.548] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560\\....\\temporaryfile")) returned 0 [0255.549] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560\\temporaryfile")) returned 1 [0255.550] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.550] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.550] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.550] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.550] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.550] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.550] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.550] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560\\temporaryfile")) returned 1 [0255.551] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.551] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.551] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560")) returned 1 [0255.551] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 0 [0255.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.552] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc278*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc278*, lpNumberOfBytesWritten=0x18fdd8*=0x3b60, lpOverlapped=0x0) returned 1 [0255.553] CloseHandle (hObject=0xdc) returned 1 [0255.553] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.554] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3e9e [0255.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ea6) returned 0x2c8700 [0255.554] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3e9e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3e9e, lpOverlapped=0x0) returned 1 [0255.555] CloseHandle (hObject=0xdc) returned 1 [0255.555] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf")) returned 1 [0255.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.556] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.556] GetTickCount () returned 0x4f3d0 [0255.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.557] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.557] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560\\....\\temporaryfile")) returned 0 [0255.558] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560\\temporaryfile")) returned 1 [0255.559] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.559] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.559] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.559] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.559] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.559] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.559] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.559] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560\\temporaryfile")) returned 1 [0255.560] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d449f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d449f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d449f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.560] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.560] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324560" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324560")) returned 1 [0255.560] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 0 [0255.560] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.561] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc5b8*, nNumberOfBytesToWrite=0x3ea8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc5b8*, lpNumberOfBytesWritten=0x18fdd8*=0x3ea8, lpOverlapped=0x0) returned 1 [0255.562] CloseHandle (hObject=0xdc) returned 1 [0255.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.563] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x73a2 [0255.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x73aa) returned 0x2c8700 [0255.563] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x73a2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x73a2, lpOverlapped=0x0) returned 1 [0255.565] CloseHandle (hObject=0xdc) returned 1 [0255.565] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 1 [0255.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.566] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.566] GetTickCount () returned 0x4f3df [0255.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.566] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575\\....\\temporaryfile")) returned 0 [0255.567] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575\\temporaryfile")) returned 1 [0255.568] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.568] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.568] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.568] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.568] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.568] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.568] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.569] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575\\temporaryfile")) returned 1 [0255.569] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.569] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.569] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575")) returned 1 [0255.569] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 0 [0255.570] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.570] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfac0*, nNumberOfBytesToWrite=0x73a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfac0*, lpNumberOfBytesWritten=0x18fdd8*=0x73a8, lpOverlapped=0x0) returned 1 [0255.571] CloseHandle (hObject=0xdc) returned 1 [0255.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.572] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x336a [0255.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3372) returned 0x2c8700 [0255.572] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x336a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x336a, lpOverlapped=0x0) returned 1 [0255.573] CloseHandle (hObject=0xdc) returned 1 [0255.573] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 1 [0255.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.574] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.574] GetTickCount () returned 0x4f3df [0255.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.575] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575\\....\\temporaryfile")) returned 0 [0255.576] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575\\temporaryfile")) returned 1 [0255.577] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.577] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.577] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.577] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.577] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.577] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.577] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.577] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575\\temporaryfile")) returned 1 [0255.578] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d4700c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d4700c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d4700c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.578] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324575" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324575")) returned 1 [0255.578] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 0 [0255.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.579] WriteFile (in: hFile=0xdc, lpBuffer=0x2cba88*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cba88*, lpNumberOfBytesWritten=0x18fdd8*=0x3370, lpOverlapped=0x0) returned 1 [0255.580] CloseHandle (hObject=0xdc) returned 1 [0255.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.581] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ca4 [0255.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1cac) returned 0x2c8700 [0255.581] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1ca4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1ca4, lpOverlapped=0x0) returned 1 [0255.582] CloseHandle (hObject=0xdc) returned 1 [0255.582] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 1 [0255.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.583] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.583] GetTickCount () returned 0x4f3ef [0255.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.583] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.583] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591\\....\\temporaryfile")) returned 0 [0255.584] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591\\temporaryfile")) returned 1 [0255.585] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.585] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.585] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.585] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.585] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.586] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.586] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.586] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591\\temporaryfile")) returned 1 [0255.586] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.586] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.586] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591")) returned 1 [0255.586] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 0 [0255.586] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.587] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca3c0*, nNumberOfBytesToWrite=0x1ca8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca3c0*, lpNumberOfBytesWritten=0x18fdd8*=0x1ca8, lpOverlapped=0x0) returned 1 [0255.588] CloseHandle (hObject=0xdc) returned 1 [0255.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.588] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x11b6 [0255.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11be) returned 0x25b528 [0255.589] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11b6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x11b6, lpOverlapped=0x0) returned 1 [0255.590] CloseHandle (hObject=0xdc) returned 1 [0255.590] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 1 [0255.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.591] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.591] GetTickCount () returned 0x4f3ef [0255.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.592] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.592] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591\\....\\temporaryfile")) returned 0 [0255.592] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591\\temporaryfile")) returned 1 [0255.672] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.672] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.672] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.672] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.672] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.672] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.672] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.673] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591\\temporaryfile")) returned 1 [0255.673] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d496220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d496220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d496220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.673] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.673] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324591" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324591")) returned 1 [0255.673] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 0 [0255.673] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.674] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x11c0, lpOverlapped=0x0) returned 1 [0255.675] CloseHandle (hObject=0xdc) returned 1 [0255.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.676] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x207a [0255.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2082) returned 0x2c8700 [0255.676] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x207a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x207a, lpOverlapped=0x0) returned 1 [0255.678] CloseHandle (hObject=0xdc) returned 1 [0255.678] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf")) returned 1 [0255.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.679] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.679] GetTickCount () returned 0x4f44c [0255.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.679] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.679] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324684\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324684\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.680] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324684\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324684\\....\\temporaryfile")) returned 0 [0255.680] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324684\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324684\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324684\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324684\\temporaryfile")) returned 1 [0255.682] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324684\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d57aa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d57aa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d57aa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.682] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d57aa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d57aa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d57aa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.682] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d57aa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d57aa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d57aa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.682] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324684\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d57aa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d57aa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d57aa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.682] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d57aa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d57aa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d57aa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.682] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d57aa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d57aa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d57aa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.682] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.682] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324684\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324684\\temporaryfile")) returned 1 [0255.682] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d57aa60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d57aa60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d57aa60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.682] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.682] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324684" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324684")) returned 1 [0255.682] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 0 [0255.683] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.683] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca798*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca798*, lpNumberOfBytesWritten=0x18fdd8*=0x2080, lpOverlapped=0x0) returned 1 [0255.684] CloseHandle (hObject=0xdc) returned 1 [0255.685] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.686] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x72f8 [0255.686] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7300) returned 0x2c8700 [0255.686] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x72f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x72f8, lpOverlapped=0x0) returned 1 [0255.687] CloseHandle (hObject=0xdc) returned 1 [0255.687] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 1 [0255.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.688] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.688] GetTickCount () returned 0x4f45c [0255.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.689] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.689] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.690] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700\\....\\temporaryfile")) returned 0 [0255.690] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700\\temporaryfile")) returned 1 [0255.691] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.692] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.692] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.692] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.692] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.692] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.692] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.692] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700\\temporaryfile")) returned 1 [0255.692] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.692] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.692] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700")) returned 1 [0255.692] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 0 [0255.693] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.694] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfa10*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfa10*, lpNumberOfBytesWritten=0x18fdd8*=0x7300, lpOverlapped=0x0) returned 1 [0255.695] CloseHandle (hObject=0xdc) returned 1 [0255.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.695] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5350 [0255.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5358) returned 0x2c8700 [0255.696] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5350, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5350, lpOverlapped=0x0) returned 1 [0255.697] CloseHandle (hObject=0xdc) returned 1 [0255.697] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 1 [0255.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.698] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.698] GetTickCount () returned 0x4f45c [0255.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.699] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.699] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.699] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700\\....\\temporaryfile")) returned 0 [0255.699] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700\\temporaryfile")) returned 1 [0255.701] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.701] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.701] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.701] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.701] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.701] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.701] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.701] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700\\temporaryfile")) returned 1 [0255.701] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5a0bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5a0bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5a0bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.702] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.702] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324700" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324700")) returned 1 [0255.702] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 0 [0255.702] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.703] WriteFile (in: hFile=0xdc, lpBuffer=0x2cda68*, nNumberOfBytesToWrite=0x5358, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cda68*, lpNumberOfBytesWritten=0x18fdd8*=0x5358, lpOverlapped=0x0) returned 1 [0255.704] CloseHandle (hObject=0xdc) returned 1 [0255.704] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.705] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x48be [0255.705] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x48c6) returned 0x2c8700 [0255.705] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x48be, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x48be, lpOverlapped=0x0) returned 1 [0255.706] CloseHandle (hObject=0xdc) returned 1 [0255.706] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 1 [0255.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.707] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.707] GetTickCount () returned 0x4f46c [0255.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.708] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324716\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324716\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.708] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324716\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324716\\....\\temporaryfile")) returned 0 [0255.708] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324716\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324716\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324716\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324716\\temporaryfile")) returned 1 [0255.710] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324716\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5c6d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5c6d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5c6d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.710] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5c6d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5c6d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5c6d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.710] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5c6d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5c6d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5c6d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.710] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324716\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5c6d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5c6d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5c6d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.710] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5c6d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5c6d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5c6d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.710] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5c6d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5c6d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5c6d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.710] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.710] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324716\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324716\\temporaryfile")) returned 1 [0255.710] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5c6d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5c6d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5c6d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.710] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.710] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324716" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324716")) returned 1 [0255.711] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 0 [0255.711] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.712] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccfd8*, nNumberOfBytesToWrite=0x48c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccfd8*, lpNumberOfBytesWritten=0x18fdd8*=0x48c8, lpOverlapped=0x0) returned 1 [0255.715] CloseHandle (hObject=0xdc) returned 1 [0255.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.716] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe60 [0255.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe68) returned 0x2350048 [0255.716] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe60, lpOverlapped=0x0) returned 1 [0255.717] CloseHandle (hObject=0xdc) returned 1 [0255.717] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf")) returned 1 [0255.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.718] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.718] GetTickCount () returned 0x4f47b [0255.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.719] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731\\....\\temporaryfile")) returned 0 [0255.719] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731\\temporaryfile")) returned 1 [0255.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.721] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.721] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.721] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.721] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.721] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.721] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.721] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731\\temporaryfile")) returned 1 [0255.721] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.721] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.721] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731")) returned 1 [0255.722] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 0 [0255.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.722] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe68, lpOverlapped=0x0) returned 1 [0255.723] CloseHandle (hObject=0xdc) returned 1 [0255.723] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.724] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbbc [0255.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbc4) returned 0x2350048 [0255.724] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xbbc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xbbc, lpOverlapped=0x0) returned 1 [0255.725] CloseHandle (hObject=0xdc) returned 1 [0255.725] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 1 [0255.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.726] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.726] GetTickCount () returned 0x4f47b [0255.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.727] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731\\....\\temporaryfile")) returned 0 [0255.727] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731\\temporaryfile")) returned 1 [0255.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.729] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.729] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.729] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.729] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.729] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731\\temporaryfile")) returned 1 [0255.729] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d5ece80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d5ece80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d5ece80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.729] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.729] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324731" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324731")) returned 1 [0255.729] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 0 [0255.730] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.730] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xbc0, lpOverlapped=0x0) returned 1 [0255.731] CloseHandle (hObject=0xdc) returned 1 [0255.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.732] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x128e [0255.732] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1296) returned 0x25b528 [0255.732] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x128e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x128e, lpOverlapped=0x0) returned 1 [0255.733] CloseHandle (hObject=0xdc) returned 1 [0255.733] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 1 [0255.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.734] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.734] GetTickCount () returned 0x4f48b [0255.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.735] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747\\....\\temporaryfile")) returned 0 [0255.736] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747\\temporaryfile")) returned 1 [0255.737] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.737] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.737] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.737] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.737] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747\\temporaryfile")) returned 1 [0255.737] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.737] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747")) returned 1 [0255.738] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 0 [0255.738] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.738] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1298, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1298, lpOverlapped=0x0) returned 1 [0255.739] CloseHandle (hObject=0xdc) returned 1 [0255.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.742] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14ce [0255.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14d6) returned 0x29b460 [0255.742] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x14ce, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x14ce, lpOverlapped=0x0) returned 1 [0255.743] CloseHandle (hObject=0xdc) returned 1 [0255.743] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 1 [0255.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.744] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.744] GetTickCount () returned 0x4f48b [0255.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.745] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747\\....\\temporaryfile")) returned 0 [0255.746] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747\\temporaryfile")) returned 1 [0255.747] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.747] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.747] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.747] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.747] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.747] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.747] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.747] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747\\temporaryfile")) returned 1 [0255.747] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d612fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d612fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d612fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.747] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.751] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324747" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324747")) returned 1 [0255.751] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 0 [0255.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.752] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x14d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x14d8, lpOverlapped=0x0) returned 1 [0255.753] CloseHandle (hObject=0xdc) returned 1 [0255.753] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.753] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xef2 [0255.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xefa) returned 0x2350048 [0255.754] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xef2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xef2, lpOverlapped=0x0) returned 1 [0255.755] CloseHandle (hObject=0xdc) returned 1 [0255.755] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf")) returned 1 [0255.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.756] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.756] GetTickCount () returned 0x4f49a [0255.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.756] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.756] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762\\....\\temporaryfile")) returned 0 [0255.757] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762\\temporaryfile")) returned 1 [0255.758] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.758] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.758] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.758] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.758] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.758] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.759] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.759] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762\\temporaryfile")) returned 1 [0255.759] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.759] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.759] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762")) returned 1 [0255.759] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 0 [0255.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.760] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xef8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xef8, lpOverlapped=0x0) returned 1 [0255.761] CloseHandle (hObject=0xdc) returned 1 [0255.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.762] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3586 [0255.762] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x358e) returned 0x2c8700 [0255.762] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3586, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3586, lpOverlapped=0x0) returned 1 [0255.763] CloseHandle (hObject=0xdc) returned 1 [0255.763] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf")) returned 1 [0255.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.764] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.764] GetTickCount () returned 0x4f49a [0255.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.765] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762\\....\\temporaryfile")) returned 0 [0255.765] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762\\temporaryfile")) returned 1 [0255.767] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d65f2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d65f2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.767] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d65f2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d65f2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.767] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.767] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.767] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.767] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.767] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.767] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762\\temporaryfile")) returned 1 [0255.767] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d639140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d639140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d639140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.767] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.767] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324762" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324762")) returned 1 [0255.768] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 0 [0255.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.769] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbca0*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbca0*, lpNumberOfBytesWritten=0x18fdd8*=0x3590, lpOverlapped=0x0) returned 1 [0255.770] CloseHandle (hObject=0xdc) returned 1 [0255.770] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.771] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b00 [0255.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b08) returned 0x2c4a70 [0255.771] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b00, lpOverlapped=0x0) returned 1 [0255.772] CloseHandle (hObject=0xdc) returned 1 [0255.772] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf")) returned 1 [0255.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.773] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.773] GetTickCount () returned 0x4f4aa [0255.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.773] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.774] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324778\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324778\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.775] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324778\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324778\\....\\temporaryfile")) returned 0 [0255.775] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324778\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324778\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324778\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324778\\temporaryfile")) returned 1 [0255.776] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324778\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d65f2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d65f2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d65f2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d65f2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d65f2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d65f2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d65f2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d65f2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d65f2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324778\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d65f2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d65f2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d65f2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.777] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d65f2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d65f2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d65f2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.777] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d65f2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d65f2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d65f2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.777] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324778\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324778\\temporaryfile")) returned 1 [0255.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d65f2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d65f2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d65f2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.777] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324778" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324778")) returned 1 [0255.777] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 0 [0255.778] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.778] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1b08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b08, lpOverlapped=0x0) returned 1 [0255.779] CloseHandle (hObject=0xdc) returned 1 [0255.779] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.780] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x164c [0255.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1654) returned 0x2c4a70 [0255.781] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x164c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x164c, lpOverlapped=0x0) returned 1 [0255.782] CloseHandle (hObject=0xdc) returned 1 [0255.782] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf")) returned 1 [0255.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.783] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.783] GetTickCount () returned 0x4f4ba [0255.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.783] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.784] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794\\....\\temporaryfile")) returned 0 [0255.784] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794\\temporaryfile")) returned 1 [0255.785] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.785] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.785] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.785] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.785] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.785] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.785] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.785] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794\\temporaryfile")) returned 1 [0255.786] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.786] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.786] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794")) returned 1 [0255.786] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 0 [0255.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.787] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1650, lpOverlapped=0x0) returned 1 [0255.788] CloseHandle (hObject=0xdc) returned 1 [0255.788] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.788] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9d26 [0255.788] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9d2e) returned 0x2c8700 [0255.788] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x9d26, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x9d26, lpOverlapped=0x0) returned 1 [0255.790] CloseHandle (hObject=0xdc) returned 1 [0255.790] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf")) returned 1 [0255.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.791] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.791] GetTickCount () returned 0x4f4ba [0255.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.791] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.792] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794\\....\\temporaryfile")) returned 0 [0255.792] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794\\temporaryfile")) returned 1 [0255.793] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.794] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.794] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.794] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.794] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.794] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.794] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.794] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794\\temporaryfile")) returned 1 [0255.794] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d685400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d685400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d685400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.794] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.794] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324794" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324794")) returned 1 [0255.794] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 0 [0255.795] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.796] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2440*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2440*, lpNumberOfBytesWritten=0x18fdd8*=0x9d30, lpOverlapped=0x0) returned 1 [0255.797] CloseHandle (hObject=0xdc) returned 1 [0255.798] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.799] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x668c [0255.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6694) returned 0x2c8700 [0255.799] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x668c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x668c, lpOverlapped=0x0) returned 1 [0255.800] CloseHandle (hObject=0xdc) returned 1 [0255.800] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf")) returned 1 [0255.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.801] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.801] GetTickCount () returned 0x4f4c9 [0255.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.802] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809\\....\\temporaryfile")) returned 0 [0255.802] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809\\temporaryfile")) returned 1 [0255.804] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.804] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.804] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.804] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.804] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.804] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.804] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809\\temporaryfile")) returned 1 [0255.804] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.804] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.805] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809")) returned 1 [0255.805] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 0 [0255.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.806] WriteFile (in: hFile=0xdc, lpBuffer=0x2ceda8*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ceda8*, lpNumberOfBytesWritten=0x18fdd8*=0x6690, lpOverlapped=0x0) returned 1 [0255.807] CloseHandle (hObject=0xdc) returned 1 [0255.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.808] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x849c [0255.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x84a4) returned 0x2c8700 [0255.808] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x849c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x849c, lpOverlapped=0x0) returned 1 [0255.809] CloseHandle (hObject=0xdc) returned 1 [0255.809] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf")) returned 1 [0255.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.810] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.810] GetTickCount () returned 0x4f4c9 [0255.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.811] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.811] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809\\....\\temporaryfile")) returned 0 [0255.812] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809\\temporaryfile")) returned 1 [0255.813] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6d16c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6d16c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.813] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6d16c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6d16c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.813] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.813] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.813] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.813] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.813] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.813] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809\\temporaryfile")) returned 1 [0255.814] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6ab560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6ab560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6ab560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.814] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.814] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324809" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324809")) returned 1 [0255.814] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 0 [0255.815] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.815] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0bb8*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0bb8*, lpNumberOfBytesWritten=0x18fdd8*=0x84a0, lpOverlapped=0x0) returned 1 [0255.817] CloseHandle (hObject=0xdc) returned 1 [0255.817] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.818] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5cae [0255.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5cb6) returned 0x2c8700 [0255.818] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5cae, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5cae, lpOverlapped=0x0) returned 1 [0255.819] CloseHandle (hObject=0xdc) returned 1 [0255.819] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf")) returned 1 [0255.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.820] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.820] GetTickCount () returned 0x4f4d9 [0255.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.821] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324825\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324825\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324825\\....\\temporaryfile")) returned 0 [0255.822] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324825\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324825\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324825\\temporaryfile")) returned 1 [0255.823] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324825\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6d16c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6d16c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6d16c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.823] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6d16c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6d16c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6d16c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.823] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6d16c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6d16c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6d16c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.823] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324825\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6d16c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6d16c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6d16c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6d16c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6d16c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6d16c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.823] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6d16c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6d16c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6d16c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.823] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.823] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324825\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324825\\temporaryfile")) returned 1 [0255.824] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6d16c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6d16c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6d16c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.824] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.824] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324825" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324825")) returned 1 [0255.824] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 0 [0255.824] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.825] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce3c8*, nNumberOfBytesToWrite=0x5cb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce3c8*, lpNumberOfBytesWritten=0x18fdd8*=0x5cb8, lpOverlapped=0x0) returned 1 [0255.826] CloseHandle (hObject=0xdc) returned 1 [0255.826] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.828] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8860 [0255.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8868) returned 0x2c8700 [0255.828] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8860, lpOverlapped=0x0) returned 1 [0255.829] CloseHandle (hObject=0xdc) returned 1 [0255.829] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf")) returned 1 [0255.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.830] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.830] GetTickCount () returned 0x4f4e8 [0255.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.831] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840\\....\\temporaryfile")) returned 0 [0255.832] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840\\temporaryfile")) returned 1 [0255.833] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.833] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.833] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.833] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.833] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.833] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840\\temporaryfile")) returned 1 [0255.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.834] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840")) returned 1 [0255.834] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 0 [0255.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.835] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0f78*, nNumberOfBytesToWrite=0x8868, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0f78*, lpNumberOfBytesWritten=0x18fdd8*=0x8868, lpOverlapped=0x0) returned 1 [0255.836] CloseHandle (hObject=0xdc) returned 1 [0255.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.838] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6624 [0255.838] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x662c) returned 0x2c8700 [0255.838] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6624, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6624, lpOverlapped=0x0) returned 1 [0255.839] CloseHandle (hObject=0xdc) returned 1 [0255.839] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf")) returned 1 [0255.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.840] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.840] GetTickCount () returned 0x4f4e8 [0255.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.841] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840\\....\\temporaryfile")) returned 0 [0255.842] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840\\temporaryfile")) returned 1 [0255.843] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.843] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.843] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.843] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.843] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.843] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.843] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.844] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840\\temporaryfile")) returned 1 [0255.844] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d6f7820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d6f7820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d6f7820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.844] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.844] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324840" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324840")) returned 1 [0255.844] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 0 [0255.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.845] WriteFile (in: hFile=0xdc, lpBuffer=0x2ced40*, nNumberOfBytesToWrite=0x6628, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ced40*, lpNumberOfBytesWritten=0x18fdd8*=0x6628, lpOverlapped=0x0) returned 1 [0255.846] CloseHandle (hObject=0xdc) returned 1 [0255.847] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.847] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3cce [0255.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3cd6) returned 0x2c8700 [0255.847] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3cce, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3cce, lpOverlapped=0x0) returned 1 [0255.849] CloseHandle (hObject=0xdc) returned 1 [0255.849] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf")) returned 1 [0255.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.850] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.850] GetTickCount () returned 0x4f4f8 [0255.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.850] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324856\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324856\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.851] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324856\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324856\\....\\temporaryfile")) returned 0 [0255.851] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324856\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324856\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324856\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324856\\temporaryfile")) returned 1 [0255.852] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324856\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d71d980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d71d980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d71d980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.852] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d71d980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d71d980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d71d980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.852] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d71d980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d71d980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d71d980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.852] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324856\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d71d980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d71d980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d71d980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.852] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d71d980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d71d980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d71d980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.853] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d71d980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d71d980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d71d980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.853] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.853] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324856\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324856\\temporaryfile")) returned 1 [0255.853] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d71d980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d71d980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d71d980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.853] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.853] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324856" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324856")) returned 1 [0255.853] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 0 [0255.854] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.854] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc3e8*, nNumberOfBytesToWrite=0x3cd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc3e8*, lpNumberOfBytesWritten=0x18fdd8*=0x3cd8, lpOverlapped=0x0) returned 1 [0255.855] CloseHandle (hObject=0xdc) returned 1 [0255.856] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.856] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd6b4 [0255.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd6bc) returned 0x2c8700 [0255.856] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xd6b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xd6b4, lpOverlapped=0x0) returned 1 [0255.858] CloseHandle (hObject=0xdc) returned 1 [0255.858] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf")) returned 1 [0255.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.859] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.859] GetTickCount () returned 0x4f508 [0255.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.860] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872\\....\\temporaryfile")) returned 0 [0255.860] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872\\temporaryfile")) returned 1 [0255.862] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.862] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.862] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.862] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.862] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872\\temporaryfile")) returned 1 [0255.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.862] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872")) returned 1 [0255.862] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 0 [0255.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.864] WriteFile (in: hFile=0xdc, lpBuffer=0x2d5dd0*, nNumberOfBytesToWrite=0xd6b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d5dd0*, lpNumberOfBytesWritten=0x18fdd8*=0xd6b8, lpOverlapped=0x0) returned 1 [0255.866] CloseHandle (hObject=0xdc) returned 1 [0255.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.866] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa520 [0255.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa528) returned 0x2c8700 [0255.866] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa520, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa520, lpOverlapped=0x0) returned 1 [0255.868] CloseHandle (hObject=0xdc) returned 1 [0255.868] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf")) returned 1 [0255.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.869] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.869] GetTickCount () returned 0x4f508 [0255.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.870] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872\\....\\temporaryfile")) returned 0 [0255.872] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872\\temporaryfile")) returned 1 [0255.873] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.873] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.873] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.873] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.873] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.873] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.873] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.873] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872\\temporaryfile")) returned 1 [0255.874] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d743ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d743ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d743ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.874] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.874] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324872" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324872")) returned 1 [0255.874] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 0 [0255.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.875] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2c38*, nNumberOfBytesToWrite=0xa528, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2c38*, lpNumberOfBytesWritten=0x18fdd8*=0xa528, lpOverlapped=0x0) returned 1 [0255.877] CloseHandle (hObject=0xdc) returned 1 [0255.877] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.878] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa3b2 [0255.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa3ba) returned 0x2c8700 [0255.878] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa3b2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa3b2, lpOverlapped=0x0) returned 1 [0255.879] CloseHandle (hObject=0xdc) returned 1 [0255.879] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf")) returned 1 [0255.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.880] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.880] GetTickCount () returned 0x4f517 [0255.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.881] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324887\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324887\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324887\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324887\\....\\temporaryfile")) returned 0 [0255.881] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324887\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324887\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324887\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324887\\temporaryfile")) returned 1 [0255.886] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324887\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d769c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d769c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d769c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.886] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d769c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d769c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d769c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.886] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d769c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d769c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d769c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.886] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324887\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d769c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d769c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d769c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.886] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d769c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d769c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d769c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.886] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d769c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d769c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d769c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.886] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.887] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324887\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324887\\temporaryfile")) returned 1 [0255.887] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d769c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d769c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d769c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.887] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.887] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324887" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324887")) returned 1 [0255.887] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 0 [0255.888] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.888] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2ad0*, nNumberOfBytesToWrite=0xa3b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2ad0*, lpNumberOfBytesWritten=0x18fdd8*=0xa3b8, lpOverlapped=0x0) returned 1 [0255.890] CloseHandle (hObject=0xdc) returned 1 [0255.890] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.891] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa69e [0255.891] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa6a6) returned 0x2c8700 [0255.891] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa69e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa69e, lpOverlapped=0x0) returned 1 [0255.892] CloseHandle (hObject=0xdc) returned 1 [0255.892] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf")) returned 1 [0255.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.893] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.894] GetTickCount () returned 0x4f527 [0255.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.894] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.894] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903\\....\\temporaryfile")) returned 0 [0255.895] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903\\temporaryfile")) returned 1 [0255.896] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.896] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.896] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.896] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.896] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.896] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.896] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.896] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903\\temporaryfile")) returned 1 [0255.897] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.897] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.897] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903")) returned 1 [0255.897] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 0 [0255.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.898] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2db8*, nNumberOfBytesToWrite=0xa6a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2db8*, lpNumberOfBytesWritten=0x18fdd8*=0xa6a8, lpOverlapped=0x0) returned 1 [0255.900] CloseHandle (hObject=0xdc) returned 1 [0255.900] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.900] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6f9c [0255.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6fa4) returned 0x2c8700 [0255.900] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6f9c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6f9c, lpOverlapped=0x0) returned 1 [0255.902] CloseHandle (hObject=0xdc) returned 1 [0255.902] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf")) returned 1 [0255.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.903] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.903] GetTickCount () returned 0x4f527 [0255.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.903] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.904] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903\\....\\temporaryfile")) returned 0 [0255.904] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903\\temporaryfile")) returned 1 [0255.906] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.906] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.906] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.906] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.906] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.906] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.906] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903\\temporaryfile")) returned 1 [0255.907] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d78fda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d78fda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d78fda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.907] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.907] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324903" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324903")) returned 1 [0255.907] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 0 [0255.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.908] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf6b8*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf6b8*, lpNumberOfBytesWritten=0x18fdd8*=0x6fa0, lpOverlapped=0x0) returned 1 [0255.909] CloseHandle (hObject=0xdc) returned 1 [0255.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.911] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9d6c [0255.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9d74) returned 0x2c8700 [0255.911] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x9d6c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x9d6c, lpOverlapped=0x0) returned 1 [0255.913] CloseHandle (hObject=0xdc) returned 1 [0255.913] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf")) returned 1 [0255.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.914] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.914] GetTickCount () returned 0x4f536 [0255.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.915] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324918\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324918\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324918\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324918\\....\\temporaryfile")) returned 0 [0255.916] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324918\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324918\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324918\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324918\\temporaryfile")) returned 1 [0255.917] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324918\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7b5f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7b5f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7b5f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7b5f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7b5f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7b5f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7b5f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7b5f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7b5f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.917] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324918\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7b5f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7b5f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7b5f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.917] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7b5f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7b5f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7b5f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.917] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7b5f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7b5f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7b5f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.917] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.917] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324918\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324918\\temporaryfile")) returned 1 [0255.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7b5f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7b5f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7b5f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.918] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324918" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324918")) returned 1 [0255.918] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 0 [0255.919] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.919] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2488*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2488*, lpNumberOfBytesWritten=0x18fdd8*=0x9d70, lpOverlapped=0x0) returned 1 [0255.921] CloseHandle (hObject=0xdc) returned 1 [0255.921] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.922] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc20c [0255.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc214) returned 0x2c8700 [0255.922] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xc20c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xc20c, lpOverlapped=0x0) returned 1 [0255.924] CloseHandle (hObject=0xdc) returned 1 [0255.924] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf")) returned 1 [0255.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.925] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.925] GetTickCount () returned 0x4f546 [0255.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.926] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.926] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934\\....\\temporaryfile")) returned 0 [0255.926] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934\\temporaryfile")) returned 1 [0255.928] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.928] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.928] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.928] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.928] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.928] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.928] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934\\temporaryfile")) returned 1 [0255.928] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.928] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934")) returned 1 [0255.929] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 0 [0255.929] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.930] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4928*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4928*, lpNumberOfBytesWritten=0x18fdd8*=0xc210, lpOverlapped=0x0) returned 1 [0255.932] CloseHandle (hObject=0xdc) returned 1 [0255.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.932] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xae08 [0255.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xae10) returned 0x2c8700 [0255.932] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xae08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xae08, lpOverlapped=0x0) returned 1 [0255.934] CloseHandle (hObject=0xdc) returned 1 [0255.934] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf")) returned 1 [0255.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.935] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.935] GetTickCount () returned 0x4f546 [0255.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.936] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934\\....\\temporaryfile")) returned 0 [0255.936] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934\\temporaryfile")) returned 1 [0255.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8021c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8021c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8021c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8021c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.938] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.938] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.938] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.938] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934\\temporaryfile")) returned 1 [0255.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d7dc060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d7dc060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d7dc060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.939] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.939] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324934" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324934")) returned 1 [0255.939] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 0 [0255.940] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.940] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3520*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3520*, lpNumberOfBytesWritten=0x18fdd8*=0xae10, lpOverlapped=0x0) returned 1 [0255.941] CloseHandle (hObject=0xdc) returned 1 [0255.942] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.942] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe17a [0255.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe182) returned 0x2c8700 [0255.942] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xe17a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xe17a, lpOverlapped=0x0) returned 1 [0255.944] CloseHandle (hObject=0xdc) returned 1 [0255.944] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf")) returned 1 [0255.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.945] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.945] GetTickCount () returned 0x4f556 [0255.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.946] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324950\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324950\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324950\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324950\\....\\temporaryfile")) returned 0 [0255.947] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324950\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324950\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324950\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324950\\temporaryfile")) returned 1 [0255.948] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324950\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8021c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8021c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8021c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.948] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8021c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8021c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8021c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.948] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8021c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8021c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8021c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.948] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324950\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8021c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8021c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8021c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.949] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8021c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8021c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8021c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.949] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8021c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8021c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8021c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.949] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.949] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324950\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324950\\temporaryfile")) returned 1 [0255.949] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8021c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8021c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8021c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.949] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.949] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324950" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324950")) returned 1 [0255.949] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 0 [0255.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.951] WriteFile (in: hFile=0xdc, lpBuffer=0x2d6898*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d6898*, lpNumberOfBytesWritten=0x18fdd8*=0xe180, lpOverlapped=0x0) returned 1 [0255.952] CloseHandle (hObject=0xdc) returned 1 [0255.953] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.953] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x714e [0255.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7156) returned 0x2c8700 [0255.953] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x714e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x714e, lpOverlapped=0x0) returned 1 [0255.955] CloseHandle (hObject=0xdc) returned 1 [0255.955] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf")) returned 1 [0255.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.956] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.956] GetTickCount () returned 0x4f565 [0255.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.956] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965\\....\\temporaryfile")) returned 0 [0255.957] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965\\temporaryfile")) returned 1 [0255.958] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.958] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.959] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.959] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.959] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.959] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.959] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.959] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965\\temporaryfile")) returned 1 [0255.959] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.959] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.959] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965")) returned 1 [0255.959] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 0 [0255.960] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.960] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf868*, nNumberOfBytesToWrite=0x7158, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf868*, lpNumberOfBytesWritten=0x18fdd8*=0x7158, lpOverlapped=0x0) returned 1 [0255.962] CloseHandle (hObject=0xdc) returned 1 [0255.962] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.963] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c4e [0255.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c56) returned 0x2c8700 [0255.963] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7c4e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7c4e, lpOverlapped=0x0) returned 1 [0255.964] CloseHandle (hObject=0xdc) returned 1 [0255.965] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf")) returned 1 [0255.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.966] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.966] GetTickCount () returned 0x4f565 [0255.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.966] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965\\....\\temporaryfile")) returned 0 [0255.967] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965\\temporaryfile")) returned 1 [0255.968] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.969] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.969] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.969] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.969] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.969] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.969] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.969] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965\\temporaryfile")) returned 1 [0255.969] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d828320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d828320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d828320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.969] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.969] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324965" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324965")) returned 1 [0255.969] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 0 [0255.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.971] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0368*, nNumberOfBytesToWrite=0x7c58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0368*, lpNumberOfBytesWritten=0x18fdd8*=0x7c58, lpOverlapped=0x0) returned 1 [0255.972] CloseHandle (hObject=0xdc) returned 1 [0255.972] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.973] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc37e [0255.973] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc386) returned 0x2c8700 [0255.973] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xc37e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xc37e, lpOverlapped=0x0) returned 1 [0255.974] CloseHandle (hObject=0xdc) returned 1 [0255.974] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf")) returned 1 [0255.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.975] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.975] GetTickCount () returned 0x4f575 [0255.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.976] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324981\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324981\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324981\\....\\temporaryfile")) returned 0 [0255.977] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324981\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324981\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324981\\temporaryfile")) returned 1 [0255.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324981\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d84e480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d84e480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d84e480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.978] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d84e480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d84e480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d84e480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.978] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d84e480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d84e480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d84e480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324981\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d84e480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d84e480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d84e480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.978] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d84e480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d84e480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d84e480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.979] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d84e480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d84e480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d84e480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.979] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324981\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324981\\temporaryfile")) returned 1 [0255.979] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d84e480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d84e480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d84e480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.979] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.979] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324981" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324981")) returned 1 [0255.979] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 0 [0255.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.981] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4a98*, nNumberOfBytesToWrite=0xc388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4a98*, lpNumberOfBytesWritten=0x18fdd8*=0xc388, lpOverlapped=0x0) returned 1 [0255.982] CloseHandle (hObject=0xdc) returned 1 [0255.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.983] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x662a [0255.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6632) returned 0x2c8700 [0255.983] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x662a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x662a, lpOverlapped=0x0) returned 1 [0255.985] CloseHandle (hObject=0xdc) returned 1 [0255.985] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf")) returned 1 [0255.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0255.986] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.986] GetTickCount () returned 0x4f584 [0255.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.987] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.987] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996\\...."), lpSecurityAttributes=0x256228) returned 1 [0255.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996\\....\\temporaryfile")) returned 0 [0255.988] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996\\temporaryfile")) returned 1 [0255.989] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.989] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.989] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.989] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.989] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.989] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.989] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.989] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996\\temporaryfile")) returned 1 [0255.990] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0255.990] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0255.990] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996")) returned 1 [0255.990] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 0 [0255.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.991] WriteFile (in: hFile=0xdc, lpBuffer=0x2ced48*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ced48*, lpNumberOfBytesWritten=0x18fdd8*=0x6630, lpOverlapped=0x0) returned 1 [0255.992] CloseHandle (hObject=0xdc) returned 1 [0255.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0255.993] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4124 [0255.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x412c) returned 0x2c8700 [0255.993] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4124, lpOverlapped=0x0) returned 1 [0255.994] CloseHandle (hObject=0xdc) returned 1 [0255.994] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf")) returned 1 [0255.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0255.995] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0255.995] GetTickCount () returned 0x4f584 [0255.996] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0255.996] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0255.996] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0255.996] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996\\...."), lpSecurityAttributes=0x256210) returned 1 [0255.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996\\....\\temporaryfile")) returned 0 [0255.997] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996\\temporaryfile")) returned 1 [0255.998] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0255.998] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.998] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0255.998] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0255.998] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.998] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.999] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0255.999] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996\\temporaryfile")) returned 1 [0256.002] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9d8745e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9d8745e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9d8745e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.002] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.002] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18324996" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18324996")) returned 1 [0256.002] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 0 [0256.003] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.003] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc840*, nNumberOfBytesToWrite=0x4128, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc840*, lpNumberOfBytesWritten=0x18fdd8*=0x4128, lpOverlapped=0x0) returned 1 [0256.004] CloseHandle (hObject=0xdc) returned 1 [0256.004] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.005] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13c4 [0256.005] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13cc) returned 0x25b528 [0256.005] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13c4, lpOverlapped=0x0) returned 1 [0256.223] CloseHandle (hObject=0xdc) returned 1 [0256.224] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf")) returned 1 [0256.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.225] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.225] GetTickCount () returned 0x4f66e [0256.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.225] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.226] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325230\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325230\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325230\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325230\\....\\temporaryfile")) returned 0 [0256.226] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325230\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325230\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325230\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325230\\temporaryfile")) returned 1 [0256.228] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325230\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9daafa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9daafa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9daafa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.228] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9daafa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9daafa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9daafa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.228] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9daafa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9daafa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9daafa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.228] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325230\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9daafa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9daafa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9daafa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.228] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9daafa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9daafa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9daafa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.228] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9daafa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9daafa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9daafa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.228] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.228] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325230\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325230\\temporaryfile")) returned 1 [0256.229] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9daafa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9daafa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9daafa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.229] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.229] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325230" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325230")) returned 1 [0256.229] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 0 [0256.229] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.230] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x13c8, lpOverlapped=0x0) returned 1 [0256.231] CloseHandle (hObject=0xdc) returned 1 [0256.231] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.232] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x35bc [0256.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x35c4) returned 0x2c8700 [0256.233] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x35bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x35bc, lpOverlapped=0x0) returned 1 [0256.234] CloseHandle (hObject=0xdc) returned 1 [0256.234] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf")) returned 1 [0256.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.235] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.235] GetTickCount () returned 0x4f67e [0256.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.236] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246\\....\\temporaryfile")) returned 0 [0256.236] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246\\temporaryfile")) returned 1 [0256.238] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.238] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.238] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.238] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.238] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.238] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.238] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246\\temporaryfile")) returned 1 [0256.238] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.238] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246")) returned 1 [0256.239] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 0 [0256.239] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.240] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbcd8*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbcd8*, lpNumberOfBytesWritten=0x18fdd8*=0x35c0, lpOverlapped=0x0) returned 1 [0256.241] CloseHandle (hObject=0xdc) returned 1 [0256.241] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.242] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a18 [0256.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a20) returned 0x2c8700 [0256.242] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2a18, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2a18, lpOverlapped=0x0) returned 1 [0256.244] CloseHandle (hObject=0xdc) returned 1 [0256.244] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf")) returned 1 [0256.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.245] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.245] GetTickCount () returned 0x4f67e [0256.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.245] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.246] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.246] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246\\....\\temporaryfile")) returned 0 [0256.247] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246\\temporaryfile")) returned 1 [0256.248] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.248] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.248] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.248] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.249] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246\\temporaryfile")) returned 1 [0256.249] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dad5be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dad5be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dad5be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.249] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325246" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325246")) returned 1 [0256.252] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 0 [0256.253] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.254] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb130*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb130*, lpNumberOfBytesWritten=0x18fdd8*=0x2a20, lpOverlapped=0x0) returned 1 [0256.254] CloseHandle (hObject=0xdc) returned 1 [0256.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.255] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1484 [0256.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x148c) returned 0x29b460 [0256.255] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1484, lpOverlapped=0x0) returned 1 [0256.257] CloseHandle (hObject=0xdc) returned 1 [0256.257] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf")) returned 1 [0256.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.258] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.258] GetTickCount () returned 0x4f68e [0256.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.259] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325262\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325262\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325262\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325262\\....\\temporaryfile")) returned 0 [0256.259] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325262\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325262\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325262\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325262\\temporaryfile")) returned 1 [0256.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325262\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dafbd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dafbd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dafbd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dafbd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dafbd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dafbd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dafbd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dafbd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dafbd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325262\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dafbd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dafbd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dafbd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.263] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dafbd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dafbd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dafbd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.263] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dafbd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dafbd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dafbd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.263] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325262\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325262\\temporaryfile")) returned 1 [0256.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dafbd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dafbd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dafbd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.263] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325262" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325262")) returned 1 [0256.264] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 0 [0256.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.265] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1488, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1488, lpOverlapped=0x0) returned 1 [0256.266] CloseHandle (hObject=0xdc) returned 1 [0256.266] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.266] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x27b4 [0256.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x27bc) returned 0x2c8700 [0256.266] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x27b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x27b4, lpOverlapped=0x0) returned 1 [0256.268] CloseHandle (hObject=0xdc) returned 1 [0256.268] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf")) returned 1 [0256.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.269] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.269] GetTickCount () returned 0x4f69d [0256.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.269] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277\\....\\temporaryfile")) returned 0 [0256.270] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277\\temporaryfile")) returned 1 [0256.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.271] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.272] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.272] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.272] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.272] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277\\temporaryfile")) returned 1 [0256.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.272] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277")) returned 1 [0256.272] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 0 [0256.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.273] WriteFile (in: hFile=0xdc, lpBuffer=0x2caed0*, nNumberOfBytesToWrite=0x27b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caed0*, lpNumberOfBytesWritten=0x18fdd8*=0x27b8, lpOverlapped=0x0) returned 1 [0256.274] CloseHandle (hObject=0xdc) returned 1 [0256.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.275] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x302c [0256.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3034) returned 0x2c8700 [0256.275] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x302c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x302c, lpOverlapped=0x0) returned 1 [0256.277] CloseHandle (hObject=0xdc) returned 1 [0256.277] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf")) returned 1 [0256.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.278] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.278] GetTickCount () returned 0x4f69d [0256.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.279] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277\\....\\temporaryfile")) returned 0 [0256.280] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277\\temporaryfile")) returned 1 [0256.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db48000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db48000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db48000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db48000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.282] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277\\temporaryfile")) returned 1 [0256.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db21ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db21ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db21ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.282] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325277" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325277")) returned 1 [0256.282] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 0 [0256.283] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.283] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb748*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb748*, lpNumberOfBytesWritten=0x18fdd8*=0x3030, lpOverlapped=0x0) returned 1 [0256.284] CloseHandle (hObject=0xdc) returned 1 [0256.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.286] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2004 [0256.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x200c) returned 0x2c8700 [0256.286] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2004, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2004, lpOverlapped=0x0) returned 1 [0256.287] CloseHandle (hObject=0xdc) returned 1 [0256.287] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf")) returned 1 [0256.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.288] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.288] GetTickCount () returned 0x4f6ad [0256.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.289] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325293\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325293\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325293\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325293\\....\\temporaryfile")) returned 0 [0256.289] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325293\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325293\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325293\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325293\\temporaryfile")) returned 1 [0256.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325293\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db48000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db48000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db48000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.291] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db48000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db48000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db48000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.291] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db48000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db48000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db48000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325293\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db48000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db48000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db48000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.291] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db48000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db48000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db48000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.291] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db48000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db48000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db48000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.291] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325293\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325293\\temporaryfile")) returned 1 [0256.291] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db48000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db48000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db48000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.291] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.292] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325293" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325293")) returned 1 [0256.292] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 0 [0256.292] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.293] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca720*, nNumberOfBytesToWrite=0x2008, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca720*, lpNumberOfBytesWritten=0x18fdd8*=0x2008, lpOverlapped=0x0) returned 1 [0256.294] CloseHandle (hObject=0xdc) returned 1 [0256.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.295] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c0c [0256.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c14) returned 0x2c4a70 [0256.295] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1c0c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1c0c, lpOverlapped=0x0) returned 1 [0256.297] CloseHandle (hObject=0xdc) returned 1 [0256.297] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf")) returned 1 [0256.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.298] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.298] GetTickCount () returned 0x4f6bc [0256.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.298] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308\\....\\temporaryfile")) returned 0 [0256.299] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308\\temporaryfile")) returned 1 [0256.300] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.300] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.300] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.300] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.301] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308\\temporaryfile")) returned 1 [0256.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.301] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308")) returned 1 [0256.301] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 0 [0256.301] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.302] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1c10, lpOverlapped=0x0) returned 1 [0256.303] CloseHandle (hObject=0xdc) returned 1 [0256.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.304] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14c0 [0256.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14c8) returned 0x29b460 [0256.304] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x14c0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x14c0, lpOverlapped=0x0) returned 1 [0256.305] CloseHandle (hObject=0xdc) returned 1 [0256.305] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf")) returned 1 [0256.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.306] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.306] GetTickCount () returned 0x4f6bc [0256.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.307] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.307] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308\\....\\temporaryfile")) returned 0 [0256.307] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308\\temporaryfile")) returned 1 [0256.309] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.309] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.309] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.309] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.309] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.309] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.309] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.309] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308\\temporaryfile")) returned 1 [0256.309] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db6e160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db6e160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db6e160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.309] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.309] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325308" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325308")) returned 1 [0256.310] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 0 [0256.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.310] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x14c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x14c8, lpOverlapped=0x0) returned 1 [0256.311] CloseHandle (hObject=0xdc) returned 1 [0256.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.312] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f7c [0256.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f84) returned 0x2c8700 [0256.312] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f7c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f7c, lpOverlapped=0x0) returned 1 [0256.313] CloseHandle (hObject=0xdc) returned 1 [0256.313] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf")) returned 1 [0256.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.314] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.315] GetTickCount () returned 0x4f6cc [0256.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.315] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.315] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324\\....\\temporaryfile")) returned 0 [0256.316] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324\\temporaryfile")) returned 1 [0256.317] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.317] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.317] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.317] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.317] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.317] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.317] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.317] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324\\temporaryfile")) returned 1 [0256.318] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.318] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.318] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324")) returned 1 [0256.318] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 0 [0256.318] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.319] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca698*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca698*, lpNumberOfBytesWritten=0x18fdd8*=0x1f80, lpOverlapped=0x0) returned 1 [0256.320] CloseHandle (hObject=0xdc) returned 1 [0256.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.320] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7a46 [0256.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7a4e) returned 0x2c8700 [0256.320] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7a46, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7a46, lpOverlapped=0x0) returned 1 [0256.322] CloseHandle (hObject=0xdc) returned 1 [0256.323] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf")) returned 1 [0256.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.324] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.324] GetTickCount () returned 0x4f6cc [0256.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.324] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324\\....\\temporaryfile")) returned 0 [0256.325] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324\\temporaryfile")) returned 1 [0256.326] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.326] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.326] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.326] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.327] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.327] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.327] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324\\temporaryfile")) returned 1 [0256.327] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9db942c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9db942c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9db942c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.327] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.327] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325324" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325324")) returned 1 [0256.327] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 0 [0256.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.329] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0160*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0160*, lpNumberOfBytesWritten=0x18fdd8*=0x7a50, lpOverlapped=0x0) returned 1 [0256.330] CloseHandle (hObject=0xdc) returned 1 [0256.330] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.330] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4c0a [0256.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c12) returned 0x2c8700 [0256.330] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4c0a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4c0a, lpOverlapped=0x0) returned 1 [0256.332] CloseHandle (hObject=0xdc) returned 1 [0256.332] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf")) returned 1 [0256.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.333] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.333] GetTickCount () returned 0x4f6dc [0256.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.333] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340\\....\\temporaryfile")) returned 0 [0256.334] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340\\temporaryfile")) returned 1 [0256.335] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbba420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbba420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbba420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.335] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbba420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbba420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbba420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.335] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbba420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbba420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbba420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.335] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbba420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbba420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbba420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.335] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbba420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbba420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbba420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.335] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbba420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbba420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbba420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.335] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340\\temporaryfile")) returned 1 [0256.336] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbba420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbba420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbba420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.336] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340")) returned 1 [0256.336] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 0 [0256.336] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.337] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd328*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd328*, lpNumberOfBytesWritten=0x18fdd8*=0x4c10, lpOverlapped=0x0) returned 1 [0256.338] CloseHandle (hObject=0xdc) returned 1 [0256.338] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.339] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa0b0 [0256.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa0b8) returned 0x2c8700 [0256.339] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa0b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa0b0, lpOverlapped=0x0) returned 1 [0256.340] CloseHandle (hObject=0xdc) returned 1 [0256.340] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf")) returned 1 [0256.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.341] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.341] GetTickCount () returned 0x4f6dc [0256.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.342] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340\\....\\temporaryfile")) returned 0 [0256.343] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340\\temporaryfile")) returned 1 [0256.344] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbba420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.344] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbba420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.344] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.344] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.344] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.344] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.344] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340\\temporaryfile")) returned 1 [0256.345] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.345] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.345] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325340" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325340")) returned 1 [0256.345] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 0 [0256.346] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.346] WriteFile (in: hFile=0xdc, lpBuffer=0x2d27c8*, nNumberOfBytesToWrite=0xa0b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d27c8*, lpNumberOfBytesWritten=0x18fdd8*=0xa0b8, lpOverlapped=0x0) returned 1 [0256.348] CloseHandle (hObject=0xdc) returned 1 [0256.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.348] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4f08 [0256.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f10) returned 0x2c8700 [0256.348] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4f08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4f08, lpOverlapped=0x0) returned 1 [0256.350] CloseHandle (hObject=0xdc) returned 1 [0256.350] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf")) returned 1 [0256.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.351] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.351] GetTickCount () returned 0x4f6eb [0256.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.351] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.351] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325355\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325355\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325355\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325355\\....\\temporaryfile")) returned 0 [0256.352] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325355\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325355\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325355\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325355\\temporaryfile")) returned 1 [0256.353] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325355\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.353] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.353] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.353] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325355\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.353] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.353] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.353] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.354] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325355\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325355\\temporaryfile")) returned 1 [0256.354] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dbe0580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dbe0580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dbe0580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.354] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.354] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325355" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325355")) returned 1 [0256.354] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 0 [0256.354] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.355] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd620*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd620*, lpNumberOfBytesWritten=0x18fdd8*=0x4f10, lpOverlapped=0x0) returned 1 [0256.356] CloseHandle (hObject=0xdc) returned 1 [0256.356] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.357] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5398 [0256.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x53a0) returned 0x2c8700 [0256.357] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5398, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5398, lpOverlapped=0x0) returned 1 [0256.359] CloseHandle (hObject=0xdc) returned 1 [0256.359] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf")) returned 1 [0256.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.360] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.360] GetTickCount () returned 0x4f6fb [0256.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.361] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.361] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.361] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371\\....\\temporaryfile")) returned 0 [0256.361] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371\\temporaryfile")) returned 1 [0256.363] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.363] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.363] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.363] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.363] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.363] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.363] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.363] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371\\temporaryfile")) returned 1 [0256.363] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.363] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.363] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371")) returned 1 [0256.363] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 0 [0256.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.365] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdab0*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdab0*, lpNumberOfBytesWritten=0x18fdd8*=0x53a0, lpOverlapped=0x0) returned 1 [0256.366] CloseHandle (hObject=0xdc) returned 1 [0256.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.366] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x366e [0256.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3676) returned 0x2c8700 [0256.366] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x366e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x366e, lpOverlapped=0x0) returned 1 [0256.368] CloseHandle (hObject=0xdc) returned 1 [0256.368] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf")) returned 1 [0256.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.369] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.369] GetTickCount () returned 0x4f6fb [0256.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.370] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371\\....\\temporaryfile")) returned 0 [0256.370] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371\\temporaryfile")) returned 1 [0256.371] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.372] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.372] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.372] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.372] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.372] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.372] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.372] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371\\temporaryfile")) returned 1 [0256.372] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc066e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc066e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc066e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.372] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.372] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325371" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325371")) returned 1 [0256.372] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 0 [0256.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.373] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbd88*, nNumberOfBytesToWrite=0x3678, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbd88*, lpNumberOfBytesWritten=0x18fdd8*=0x3678, lpOverlapped=0x0) returned 1 [0256.374] CloseHandle (hObject=0xdc) returned 1 [0256.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.375] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x273e [0256.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2746) returned 0x2c8700 [0256.375] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x273e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x273e, lpOverlapped=0x0) returned 1 [0256.376] CloseHandle (hObject=0xdc) returned 1 [0256.376] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf")) returned 1 [0256.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.377] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.377] GetTickCount () returned 0x4f70a [0256.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.378] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386\\....\\temporaryfile")) returned 0 [0256.379] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386\\temporaryfile")) returned 1 [0256.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.380] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386\\temporaryfile")) returned 1 [0256.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.380] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386")) returned 1 [0256.381] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 0 [0256.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.381] WriteFile (in: hFile=0xdc, lpBuffer=0x2cae58*, nNumberOfBytesToWrite=0x2748, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cae58*, lpNumberOfBytesWritten=0x18fdd8*=0x2748, lpOverlapped=0x0) returned 1 [0256.382] CloseHandle (hObject=0xdc) returned 1 [0256.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.383] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf36 [0256.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf3e) returned 0x2350048 [0256.383] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xf36, lpOverlapped=0x0) returned 1 [0256.384] CloseHandle (hObject=0xdc) returned 1 [0256.384] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf")) returned 1 [0256.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.385] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.385] GetTickCount () returned 0x4f70a [0256.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.386] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386\\....\\temporaryfile")) returned 0 [0256.394] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386\\temporaryfile")) returned 1 [0256.395] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc529a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc529a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc529a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc529a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.395] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.395] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.395] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.395] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.396] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386\\temporaryfile")) returned 1 [0256.396] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc2c840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc2c840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc2c840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.396] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.396] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325386" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325386")) returned 1 [0256.396] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 0 [0256.396] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.397] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xf40, lpOverlapped=0x0) returned 1 [0256.398] CloseHandle (hObject=0xdc) returned 1 [0256.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.398] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa50e [0256.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa516) returned 0x2c8700 [0256.398] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa50e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa50e, lpOverlapped=0x0) returned 1 [0256.400] CloseHandle (hObject=0xdc) returned 1 [0256.400] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg")) returned 1 [0256.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.401] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.401] GetTickCount () returned 0x4f71a [0256.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.402] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325402\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325402\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325402\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325402\\....\\temporaryfile")) returned 0 [0256.402] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325402\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325402\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325402\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325402\\temporaryfile")) returned 1 [0256.404] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325402\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc529a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc529a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc529a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.404] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc529a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc529a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc529a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.404] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc529a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc529a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc529a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.404] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325402\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc529a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc529a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc529a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.404] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc529a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc529a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc529a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.404] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc529a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc529a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc529a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.404] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.404] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325402\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325402\\temporaryfile")) returned 1 [0256.404] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc529a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc529a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc529a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.404] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.405] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325402" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325402")) returned 1 [0256.405] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 0 [0256.406] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.406] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2c28*, nNumberOfBytesToWrite=0xa518, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2c28*, lpNumberOfBytesWritten=0x18fdd8*=0xa518, lpOverlapped=0x0) returned 1 [0256.408] CloseHandle (hObject=0xdc) returned 1 [0256.408] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.408] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6e74 [0256.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6e7c) returned 0x2c8700 [0256.408] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6e74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6e74, lpOverlapped=0x0) returned 1 [0256.410] CloseHandle (hObject=0xdc) returned 1 [0256.410] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf")) returned 1 [0256.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.411] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.411] GetTickCount () returned 0x4f72a [0256.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.411] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418\\....\\temporaryfile")) returned 0 [0256.412] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418\\temporaryfile")) returned 1 [0256.413] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc78b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc78b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc78b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc78b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc78b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc78b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc78b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc78b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc78b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.413] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc78b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc78b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc78b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.413] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc78b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc78b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc78b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.413] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc78b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc78b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc78b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.413] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.413] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418\\temporaryfile")) returned 1 [0256.414] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc78b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc78b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc78b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.414] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.414] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418")) returned 1 [0256.414] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 0 [0256.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.415] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf590*, nNumberOfBytesToWrite=0x6e78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf590*, lpNumberOfBytesWritten=0x18fdd8*=0x6e78, lpOverlapped=0x0) returned 1 [0256.416] CloseHandle (hObject=0xdc) returned 1 [0256.416] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.418] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x180e [0256.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1816) returned 0x2c4a70 [0256.418] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x180e, lpOverlapped=0x0) returned 1 [0256.419] CloseHandle (hObject=0xdc) returned 1 [0256.419] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf")) returned 1 [0256.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.420] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.420] GetTickCount () returned 0x4f72a [0256.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.421] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.421] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.421] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418\\....\\temporaryfile")) returned 0 [0256.421] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418\\temporaryfile")) returned 1 [0256.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.423] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.423] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.423] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418\\temporaryfile")) returned 1 [0256.423] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.423] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325418" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325418")) returned 1 [0256.424] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 0 [0256.424] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.424] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1818, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1818, lpOverlapped=0x0) returned 1 [0256.425] CloseHandle (hObject=0xdc) returned 1 [0256.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.426] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x25cc [0256.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25d4) returned 0x2c8700 [0256.426] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x25cc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x25cc, lpOverlapped=0x0) returned 1 [0256.427] CloseHandle (hObject=0xdc) returned 1 [0256.427] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf")) returned 1 [0256.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.428] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.428] GetTickCount () returned 0x4f739 [0256.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.429] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325433\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325433\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325433\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325433\\....\\temporaryfile")) returned 0 [0256.430] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325433\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325433\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325433\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325433\\temporaryfile")) returned 1 [0256.431] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325433\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.431] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.431] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.431] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325433\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.431] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.431] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.431] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.431] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325433\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325433\\temporaryfile")) returned 1 [0256.431] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dc9ec60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dc9ec60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dc9ec60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.432] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.432] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325433" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325433")) returned 1 [0256.432] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 0 [0256.432] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.433] WriteFile (in: hFile=0xdc, lpBuffer=0x2cace8*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cace8*, lpNumberOfBytesWritten=0x18fdd8*=0x25d0, lpOverlapped=0x0) returned 1 [0256.434] CloseHandle (hObject=0xdc) returned 1 [0256.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.435] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x199a [0256.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19a2) returned 0x2c4a70 [0256.435] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x199a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x199a, lpOverlapped=0x0) returned 1 [0256.437] CloseHandle (hObject=0xdc) returned 1 [0256.437] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf")) returned 1 [0256.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.438] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.438] GetTickCount () returned 0x4f749 [0256.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.438] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449\\....\\temporaryfile")) returned 0 [0256.439] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449\\temporaryfile")) returned 1 [0256.440] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.440] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.440] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.440] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.440] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.440] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.440] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.440] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449\\temporaryfile")) returned 1 [0256.441] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.441] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.441] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449")) returned 1 [0256.441] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 0 [0256.441] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.442] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x19a0, lpOverlapped=0x0) returned 1 [0256.443] CloseHandle (hObject=0xdc) returned 1 [0256.443] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.443] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x80c [0256.443] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x814) returned 0x2350048 [0256.443] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x80c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x80c, lpOverlapped=0x0) returned 1 [0256.445] CloseHandle (hObject=0xdc) returned 1 [0256.445] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf")) returned 1 [0256.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.446] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.446] GetTickCount () returned 0x4f749 [0256.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.446] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449\\....\\temporaryfile")) returned 0 [0256.447] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449\\temporaryfile")) returned 1 [0256.448] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.448] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.448] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.449] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.449] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.449] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.449] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.449] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449\\temporaryfile")) returned 1 [0256.449] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dcc4dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dcc4dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dcc4dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.449] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.449] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325449" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325449")) returned 1 [0256.449] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 0 [0256.449] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.450] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x810, lpOverlapped=0x0) returned 1 [0256.451] CloseHandle (hObject=0xdc) returned 1 [0256.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.452] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d4a [0256.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d52) returned 0x2c8700 [0256.452] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1d4a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1d4a, lpOverlapped=0x0) returned 1 [0256.454] CloseHandle (hObject=0xdc) returned 1 [0256.455] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf")) returned 1 [0256.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.455] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.456] GetTickCount () returned 0x4f758 [0256.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.456] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464\\....\\temporaryfile")) returned 0 [0256.457] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464\\temporaryfile")) returned 1 [0256.458] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.458] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.458] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.458] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.458] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.458] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.458] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.458] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464\\temporaryfile")) returned 1 [0256.458] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.458] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.459] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464")) returned 1 [0256.459] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 0 [0256.459] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.460] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca468*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca468*, lpNumberOfBytesWritten=0x18fdd8*=0x1d50, lpOverlapped=0x0) returned 1 [0256.460] CloseHandle (hObject=0xdc) returned 1 [0256.461] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.461] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa5c [0256.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa64) returned 0x2350048 [0256.461] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa5c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xa5c, lpOverlapped=0x0) returned 1 [0256.463] CloseHandle (hObject=0xdc) returned 1 [0256.463] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf")) returned 1 [0256.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.463] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.464] GetTickCount () returned 0x4f758 [0256.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.464] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464\\....\\temporaryfile")) returned 0 [0256.465] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464\\temporaryfile")) returned 1 [0256.466] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.466] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.466] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.466] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.466] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.466] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.466] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.466] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464\\temporaryfile")) returned 1 [0256.467] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dceaf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dceaf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dceaf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.467] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.467] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325464" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325464")) returned 1 [0256.467] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 0 [0256.467] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.468] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xa60, lpOverlapped=0x0) returned 1 [0256.469] CloseHandle (hObject=0xdc) returned 1 [0256.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.469] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf00 [0256.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf08) returned 0x2350048 [0256.469] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xf00, lpOverlapped=0x0) returned 1 [0256.471] CloseHandle (hObject=0xdc) returned 1 [0256.471] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf")) returned 1 [0256.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.471] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.472] GetTickCount () returned 0x4f768 [0256.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.472] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.472] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480\\....\\temporaryfile")) returned 0 [0256.473] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480\\temporaryfile")) returned 1 [0256.474] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.474] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.474] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.474] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.474] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.474] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.474] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.474] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480\\temporaryfile")) returned 1 [0256.474] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.474] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.475] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480")) returned 1 [0256.475] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 0 [0256.475] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.475] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xf08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xf08, lpOverlapped=0x0) returned 1 [0256.476] CloseHandle (hObject=0xdc) returned 1 [0256.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.477] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7cb6 [0256.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7cbe) returned 0x2c8700 [0256.477] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7cb6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7cb6, lpOverlapped=0x0) returned 1 [0256.479] CloseHandle (hObject=0xdc) returned 1 [0256.479] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf")) returned 1 [0256.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.480] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.480] GetTickCount () returned 0x4f768 [0256.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.480] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.481] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480\\....\\temporaryfile")) returned 0 [0256.481] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480\\temporaryfile")) returned 1 [0256.482] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.483] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.483] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.483] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.483] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.483] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.483] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.483] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480\\temporaryfile")) returned 1 [0256.483] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd11080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd11080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd11080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.483] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.483] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325480" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325480")) returned 1 [0256.483] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 0 [0256.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.485] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03d0*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7cc0, lpOverlapped=0x0) returned 1 [0256.486] CloseHandle (hObject=0xdc) returned 1 [0256.486] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.487] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaefa [0256.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaf02) returned 0x2c8700 [0256.487] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xaefa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xaefa, lpOverlapped=0x0) returned 1 [0256.489] CloseHandle (hObject=0xdc) returned 1 [0256.489] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf")) returned 1 [0256.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.490] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.490] GetTickCount () returned 0x4f778 [0256.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.490] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325496\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325496\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325496\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325496\\....\\temporaryfile")) returned 0 [0256.491] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325496\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325496\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325496\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325496\\temporaryfile")) returned 1 [0256.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325496\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd371e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd371e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd371e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd371e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd371e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd371e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd371e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd371e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd371e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325496\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd371e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd371e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd371e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.492] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd371e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd371e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd371e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.492] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd371e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd371e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd371e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.493] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.493] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325496\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325496\\temporaryfile")) returned 1 [0256.493] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd371e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd371e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd371e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.493] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.493] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325496" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325496")) returned 1 [0256.493] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 0 [0256.494] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.494] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3618*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3618*, lpNumberOfBytesWritten=0x18fdd8*=0xaf00, lpOverlapped=0x0) returned 1 [0256.496] CloseHandle (hObject=0xdc) returned 1 [0256.496] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.496] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2d6c [0256.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d74) returned 0x2c8700 [0256.497] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2d6c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2d6c, lpOverlapped=0x0) returned 1 [0256.498] CloseHandle (hObject=0xdc) returned 1 [0256.498] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf")) returned 1 [0256.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.499] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.499] GetTickCount () returned 0x4f787 [0256.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.500] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.500] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511\\....\\temporaryfile")) returned 0 [0256.500] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511\\temporaryfile")) returned 1 [0256.501] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.501] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.501] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.501] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.502] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.502] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.502] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.502] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511\\temporaryfile")) returned 1 [0256.502] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.502] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.502] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511")) returned 1 [0256.502] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 0 [0256.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.503] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb488*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb488*, lpNumberOfBytesWritten=0x18fdd8*=0x2d70, lpOverlapped=0x0) returned 1 [0256.504] CloseHandle (hObject=0xdc) returned 1 [0256.504] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.505] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f50 [0256.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f58) returned 0x2c8700 [0256.505] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f50, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f50, lpOverlapped=0x0) returned 1 [0256.506] CloseHandle (hObject=0xdc) returned 1 [0256.506] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf")) returned 1 [0256.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.507] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.507] GetTickCount () returned 0x4f787 [0256.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.508] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511\\....\\temporaryfile")) returned 0 [0256.508] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511\\temporaryfile")) returned 1 [0256.510] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.510] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.510] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.510] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.510] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.510] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.510] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.510] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511\\temporaryfile")) returned 1 [0256.510] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd5d340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd5d340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd5d340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.510] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.510] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325511" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325511")) returned 1 [0256.510] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 0 [0256.511] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.511] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca668*, nNumberOfBytesToWrite=0x1f58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca668*, lpNumberOfBytesWritten=0x18fdd8*=0x1f58, lpOverlapped=0x0) returned 1 [0256.512] CloseHandle (hObject=0xdc) returned 1 [0256.513] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.513] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x81ce [0256.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x81d6) returned 0x2c8700 [0256.513] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x81ce, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x81ce, lpOverlapped=0x0) returned 1 [0256.515] CloseHandle (hObject=0xdc) returned 1 [0256.515] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf")) returned 1 [0256.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.516] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.516] GetTickCount () returned 0x4f797 [0256.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.516] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527\\....\\temporaryfile")) returned 0 [0256.517] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527\\temporaryfile")) returned 1 [0256.518] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd834a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd834a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd834a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.518] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd834a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd834a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd834a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.518] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd834a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd834a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd834a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.518] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd834a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd834a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd834a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.518] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd834a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd834a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd834a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.518] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd834a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd834a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd834a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.518] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.519] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527\\temporaryfile")) returned 1 [0256.519] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd834a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dd834a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dd834a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.519] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.522] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527")) returned 1 [0256.522] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 0 [0256.523] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.524] WriteFile (in: hFile=0xdc, lpBuffer=0x2d08e8*, nNumberOfBytesToWrite=0x81d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d08e8*, lpNumberOfBytesWritten=0x18fdd8*=0x81d8, lpOverlapped=0x0) returned 1 [0256.525] CloseHandle (hObject=0xdc) returned 1 [0256.525] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.526] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x244a [0256.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2452) returned 0x2c8700 [0256.527] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x244a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x244a, lpOverlapped=0x0) returned 1 [0256.528] CloseHandle (hObject=0xdc) returned 1 [0256.528] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf")) returned 1 [0256.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.529] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.529] GetTickCount () returned 0x4f797 [0256.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.529] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.529] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527\\....\\temporaryfile")) returned 0 [0256.530] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527\\temporaryfile")) returned 1 [0256.531] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd834a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.531] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dd834a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.532] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.532] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.532] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.532] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.532] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.532] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527\\temporaryfile")) returned 1 [0256.532] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.532] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.532] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325527" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325527")) returned 1 [0256.532] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 0 [0256.533] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.533] WriteFile (in: hFile=0xdc, lpBuffer=0x2cab68*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cab68*, lpNumberOfBytesWritten=0x18fdd8*=0x2450, lpOverlapped=0x0) returned 1 [0256.534] CloseHandle (hObject=0xdc) returned 1 [0256.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.535] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x45a2 [0256.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x45aa) returned 0x2c8700 [0256.535] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x45a2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x45a2, lpOverlapped=0x0) returned 1 [0256.536] CloseHandle (hObject=0xdc) returned 1 [0256.536] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf")) returned 1 [0256.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.537] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.537] GetTickCount () returned 0x4f7a6 [0256.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.538] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325542\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325542\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.538] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325542\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325542\\....\\temporaryfile")) returned 0 [0256.539] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325542\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325542\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325542\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325542\\temporaryfile")) returned 1 [0256.540] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325542\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.540] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.540] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.540] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325542\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.540] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.540] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.540] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.540] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325542\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325542\\temporaryfile")) returned 1 [0256.540] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dda9600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dda9600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dda9600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.541] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325542" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325542")) returned 1 [0256.541] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 0 [0256.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.542] WriteFile (in: hFile=0xdc, lpBuffer=0x2cccc0*, nNumberOfBytesToWrite=0x45a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cccc0*, lpNumberOfBytesWritten=0x18fdd8*=0x45a8, lpOverlapped=0x0) returned 1 [0256.543] CloseHandle (hObject=0xdc) returned 1 [0256.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.543] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15f2 [0256.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15fa) returned 0x2c4a70 [0256.544] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x15f2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x15f2, lpOverlapped=0x0) returned 1 [0256.545] CloseHandle (hObject=0xdc) returned 1 [0256.545] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf")) returned 1 [0256.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.546] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.546] GetTickCount () returned 0x4f7b6 [0256.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.547] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558\\....\\temporaryfile")) returned 0 [0256.547] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558\\temporaryfile")) returned 1 [0256.548] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.549] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.549] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.549] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.549] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.549] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.549] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.549] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558\\temporaryfile")) returned 1 [0256.549] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.549] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.549] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558")) returned 1 [0256.549] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 0 [0256.550] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.550] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x15f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x15f8, lpOverlapped=0x0) returned 1 [0256.551] CloseHandle (hObject=0xdc) returned 1 [0256.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.552] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa783 [0256.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa78b) returned 0x2c8700 [0256.552] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa783, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa783, lpOverlapped=0x0) returned 1 [0256.554] CloseHandle (hObject=0xdc) returned 1 [0256.554] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg")) returned 1 [0256.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.555] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.555] GetTickCount () returned 0x4f7b6 [0256.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.555] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558\\....\\temporaryfile")) returned 0 [0256.556] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558\\temporaryfile")) returned 1 [0256.557] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.557] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.557] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.557] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.558] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.558] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.558] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.558] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558\\temporaryfile")) returned 1 [0256.558] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddcf760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddcf760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddcf760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.558] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.558] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325558" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325558")) returned 1 [0256.558] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 0 [0256.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.559] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2ea0*, nNumberOfBytesToWrite=0xa788, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2ea0*, lpNumberOfBytesWritten=0x18fdd8*=0xa788, lpOverlapped=0x0) returned 1 [0256.561] CloseHandle (hObject=0xdc) returned 1 [0256.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.563] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5474 [0256.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x547c) returned 0x2c8700 [0256.563] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5474, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5474, lpOverlapped=0x0) returned 1 [0256.564] CloseHandle (hObject=0xdc) returned 1 [0256.564] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg")) returned 1 [0256.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.566] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.566] GetTickCount () returned 0x4f7c6 [0256.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.566] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574\\....\\temporaryfile")) returned 0 [0256.567] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574\\temporaryfile")) returned 1 [0256.568] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.568] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.568] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.568] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.568] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.568] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.568] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.568] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574\\temporaryfile")) returned 1 [0256.569] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.569] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.569] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574")) returned 1 [0256.569] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 0 [0256.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.570] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdb90*, nNumberOfBytesToWrite=0x5478, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdb90*, lpNumberOfBytesWritten=0x18fdd8*=0x5478, lpOverlapped=0x0) returned 1 [0256.571] CloseHandle (hObject=0xdc) returned 1 [0256.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.572] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa488 [0256.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa490) returned 0x2c8700 [0256.572] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa488, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa488, lpOverlapped=0x0) returned 1 [0256.574] CloseHandle (hObject=0xdc) returned 1 [0256.574] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf")) returned 1 [0256.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.575] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.575] GetTickCount () returned 0x4f7c6 [0256.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.575] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574\\....\\temporaryfile")) returned 0 [0256.576] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574\\temporaryfile")) returned 1 [0256.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de1ba20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de1ba20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.578] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de1ba20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de1ba20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.578] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.578] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.578] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.578] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574\\temporaryfile")) returned 1 [0256.578] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ddf58c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ddf58c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ddf58c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.578] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.578] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325574" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325574")) returned 1 [0256.578] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 0 [0256.579] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.580] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2ba0*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2ba0*, lpNumberOfBytesWritten=0x18fdd8*=0xa490, lpOverlapped=0x0) returned 1 [0256.581] CloseHandle (hObject=0xdc) returned 1 [0256.581] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.582] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x60dc [0256.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x60e4) returned 0x2c8700 [0256.582] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x60dc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x60dc, lpOverlapped=0x0) returned 1 [0256.583] CloseHandle (hObject=0xdc) returned 1 [0256.584] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf")) returned 1 [0256.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.585] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.585] GetTickCount () returned 0x4f7d5 [0256.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.585] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325589\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325589\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325589\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325589\\....\\temporaryfile")) returned 0 [0256.586] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325589\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325589\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325589\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325589\\temporaryfile")) returned 1 [0256.587] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325589\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de1ba20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de1ba20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de1ba20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.587] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de1ba20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de1ba20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de1ba20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.587] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de1ba20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de1ba20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de1ba20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.587] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325589\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de1ba20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de1ba20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de1ba20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.587] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de1ba20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de1ba20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de1ba20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.588] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de1ba20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de1ba20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de1ba20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.588] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.588] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325589\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325589\\temporaryfile")) returned 1 [0256.588] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de1ba20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de1ba20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de1ba20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.588] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.588] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325589" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325589")) returned 1 [0256.588] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 0 [0256.589] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.589] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce7f8*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce7f8*, lpNumberOfBytesWritten=0x18fdd8*=0x60e0, lpOverlapped=0x0) returned 1 [0256.590] CloseHandle (hObject=0xdc) returned 1 [0256.590] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.591] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f46 [0256.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f4e) returned 0x2c8700 [0256.591] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f46, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f46, lpOverlapped=0x0) returned 1 [0256.597] CloseHandle (hObject=0xdc) returned 1 [0256.597] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf")) returned 1 [0256.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.598] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.598] GetTickCount () returned 0x4f7e5 [0256.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.599] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.599] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605\\....\\temporaryfile")) returned 0 [0256.599] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605\\temporaryfile")) returned 1 [0256.600] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de41b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de41b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de41b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.601] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de41b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de41b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de41b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.601] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de41b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de41b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de41b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de41b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de41b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de41b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.601] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de41b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de41b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de41b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.601] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de41b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de41b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de41b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.601] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605\\temporaryfile")) returned 1 [0256.601] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de41b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de41b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de41b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.601] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.601] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605")) returned 1 [0256.601] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 0 [0256.602] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.602] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca660*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca660*, lpNumberOfBytesWritten=0x18fdd8*=0x1f50, lpOverlapped=0x0) returned 1 [0256.603] CloseHandle (hObject=0xdc) returned 1 [0256.603] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.604] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x24e2 [0256.604] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24ea) returned 0x2c8700 [0256.604] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x24e2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x24e2, lpOverlapped=0x0) returned 1 [0256.606] CloseHandle (hObject=0xdc) returned 1 [0256.606] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf")) returned 1 [0256.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.607] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.607] GetTickCount () returned 0x4f7e5 [0256.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.608] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605\\....\\temporaryfile")) returned 0 [0256.608] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605\\temporaryfile")) returned 1 [0256.610] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de41b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.610] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de41b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.610] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.610] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.610] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.610] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.610] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.610] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605\\temporaryfile")) returned 1 [0256.610] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.610] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.610] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325605" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325605")) returned 1 [0256.610] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF") returned 0 [0256.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.611] WriteFile (in: hFile=0xdc, lpBuffer=0x2cac00*, nNumberOfBytesToWrite=0x24e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cac00*, lpNumberOfBytesWritten=0x18fdd8*=0x24e8, lpOverlapped=0x0) returned 1 [0256.612] CloseHandle (hObject=0xdc) returned 1 [0256.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.614] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9b3a [0256.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9b42) returned 0x2c8700 [0256.614] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x9b3a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x9b3a, lpOverlapped=0x0) returned 1 [0256.615] CloseHandle (hObject=0xdc) returned 1 [0256.615] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf")) returned 1 [0256.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.616] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.616] GetTickCount () returned 0x4f7f4 [0256.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.617] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325620\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325620\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.617] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325620\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325620\\....\\temporaryfile")) returned 0 [0256.618] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325620\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325620\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325620\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325620\\temporaryfile")) returned 1 [0256.619] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325620\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.619] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.619] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.619] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325620\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.619] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.619] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.619] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.620] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325620\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325620\\temporaryfile")) returned 1 [0256.620] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de67ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de67ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de67ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.620] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.620] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325620" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325620")) returned 1 [0256.620] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 0 [0256.621] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.622] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2258*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2258*, lpNumberOfBytesWritten=0x18fdd8*=0x9b40, lpOverlapped=0x0) returned 1 [0256.623] CloseHandle (hObject=0xdc) returned 1 [0256.623] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.624] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1484 [0256.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x148c) returned 0x29b460 [0256.624] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1484, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1484, lpOverlapped=0x0) returned 1 [0256.625] CloseHandle (hObject=0xdc) returned 1 [0256.625] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf")) returned 1 [0256.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.626] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.626] GetTickCount () returned 0x4f804 [0256.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.627] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636\\....\\temporaryfile")) returned 0 [0256.627] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636\\temporaryfile")) returned 1 [0256.629] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.629] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.629] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.629] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.629] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.629] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.629] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.629] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636\\temporaryfile")) returned 1 [0256.629] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.629] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.630] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636")) returned 1 [0256.630] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 0 [0256.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.631] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1488, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1488, lpOverlapped=0x0) returned 1 [0256.632] CloseHandle (hObject=0xdc) returned 1 [0256.632] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.632] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd9a [0256.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xda2) returned 0x2350048 [0256.632] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xd9a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xd9a, lpOverlapped=0x0) returned 1 [0256.634] CloseHandle (hObject=0xdc) returned 1 [0256.634] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf")) returned 1 [0256.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.634] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.635] GetTickCount () returned 0x4f804 [0256.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.635] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636\\....\\temporaryfile")) returned 0 [0256.636] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636\\temporaryfile")) returned 1 [0256.637] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.637] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.637] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.637] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.637] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.637] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.638] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.638] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636\\temporaryfile")) returned 1 [0256.638] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9de8de40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9de8de40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9de8de40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.638] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.638] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325636" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325636")) returned 1 [0256.638] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 0 [0256.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.639] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xda0, lpOverlapped=0x0) returned 1 [0256.640] CloseHandle (hObject=0xdc) returned 1 [0256.640] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.641] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ca8 [0256.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1cb0) returned 0x2c8700 [0256.641] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1ca8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1ca8, lpOverlapped=0x0) returned 1 [0256.642] CloseHandle (hObject=0xdc) returned 1 [0256.642] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf")) returned 1 [0256.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.643] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.643] GetTickCount () returned 0x4f814 [0256.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.644] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325652\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325652\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325652\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325652\\....\\temporaryfile")) returned 0 [0256.644] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325652\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325652\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325652\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325652\\temporaryfile")) returned 1 [0256.646] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325652\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deb3fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deb3fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deb3fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.646] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deb3fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deb3fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deb3fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.646] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deb3fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deb3fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deb3fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.646] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325652\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deb3fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deb3fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deb3fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.646] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deb3fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deb3fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deb3fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.646] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deb3fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deb3fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deb3fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.646] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.646] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325652\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325652\\temporaryfile")) returned 1 [0256.646] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deb3fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deb3fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deb3fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.646] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.646] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325652" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325652")) returned 1 [0256.647] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 0 [0256.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.647] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca3c0*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca3c0*, lpNumberOfBytesWritten=0x18fdd8*=0x1cb0, lpOverlapped=0x0) returned 1 [0256.649] CloseHandle (hObject=0xdc) returned 1 [0256.649] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.650] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8ad6 [0256.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8ade) returned 0x2c8700 [0256.650] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8ad6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8ad6, lpOverlapped=0x0) returned 1 [0256.653] CloseHandle (hObject=0xdc) returned 1 [0256.653] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg")) returned 1 [0256.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.654] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.654] GetTickCount () returned 0x4f823 [0256.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.655] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.655] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667\\....\\temporaryfile")) returned 0 [0256.655] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667\\temporaryfile")) returned 1 [0256.657] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.657] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.657] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.657] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.657] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.657] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.657] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.657] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667\\temporaryfile")) returned 1 [0256.657] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.657] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.657] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667")) returned 1 [0256.658] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 0 [0256.658] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.659] WriteFile (in: hFile=0xdc, lpBuffer=0x2d11f0*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d11f0*, lpNumberOfBytesWritten=0x18fdd8*=0x8ae0, lpOverlapped=0x0) returned 1 [0256.660] CloseHandle (hObject=0xdc) returned 1 [0256.663] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.664] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe2e9 [0256.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe2f1) returned 0x2c8700 [0256.665] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xe2e9, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xe2e9, lpOverlapped=0x0) returned 1 [0256.666] CloseHandle (hObject=0xdc) returned 1 [0256.666] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg")) returned 1 [0256.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.668] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.668] GetTickCount () returned 0x4f823 [0256.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.668] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667\\....\\temporaryfile")) returned 0 [0256.669] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667\\temporaryfile")) returned 1 [0256.670] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.670] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.670] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.670] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.671] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.671] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.671] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.671] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667\\temporaryfile")) returned 1 [0256.671] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9deda100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9deda100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9deda100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.671] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.671] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325667" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325667")) returned 1 [0256.671] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 0 [0256.672] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.673] WriteFile (in: hFile=0xdc, lpBuffer=0x2d6a08*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d6a08*, lpNumberOfBytesWritten=0x18fdd8*=0xe2f0, lpOverlapped=0x0) returned 1 [0256.674] CloseHandle (hObject=0xdc) returned 1 [0256.674] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.675] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x65a6 [0256.675] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x65ae) returned 0x2c8700 [0256.675] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x65a6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x65a6, lpOverlapped=0x0) returned 1 [0256.676] CloseHandle (hObject=0xdc) returned 1 [0256.676] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf")) returned 1 [0256.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.677] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.678] GetTickCount () returned 0x4f833 [0256.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.678] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325683\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325683\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325683\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325683\\....\\temporaryfile")) returned 0 [0256.679] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325683\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325683\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325683\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325683\\temporaryfile")) returned 1 [0256.680] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325683\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df00260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df00260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df00260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.680] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df00260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df00260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df00260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.680] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df00260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df00260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df00260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.681] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325683\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df00260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df00260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df00260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.681] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df00260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df00260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df00260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.681] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df00260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df00260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df00260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.681] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.681] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325683\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325683\\temporaryfile")) returned 1 [0256.681] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df00260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df00260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df00260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.681] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.681] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325683" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325683")) returned 1 [0256.681] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 0 [0256.682] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.683] WriteFile (in: hFile=0xdc, lpBuffer=0x2cecc0*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cecc0*, lpNumberOfBytesWritten=0x18fdd8*=0x65b0, lpOverlapped=0x0) returned 1 [0256.684] CloseHandle (hObject=0xdc) returned 1 [0256.684] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.684] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x918c [0256.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9194) returned 0x2c8700 [0256.684] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x918c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x918c, lpOverlapped=0x0) returned 1 [0256.686] CloseHandle (hObject=0xdc) returned 1 [0256.686] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf")) returned 1 [0256.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.687] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.687] GetTickCount () returned 0x4f842 [0256.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.688] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.688] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698\\....\\temporaryfile")) returned 0 [0256.688] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698\\temporaryfile")) returned 1 [0256.689] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.690] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.690] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.690] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.690] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.690] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.690] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.690] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698\\temporaryfile")) returned 1 [0256.690] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.690] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.690] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698")) returned 1 [0256.690] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 0 [0256.691] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.692] WriteFile (in: hFile=0xdc, lpBuffer=0x2d18a8*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d18a8*, lpNumberOfBytesWritten=0x18fdd8*=0x9190, lpOverlapped=0x0) returned 1 [0256.693] CloseHandle (hObject=0xdc) returned 1 [0256.693] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.694] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1daa [0256.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1db2) returned 0x2c8700 [0256.694] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1daa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1daa, lpOverlapped=0x0) returned 1 [0256.696] CloseHandle (hObject=0xdc) returned 1 [0256.696] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf")) returned 1 [0256.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.697] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.697] GetTickCount () returned 0x4f842 [0256.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.697] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.697] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698\\....\\temporaryfile")) returned 0 [0256.698] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698\\temporaryfile")) returned 1 [0256.699] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.699] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.699] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.699] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.700] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.700] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.700] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.700] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698\\temporaryfile")) returned 1 [0256.700] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df263c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df263c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df263c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.700] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.700] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325698" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325698")) returned 1 [0256.700] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 0 [0256.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.701] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca4c8*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca4c8*, lpNumberOfBytesWritten=0x18fdd8*=0x1db0, lpOverlapped=0x0) returned 1 [0256.702] CloseHandle (hObject=0xdc) returned 1 [0256.702] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.703] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1066 [0256.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x106e) returned 0x25b528 [0256.703] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1066, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1066, lpOverlapped=0x0) returned 1 [0256.705] CloseHandle (hObject=0xdc) returned 1 [0256.705] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf")) returned 1 [0256.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.706] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.706] GetTickCount () returned 0x4f852 [0256.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.706] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.707] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.707] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714\\....\\temporaryfile")) returned 0 [0256.707] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714\\temporaryfile")) returned 1 [0256.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.708] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.708] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.708] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.709] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.709] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.709] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.709] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714\\temporaryfile")) returned 1 [0256.709] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.709] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.709] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714")) returned 1 [0256.709] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 0 [0256.709] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.710] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1070, lpOverlapped=0x0) returned 1 [0256.711] CloseHandle (hObject=0xdc) returned 1 [0256.711] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.712] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x332a [0256.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3332) returned 0x2c8700 [0256.712] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x332a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x332a, lpOverlapped=0x0) returned 1 [0256.713] CloseHandle (hObject=0xdc) returned 1 [0256.713] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf")) returned 1 [0256.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.714] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.714] GetTickCount () returned 0x4f852 [0256.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.715] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714\\....\\temporaryfile")) returned 0 [0256.716] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714\\temporaryfile")) returned 1 [0256.717] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.717] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.717] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.717] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.717] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.717] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.717] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.717] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714\\temporaryfile")) returned 1 [0256.717] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df4c520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df4c520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df4c520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.717] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.718] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325714" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325714")) returned 1 [0256.718] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 0 [0256.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.719] WriteFile (in: hFile=0xdc, lpBuffer=0x2cba48*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cba48*, lpNumberOfBytesWritten=0x18fdd8*=0x3330, lpOverlapped=0x0) returned 1 [0256.720] CloseHandle (hObject=0xdc) returned 1 [0256.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.721] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6bc2 [0256.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6bca) returned 0x2c8700 [0256.721] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6bc2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6bc2, lpOverlapped=0x0) returned 1 [0256.722] CloseHandle (hObject=0xdc) returned 1 [0256.722] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf")) returned 1 [0256.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.723] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.723] GetTickCount () returned 0x4f862 [0256.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.724] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325730\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325730\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325730\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325730\\....\\temporaryfile")) returned 0 [0256.724] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325730\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325730\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325730\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325730\\temporaryfile")) returned 1 [0256.726] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325730\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df72680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df72680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df72680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.726] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df72680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df72680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df72680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.726] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df72680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df72680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df72680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.726] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325730\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df72680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df72680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df72680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.726] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df72680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df72680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df72680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.726] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df72680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df72680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df72680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.726] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.726] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325730\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325730\\temporaryfile")) returned 1 [0256.726] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df72680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df72680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df72680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.726] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.726] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325730" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325730")) returned 1 [0256.726] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 0 [0256.727] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.728] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf2e0*, nNumberOfBytesToWrite=0x6bc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf2e0*, lpNumberOfBytesWritten=0x18fdd8*=0x6bc8, lpOverlapped=0x0) returned 1 [0256.729] CloseHandle (hObject=0xdc) returned 1 [0256.729] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.730] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa086 [0256.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa08e) returned 0x2c8700 [0256.730] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa086, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa086, lpOverlapped=0x0) returned 1 [0256.731] CloseHandle (hObject=0xdc) returned 1 [0256.731] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf")) returned 1 [0256.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.733] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.733] GetTickCount () returned 0x4f871 [0256.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.733] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745\\....\\temporaryfile")) returned 0 [0256.734] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745\\temporaryfile")) returned 1 [0256.735] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.735] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.735] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.735] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.735] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.735] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.735] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.735] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745\\temporaryfile")) returned 1 [0256.735] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.736] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.736] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745")) returned 1 [0256.736] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF") returned 0 [0256.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.737] WriteFile (in: hFile=0xdc, lpBuffer=0x2d27a0*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d27a0*, lpNumberOfBytesWritten=0x18fdd8*=0xa090, lpOverlapped=0x0) returned 1 [0256.738] CloseHandle (hObject=0xdc) returned 1 [0256.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.739] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x380a [0256.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3812) returned 0x2c8700 [0256.739] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x380a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x380a, lpOverlapped=0x0) returned 1 [0256.740] CloseHandle (hObject=0xdc) returned 1 [0256.741] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf")) returned 1 [0256.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.741] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.742] GetTickCount () returned 0x4f871 [0256.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.742] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745\\....\\temporaryfile")) returned 0 [0256.743] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745\\temporaryfile")) returned 1 [0256.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.744] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.744] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.744] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.744] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.744] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.744] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745\\temporaryfile")) returned 1 [0256.745] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9df987e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9df987e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9df987e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.745] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325745" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325745")) returned 1 [0256.745] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 0 [0256.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.746] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbf28*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbf28*, lpNumberOfBytesWritten=0x18fdd8*=0x3810, lpOverlapped=0x0) returned 1 [0256.747] CloseHandle (hObject=0xdc) returned 1 [0256.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.747] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x899c [0256.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x89a4) returned 0x2c8700 [0256.748] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x899c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x899c, lpOverlapped=0x0) returned 1 [0256.749] CloseHandle (hObject=0xdc) returned 1 [0256.749] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf")) returned 1 [0256.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.750] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.750] GetTickCount () returned 0x4f881 [0256.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.751] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761\\....\\temporaryfile")) returned 0 [0256.751] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761\\temporaryfile")) returned 1 [0256.753] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.753] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.753] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.753] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.753] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.753] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.753] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.753] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761\\temporaryfile")) returned 1 [0256.753] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.753] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.753] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761")) returned 1 [0256.754] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF") returned 0 [0256.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.755] WriteFile (in: hFile=0xdc, lpBuffer=0x2d10b8*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d10b8*, lpNumberOfBytesWritten=0x18fdd8*=0x89a0, lpOverlapped=0x0) returned 1 [0256.756] CloseHandle (hObject=0xdc) returned 1 [0256.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.757] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4de6 [0256.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4dee) returned 0x2c8700 [0256.757] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4de6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4de6, lpOverlapped=0x0) returned 1 [0256.758] CloseHandle (hObject=0xdc) returned 1 [0256.758] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf")) returned 1 [0256.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.759] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.759] GetTickCount () returned 0x4f881 [0256.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.760] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761\\....\\temporaryfile")) returned 0 [0256.761] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761\\temporaryfile")) returned 1 [0256.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.762] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.762] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.762] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.762] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.762] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.762] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761\\temporaryfile")) returned 1 [0256.762] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfbe940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfbe940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfbe940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.762] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325761" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325761")) returned 1 [0256.763] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 0 [0256.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.764] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd500*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd500*, lpNumberOfBytesWritten=0x18fdd8*=0x4df0, lpOverlapped=0x0) returned 1 [0256.765] CloseHandle (hObject=0xdc) returned 1 [0256.765] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.766] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x26e8 [0256.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26f0) returned 0x2c8700 [0256.766] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x26e8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x26e8, lpOverlapped=0x0) returned 1 [0256.767] CloseHandle (hObject=0xdc) returned 1 [0256.767] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf")) returned 1 [0256.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.768] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.768] GetTickCount () returned 0x4f890 [0256.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.769] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776\\....\\temporaryfile")) returned 0 [0256.769] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776\\temporaryfile")) returned 1 [0256.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.771] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.771] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.771] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.771] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776\\temporaryfile")) returned 1 [0256.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.771] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.771] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776")) returned 1 [0256.772] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 0 [0256.772] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.772] WriteFile (in: hFile=0xdc, lpBuffer=0x2cae00*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cae00*, lpNumberOfBytesWritten=0x18fdd8*=0x26f0, lpOverlapped=0x0) returned 1 [0256.773] CloseHandle (hObject=0xdc) returned 1 [0256.773] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.775] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x312c [0256.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3134) returned 0x2c8700 [0256.775] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x312c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x312c, lpOverlapped=0x0) returned 1 [0256.776] CloseHandle (hObject=0xdc) returned 1 [0256.776] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf")) returned 1 [0256.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.777] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.777] GetTickCount () returned 0x4f890 [0256.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.778] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.778] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776\\....\\temporaryfile")) returned 0 [0256.778] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776\\temporaryfile")) returned 1 [0256.780] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.780] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.780] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.780] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.780] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.780] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.780] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.780] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776\\temporaryfile")) returned 1 [0256.780] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9dfe4aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9dfe4aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9dfe4aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.780] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.780] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325776" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325776")) returned 1 [0256.781] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF") returned 0 [0256.781] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.782] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb848*, nNumberOfBytesToWrite=0x3130, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb848*, lpNumberOfBytesWritten=0x18fdd8*=0x3130, lpOverlapped=0x0) returned 1 [0256.782] CloseHandle (hObject=0xdc) returned 1 [0256.783] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.783] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x975e [0256.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9766) returned 0x2c8700 [0256.783] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x975e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x975e, lpOverlapped=0x0) returned 1 [0256.785] CloseHandle (hObject=0xdc) returned 1 [0256.785] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf")) returned 1 [0256.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.786] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.786] GetTickCount () returned 0x4f8a0 [0256.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.787] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325792\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325792\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.787] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325792\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325792\\....\\temporaryfile")) returned 0 [0256.787] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325792\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325792\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325792\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325792\\temporaryfile")) returned 1 [0256.789] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325792\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e00ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e00ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e00ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.789] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e00ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e00ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e00ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.789] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e00ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e00ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e00ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.789] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325792\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e00ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e00ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e00ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.789] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e00ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e00ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e00ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.789] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e00ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e00ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e00ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.789] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325792\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325792\\temporaryfile")) returned 1 [0256.789] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e00ac00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e00ac00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e00ac00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.789] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325792" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325792")) returned 1 [0256.789] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF") returned 0 [0256.790] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.791] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1e78*, nNumberOfBytesToWrite=0x9768, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1e78*, lpNumberOfBytesWritten=0x18fdd8*=0x9768, lpOverlapped=0x0) returned 1 [0256.792] CloseHandle (hObject=0xdc) returned 1 [0256.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.793] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcec6 [0256.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcece) returned 0x2c8700 [0256.793] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xcec6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xcec6, lpOverlapped=0x0) returned 1 [0256.795] CloseHandle (hObject=0xdc) returned 1 [0256.795] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf")) returned 1 [0256.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.796] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.796] GetTickCount () returned 0x4f8b0 [0256.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.797] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.800] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808\\....\\temporaryfile")) returned 0 [0256.800] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808\\temporaryfile")) returned 1 [0256.801] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.801] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.802] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.802] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.802] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.802] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.802] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.802] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808\\temporaryfile")) returned 1 [0256.802] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.802] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.802] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808")) returned 1 [0256.802] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF") returned 0 [0256.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.804] WriteFile (in: hFile=0xdc, lpBuffer=0x2d55e0*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d55e0*, lpNumberOfBytesWritten=0x18fdd8*=0xced0, lpOverlapped=0x0) returned 1 [0256.805] CloseHandle (hObject=0xdc) returned 1 [0256.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.806] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4b40 [0256.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4b48) returned 0x2c8700 [0256.806] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4b40, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4b40, lpOverlapped=0x0) returned 1 [0256.807] CloseHandle (hObject=0xdc) returned 1 [0256.807] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf")) returned 1 [0256.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.808] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.808] GetTickCount () returned 0x4f8b0 [0256.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.808] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.809] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808\\....\\temporaryfile")) returned 0 [0256.810] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808\\temporaryfile")) returned 1 [0256.811] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.811] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.811] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.811] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.811] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.811] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.811] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.811] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808\\temporaryfile")) returned 1 [0256.812] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e030d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e030d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e030d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.812] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.812] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325808" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325808")) returned 1 [0256.812] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF") returned 0 [0256.812] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.813] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd258*, nNumberOfBytesToWrite=0x4b48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd258*, lpNumberOfBytesWritten=0x18fdd8*=0x4b48, lpOverlapped=0x0) returned 1 [0256.814] CloseHandle (hObject=0xdc) returned 1 [0256.814] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.815] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x80d4 [0256.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80dc) returned 0x2c8700 [0256.815] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x80d4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x80d4, lpOverlapped=0x0) returned 1 [0256.817] CloseHandle (hObject=0xdc) returned 1 [0256.817] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf")) returned 1 [0256.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.818] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.818] GetTickCount () returned 0x4f8bf [0256.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.819] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.819] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325823\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325823\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325823\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325823\\....\\temporaryfile")) returned 0 [0256.819] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325823\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325823\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325823\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325823\\temporaryfile")) returned 1 [0256.821] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325823\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e056ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e056ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e056ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.821] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e056ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e056ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e056ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.821] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e056ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e056ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e056ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.821] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325823\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e056ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e056ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e056ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.821] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e056ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e056ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e056ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.821] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e056ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e056ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e056ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.821] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.821] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325823\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325823\\temporaryfile")) returned 1 [0256.821] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e056ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e056ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e056ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.821] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.821] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325823" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325823")) returned 1 [0256.822] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF") returned 0 [0256.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.823] WriteFile (in: hFile=0xdc, lpBuffer=0x2d07f0*, nNumberOfBytesToWrite=0x80d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d07f0*, lpNumberOfBytesWritten=0x18fdd8*=0x80d8, lpOverlapped=0x0) returned 1 [0256.824] CloseHandle (hObject=0xdc) returned 1 [0256.824] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.825] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcba0 [0256.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcba8) returned 0x2c8700 [0256.825] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xcba0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xcba0, lpOverlapped=0x0) returned 1 [0256.826] CloseHandle (hObject=0xdc) returned 1 [0256.826] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf")) returned 1 [0256.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.827] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.828] GetTickCount () returned 0x4f8cf [0256.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.828] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839\\....\\temporaryfile")) returned 0 [0256.829] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839\\temporaryfile")) returned 1 [0256.830] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.830] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.830] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.830] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.830] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.830] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.830] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.830] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839\\temporaryfile")) returned 1 [0256.831] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.831] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.831] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839")) returned 1 [0256.831] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF") returned 0 [0256.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.832] WriteFile (in: hFile=0xdc, lpBuffer=0x2d52b8*, nNumberOfBytesToWrite=0xcba8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d52b8*, lpNumberOfBytesWritten=0x18fdd8*=0xcba8, lpOverlapped=0x0) returned 1 [0256.834] CloseHandle (hObject=0xdc) returned 1 [0256.834] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.834] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5700 [0256.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5708) returned 0x2c8700 [0256.835] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5700, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5700, lpOverlapped=0x0) returned 1 [0256.836] CloseHandle (hObject=0xdc) returned 1 [0256.836] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf")) returned 1 [0256.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.837] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.837] GetTickCount () returned 0x4f8cf [0256.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.838] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.838] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839\\....\\temporaryfile")) returned 0 [0256.838] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839\\temporaryfile")) returned 1 [0256.840] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.840] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.840] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.840] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.840] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.840] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.840] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.840] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839\\temporaryfile")) returned 1 [0256.840] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e07d020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e07d020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e07d020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.840] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.840] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325839" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325839")) returned 1 [0256.840] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF") returned 0 [0256.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.842] WriteFile (in: hFile=0xdc, lpBuffer=0x2cde18*, nNumberOfBytesToWrite=0x5708, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cde18*, lpNumberOfBytesWritten=0x18fdd8*=0x5708, lpOverlapped=0x0) returned 1 [0256.843] CloseHandle (hObject=0xdc) returned 1 [0256.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.843] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x60c2 [0256.843] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x60ca) returned 0x2c8700 [0256.844] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x60c2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x60c2, lpOverlapped=0x0) returned 1 [0256.846] CloseHandle (hObject=0xdc) returned 1 [0256.846] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf")) returned 1 [0256.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.847] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.847] GetTickCount () returned 0x4f8de [0256.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.847] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854\\....\\temporaryfile")) returned 0 [0256.848] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854\\temporaryfile")) returned 1 [0256.849] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.849] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.849] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.849] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.849] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.849] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.850] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854\\temporaryfile")) returned 1 [0256.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.850] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854")) returned 1 [0256.850] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF") returned 0 [0256.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.851] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce7e0*, nNumberOfBytesToWrite=0x60c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce7e0*, lpNumberOfBytesWritten=0x18fdd8*=0x60c8, lpOverlapped=0x0) returned 1 [0256.852] CloseHandle (hObject=0xdc) returned 1 [0256.852] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.853] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x51be [0256.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x51c6) returned 0x2c8700 [0256.853] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x51be, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x51be, lpOverlapped=0x0) returned 1 [0256.855] CloseHandle (hObject=0xdc) returned 1 [0256.855] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf")) returned 1 [0256.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.856] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.856] GetTickCount () returned 0x4f8de [0256.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.856] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854\\....\\temporaryfile")) returned 0 [0256.857] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854\\temporaryfile")) returned 1 [0256.858] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0c92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0c92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0c92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0c92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.858] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.859] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.859] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.859] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.859] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854\\temporaryfile")) returned 1 [0256.859] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0a3180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0a3180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0a3180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.859] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.859] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325854" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325854")) returned 1 [0256.859] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF") returned 0 [0256.860] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.860] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd8d8*, nNumberOfBytesToWrite=0x51c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd8d8*, lpNumberOfBytesWritten=0x18fdd8*=0x51c8, lpOverlapped=0x0) returned 1 [0256.862] CloseHandle (hObject=0xdc) returned 1 [0256.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.862] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x59a0 [0256.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x59a8) returned 0x2c8700 [0256.862] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x59a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x59a0, lpOverlapped=0x0) returned 1 [0256.864] CloseHandle (hObject=0xdc) returned 1 [0256.864] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf")) returned 1 [0256.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.865] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.865] GetTickCount () returned 0x4f8ee [0256.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.865] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325870\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325870\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325870\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325870\\....\\temporaryfile")) returned 0 [0256.866] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325870\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325870\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325870\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325870\\temporaryfile")) returned 1 [0256.867] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325870\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0c92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0c92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0c92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.867] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0c92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0c92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0c92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.868] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0c92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0c92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0c92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.868] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325870\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0c92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0c92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0c92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.868] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0c92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0c92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0c92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.868] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0c92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0c92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0c92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.868] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.868] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325870\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325870\\temporaryfile")) returned 1 [0256.868] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0c92e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0c92e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0c92e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.868] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.868] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325870" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325870")) returned 1 [0256.868] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF") returned 0 [0256.869] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.869] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce0b8*, nNumberOfBytesToWrite=0x59a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce0b8*, lpNumberOfBytesWritten=0x18fdd8*=0x59a8, lpOverlapped=0x0) returned 1 [0256.870] CloseHandle (hObject=0xdc) returned 1 [0256.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.871] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1334 [0256.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x133c) returned 0x25b528 [0256.871] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1334, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1334, lpOverlapped=0x0) returned 1 [0256.873] CloseHandle (hObject=0xdc) returned 1 [0256.873] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf")) returned 1 [0256.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.874] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.874] GetTickCount () returned 0x4f8fe [0256.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.874] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886\\....\\temporaryfile")) returned 0 [0256.875] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886\\temporaryfile")) returned 1 [0256.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.876] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.876] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.876] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.876] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.876] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.876] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886\\temporaryfile")) returned 1 [0256.876] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.877] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886")) returned 1 [0256.877] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF") returned 0 [0256.877] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.878] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1338, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1338, lpOverlapped=0x0) returned 1 [0256.878] CloseHandle (hObject=0xdc) returned 1 [0256.879] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.879] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d3c [0256.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d44) returned 0x2c8700 [0256.879] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1d3c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1d3c, lpOverlapped=0x0) returned 1 [0256.881] CloseHandle (hObject=0xdc) returned 1 [0256.881] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf")) returned 1 [0256.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.881] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.882] GetTickCount () returned 0x4f8fe [0256.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.882] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.883] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886\\....\\temporaryfile")) returned 0 [0256.883] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886\\temporaryfile")) returned 1 [0256.884] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.884] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.884] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.884] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.884] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.884] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.884] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.884] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886\\temporaryfile")) returned 1 [0256.885] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e0ef440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e0ef440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e0ef440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.885] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.885] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325886" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325886")) returned 1 [0256.885] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF") returned 0 [0256.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.886] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca458*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca458*, lpNumberOfBytesWritten=0x18fdd8*=0x1d40, lpOverlapped=0x0) returned 1 [0256.887] CloseHandle (hObject=0xdc) returned 1 [0256.887] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.887] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13b8 [0256.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13c0) returned 0x25b528 [0256.887] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13b8, lpOverlapped=0x0) returned 1 [0256.889] CloseHandle (hObject=0xdc) returned 1 [0256.889] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf")) returned 1 [0256.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.890] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.890] GetTickCount () returned 0x4f90d [0256.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.890] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901\\....\\temporaryfile")) returned 0 [0256.891] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901\\temporaryfile")) returned 1 [0256.892] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.892] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.893] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.893] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.893] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.893] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901\\temporaryfile")) returned 1 [0256.893] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.893] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.893] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901")) returned 1 [0256.893] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF") returned 0 [0256.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.894] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x13c0, lpOverlapped=0x0) returned 1 [0256.895] CloseHandle (hObject=0xdc) returned 1 [0256.895] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.896] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1284 [0256.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x128c) returned 0x25b528 [0256.896] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1284, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1284, lpOverlapped=0x0) returned 1 [0256.897] CloseHandle (hObject=0xdc) returned 1 [0256.897] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf")) returned 1 [0256.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.898] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.898] GetTickCount () returned 0x4f90d [0256.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.899] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901\\....\\temporaryfile")) returned 0 [0256.899] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901\\temporaryfile")) returned 1 [0256.901] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.901] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.901] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.901] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.901] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.901] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.901] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.901] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901\\temporaryfile")) returned 1 [0256.901] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1155a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1155a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1155a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.901] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.901] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325901" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325901")) returned 1 [0256.901] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF") returned 0 [0256.902] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.902] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1288, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1288, lpOverlapped=0x0) returned 1 [0256.903] CloseHandle (hObject=0xdc) returned 1 [0256.903] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.904] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16fc [0256.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1704) returned 0x2c4a70 [0256.904] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16fc, lpOverlapped=0x0) returned 1 [0256.906] CloseHandle (hObject=0xdc) returned 1 [0256.906] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf")) returned 1 [0256.906] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.906] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.907] GetTickCount () returned 0x4f91d [0256.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.907] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917\\....\\temporaryfile")) returned 0 [0256.908] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917\\temporaryfile")) returned 1 [0256.909] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.909] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.909] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.909] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.909] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.909] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917\\temporaryfile")) returned 1 [0256.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.909] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.910] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917")) returned 1 [0256.910] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF") returned 0 [0256.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.911] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1700, lpOverlapped=0x0) returned 1 [0256.911] CloseHandle (hObject=0xdc) returned 1 [0256.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.912] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1294 [0256.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x129c) returned 0x25b528 [0256.912] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1294, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1294, lpOverlapped=0x0) returned 1 [0256.913] CloseHandle (hObject=0xdc) returned 1 [0256.913] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf")) returned 1 [0256.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.914] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.914] GetTickCount () returned 0x4f91d [0256.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.915] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917\\....\\temporaryfile")) returned 0 [0256.916] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917\\temporaryfile")) returned 1 [0256.917] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.918] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.918] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.918] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.918] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917\\temporaryfile")) returned 1 [0256.918] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e13b700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e13b700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e13b700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.918] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325917" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325917")) returned 1 [0256.918] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF") returned 0 [0256.919] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.919] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1298, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1298, lpOverlapped=0x0) returned 1 [0256.920] CloseHandle (hObject=0xdc) returned 1 [0256.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.921] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1464 [0256.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x146c) returned 0x29b460 [0256.921] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1464, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1464, lpOverlapped=0x0) returned 1 [0256.923] CloseHandle (hObject=0xdc) returned 1 [0256.923] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf")) returned 1 [0256.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.924] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.924] GetTickCount () returned 0x4f92c [0256.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.925] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325932\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325932\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325932\\....\\temporaryfile")) returned 0 [0256.925] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325932\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325932\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325932\\temporaryfile")) returned 1 [0256.926] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325932\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e161860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e161860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e161860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e161860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e161860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e161860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e161860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e161860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e161860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325932\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e161860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e161860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e161860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.927] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e161860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e161860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e161860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.927] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e161860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e161860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e161860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.927] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.927] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325932\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325932\\temporaryfile")) returned 1 [0256.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e161860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e161860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e161860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.927] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.927] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325932" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325932")) returned 1 [0256.931] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF") returned 0 [0256.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.932] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1468, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1468, lpOverlapped=0x0) returned 1 [0256.932] CloseHandle (hObject=0xdc) returned 1 [0256.933] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.933] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8424 [0256.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x842c) returned 0x2c8700 [0256.933] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8424, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8424, lpOverlapped=0x0) returned 1 [0256.935] CloseHandle (hObject=0xdc) returned 1 [0256.935] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf")) returned 1 [0256.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.936] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.936] GetTickCount () returned 0x4f93c [0256.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.936] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948\\....\\temporaryfile")) returned 0 [0256.937] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948\\temporaryfile")) returned 1 [0256.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.938] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.938] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.938] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.938] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.939] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.939] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948\\temporaryfile")) returned 1 [0256.939] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.939] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.939] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948")) returned 1 [0256.939] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF") returned 0 [0256.940] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.940] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0b40*, nNumberOfBytesToWrite=0x8428, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0b40*, lpNumberOfBytesWritten=0x18fdd8*=0x8428, lpOverlapped=0x0) returned 1 [0256.941] CloseHandle (hObject=0xdc) returned 1 [0256.942] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.943] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1314 [0256.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x131c) returned 0x25b528 [0256.943] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1314, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1314, lpOverlapped=0x0) returned 1 [0256.944] CloseHandle (hObject=0xdc) returned 1 [0256.944] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf")) returned 1 [0256.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.945] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.945] GetTickCount () returned 0x4f93c [0256.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.946] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.946] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948\\....\\temporaryfile")) returned 0 [0256.946] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948\\temporaryfile")) returned 1 [0256.948] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.948] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.948] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.948] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.948] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.948] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.948] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.948] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948\\temporaryfile")) returned 1 [0256.948] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1879c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1879c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1879c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.948] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.948] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325948" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325948")) returned 1 [0256.949] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF") returned 0 [0256.949] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.949] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1318, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1318, lpOverlapped=0x0) returned 1 [0256.950] CloseHandle (hObject=0xdc) returned 1 [0256.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.951] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1418 [0256.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1420) returned 0x25b528 [0256.951] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1418, lpOverlapped=0x0) returned 1 [0256.953] CloseHandle (hObject=0xdc) returned 1 [0256.953] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf")) returned 1 [0256.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.953] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.954] GetTickCount () returned 0x4f94c [0256.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.954] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964\\....\\temporaryfile")) returned 0 [0256.955] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964\\temporaryfile")) returned 1 [0256.956] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.956] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.956] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.956] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.956] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.956] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.956] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.956] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964\\temporaryfile")) returned 1 [0256.956] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.957] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.957] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964")) returned 1 [0256.957] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF") returned 0 [0256.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.958] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1420, lpOverlapped=0x0) returned 1 [0256.958] CloseHandle (hObject=0xdc) returned 1 [0256.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.959] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1998 [0256.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19a0) returned 0x2c4a70 [0256.959] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1998, lpOverlapped=0x0) returned 1 [0256.961] CloseHandle (hObject=0xdc) returned 1 [0256.961] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf")) returned 1 [0256.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.962] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.962] GetTickCount () returned 0x4f94c [0256.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.962] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964\\....\\temporaryfile")) returned 0 [0256.963] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964\\temporaryfile")) returned 1 [0256.964] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.964] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.964] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.964] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.964] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.965] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.965] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.965] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964\\temporaryfile")) returned 1 [0256.965] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1adb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1adb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1adb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.965] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.965] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325964" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325964")) returned 1 [0256.965] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF") returned 0 [0256.965] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.966] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x19a0, lpOverlapped=0x0) returned 1 [0256.967] CloseHandle (hObject=0xdc) returned 1 [0256.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.968] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c40 [0256.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c48) returned 0x2c4a70 [0256.968] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1c40, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1c40, lpOverlapped=0x0) returned 1 [0256.969] CloseHandle (hObject=0xdc) returned 1 [0256.969] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf")) returned 1 [0256.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.970] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.970] GetTickCount () returned 0x4f95b [0256.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.970] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.971] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.971] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979\\....\\temporaryfile")) returned 0 [0256.971] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979\\temporaryfile")) returned 1 [0256.972] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.972] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.972] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.972] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.973] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.973] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.973] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.973] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979\\temporaryfile")) returned 1 [0256.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.973] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.973] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979")) returned 1 [0256.973] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF") returned 0 [0256.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.974] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1c48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1c48, lpOverlapped=0x0) returned 1 [0256.975] CloseHandle (hObject=0xdc) returned 1 [0256.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.976] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1bc8 [0256.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1bd0) returned 0x2c4a70 [0256.976] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1bc8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1bc8, lpOverlapped=0x0) returned 1 [0256.979] CloseHandle (hObject=0xdc) returned 1 [0256.979] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf")) returned 1 [0256.979] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.979] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.980] GetTickCount () returned 0x4f95b [0256.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.980] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979\\....\\temporaryfile")) returned 0 [0256.981] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979\\temporaryfile")) returned 1 [0256.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.982] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.982] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.983] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.983] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.983] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979\\temporaryfile")) returned 1 [0256.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1d3c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1d3c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1d3c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.983] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325979" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325979")) returned 1 [0256.983] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF") returned 0 [0256.983] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.984] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1bd0, lpOverlapped=0x0) returned 1 [0256.985] CloseHandle (hObject=0xdc) returned 1 [0256.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.986] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1348 [0256.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1350) returned 0x25b528 [0256.986] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1348, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1348, lpOverlapped=0x0) returned 1 [0256.988] CloseHandle (hObject=0xdc) returned 1 [0256.988] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf")) returned 1 [0256.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0256.989] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.989] GetTickCount () returned 0x4f96b [0256.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.990] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325995\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325995\\...."), lpSecurityAttributes=0x256210) returned 1 [0256.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325995\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325995\\....\\temporaryfile")) returned 0 [0256.990] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325995\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325995\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325995\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325995\\temporaryfile")) returned 1 [0256.992] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325995\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1f9de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1f9de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1f9de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0256.992] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1f9de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1f9de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1f9de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.992] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1f9de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1f9de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1f9de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0256.992] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325995\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1f9de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1f9de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1f9de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0256.992] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1f9de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1f9de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1f9de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0256.992] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1f9de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1f9de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1f9de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0256.992] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0256.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325995\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325995\\temporaryfile")) returned 1 [0256.992] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e1f9de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e1f9de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e1f9de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0256.992] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0256.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18325995" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18325995")) returned 1 [0256.993] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF") returned 0 [0256.993] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.993] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1350, lpOverlapped=0x0) returned 1 [0256.995] CloseHandle (hObject=0xdc) returned 1 [0256.995] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0256.995] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1720 [0256.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1728) returned 0x2c4a70 [0256.995] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1720, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1720, lpOverlapped=0x0) returned 1 [0256.997] CloseHandle (hObject=0xdc) returned 1 [0256.997] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf")) returned 1 [0256.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0256.998] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0256.998] GetTickCount () returned 0x4f97a [0256.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0256.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0256.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0256.998] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010\\...."), lpSecurityAttributes=0x256228) returned 1 [0256.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010\\....\\temporaryfile")) returned 0 [0256.999] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010\\temporaryfile")) returned 1 [0257.000] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.000] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.000] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.000] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.000] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.000] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.001] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.001] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010\\temporaryfile")) returned 1 [0257.001] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.001] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.001] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010")) returned 1 [0257.001] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF") returned 0 [0257.001] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.002] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1728, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1728, lpOverlapped=0x0) returned 1 [0257.003] CloseHandle (hObject=0xdc) returned 1 [0257.003] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.003] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x154c [0257.003] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1554) returned 0x29b460 [0257.003] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x154c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x154c, lpOverlapped=0x0) returned 1 [0257.005] CloseHandle (hObject=0xdc) returned 1 [0257.005] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf")) returned 1 [0257.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.006] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.006] GetTickCount () returned 0x4f97a [0257.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.006] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010\\....\\temporaryfile")) returned 0 [0257.007] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010\\temporaryfile")) returned 1 [0257.008] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.008] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.008] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.008] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.009] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.009] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.009] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.009] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010\\temporaryfile")) returned 1 [0257.009] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e21ff40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e21ff40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e21ff40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.009] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.009] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326010" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326010")) returned 1 [0257.009] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF") returned 0 [0257.009] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.010] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1550, lpOverlapped=0x0) returned 1 [0257.011] CloseHandle (hObject=0xdc) returned 1 [0257.011] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.012] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13e8 [0257.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13f0) returned 0x25b528 [0257.012] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13e8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13e8, lpOverlapped=0x0) returned 1 [0257.013] CloseHandle (hObject=0xdc) returned 1 [0257.013] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf")) returned 1 [0257.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.014] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.014] GetTickCount () returned 0x4f98a [0257.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.014] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026\\....\\temporaryfile")) returned 0 [0257.015] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026\\temporaryfile")) returned 1 [0257.016] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.016] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.016] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.016] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.016] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.017] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.017] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.017] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026\\temporaryfile")) returned 1 [0257.017] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.017] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.017] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026")) returned 1 [0257.017] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF") returned 0 [0257.017] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.018] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x13f0, lpOverlapped=0x0) returned 1 [0257.019] CloseHandle (hObject=0xdc) returned 1 [0257.019] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.020] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xda0 [0257.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xda8) returned 0x2350048 [0257.020] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xda0, lpOverlapped=0x0) returned 1 [0257.021] CloseHandle (hObject=0xdc) returned 1 [0257.021] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf")) returned 1 [0257.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.022] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.022] GetTickCount () returned 0x4f98a [0257.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.023] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026\\....\\temporaryfile")) returned 0 [0257.028] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026\\temporaryfile")) returned 1 [0257.029] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.029] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.029] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.029] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.029] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.029] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.029] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.029] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026\\temporaryfile")) returned 1 [0257.030] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2460a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2460a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2460a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.030] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.030] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326026" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326026")) returned 1 [0257.030] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF") returned 0 [0257.030] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.031] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xda8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xda8, lpOverlapped=0x0) returned 1 [0257.032] CloseHandle (hObject=0xdc) returned 1 [0257.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.032] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcd8 [0257.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xce0) returned 0x2350048 [0257.032] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xcd8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xcd8, lpOverlapped=0x0) returned 1 [0257.034] CloseHandle (hObject=0xdc) returned 1 [0257.034] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf")) returned 1 [0257.034] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.034] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.035] GetTickCount () returned 0x4f99a [0257.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.035] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042\\....\\temporaryfile")) returned 0 [0257.036] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042\\temporaryfile")) returned 1 [0257.037] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e26c200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e26c200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e26c200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.037] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e26c200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e26c200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e26c200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.037] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e26c200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e26c200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e26c200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.037] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e26c200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e26c200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e26c200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.037] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e26c200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e26c200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e26c200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.037] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e26c200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e26c200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e26c200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.037] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042\\temporaryfile")) returned 1 [0257.038] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e26c200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e26c200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e26c200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.038] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042")) returned 1 [0257.038] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF") returned 0 [0257.038] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.039] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xce0, lpOverlapped=0x0) returned 1 [0257.040] CloseHandle (hObject=0xdc) returned 1 [0257.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.041] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1df8 [0257.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e00) returned 0x2c8700 [0257.041] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1df8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1df8, lpOverlapped=0x0) returned 1 [0257.042] CloseHandle (hObject=0xdc) returned 1 [0257.042] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf")) returned 1 [0257.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.043] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.043] GetTickCount () returned 0x4f99a [0257.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.043] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.044] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042\\....\\temporaryfile")) returned 0 [0257.045] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042\\temporaryfile")) returned 1 [0257.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e26c200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.046] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e26c200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.046] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.046] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.046] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.046] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042\\temporaryfile")) returned 1 [0257.047] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.047] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326042" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326042")) returned 1 [0257.047] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF") returned 0 [0257.047] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.048] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca510*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca510*, lpNumberOfBytesWritten=0x18fdd8*=0x1e00, lpOverlapped=0x0) returned 1 [0257.049] CloseHandle (hObject=0xdc) returned 1 [0257.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.049] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa410 [0257.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa418) returned 0x2c8700 [0257.049] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa410, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa410, lpOverlapped=0x0) returned 1 [0257.051] CloseHandle (hObject=0xdc) returned 1 [0257.051] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf")) returned 1 [0257.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.052] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.052] GetTickCount () returned 0x4f9a9 [0257.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.053] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326057\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326057\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326057\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326057\\....\\temporaryfile")) returned 0 [0257.053] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326057\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326057\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326057\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326057\\temporaryfile")) returned 1 [0257.055] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326057\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.055] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326057\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.055] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.055] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.055] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.055] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326057\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326057\\temporaryfile")) returned 1 [0257.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e292360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e292360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e292360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.055] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.055] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326057" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326057")) returned 1 [0257.056] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF") returned 0 [0257.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.058] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2b28*, nNumberOfBytesToWrite=0xa418, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2b28*, lpNumberOfBytesWritten=0x18fdd8*=0xa418, lpOverlapped=0x0) returned 1 [0257.059] CloseHandle (hObject=0xdc) returned 1 [0257.059] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.061] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdc4 [0257.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdcc) returned 0x2350048 [0257.061] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xdc4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xdc4, lpOverlapped=0x0) returned 1 [0257.062] CloseHandle (hObject=0xdc) returned 1 [0257.062] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf")) returned 1 [0257.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.063] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.063] GetTickCount () returned 0x4f9b9 [0257.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.063] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.064] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.067] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073\\....\\temporaryfile")) returned 0 [0257.067] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073\\temporaryfile")) returned 1 [0257.068] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.069] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.069] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.069] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.069] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.069] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.069] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.069] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073\\temporaryfile")) returned 1 [0257.069] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.069] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.069] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073")) returned 1 [0257.069] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF") returned 0 [0257.070] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.070] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xdc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xdc8, lpOverlapped=0x0) returned 1 [0257.071] CloseHandle (hObject=0xdc) returned 1 [0257.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.072] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1476 [0257.072] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x147e) returned 0x29b460 [0257.072] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1476, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1476, lpOverlapped=0x0) returned 1 [0257.074] CloseHandle (hObject=0xdc) returned 1 [0257.074] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf")) returned 1 [0257.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.075] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.075] GetTickCount () returned 0x4f9b9 [0257.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.075] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073\\....\\temporaryfile")) returned 0 [0257.076] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073\\temporaryfile")) returned 1 [0257.077] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2de620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2de620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.077] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2de620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2de620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.077] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.077] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.078] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.078] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.078] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.078] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073\\temporaryfile")) returned 1 [0257.078] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2b84c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2b84c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2b84c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.078] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.078] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326073" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326073")) returned 1 [0257.078] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF") returned 0 [0257.078] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.079] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1480, lpOverlapped=0x0) returned 1 [0257.080] CloseHandle (hObject=0xdc) returned 1 [0257.080] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.081] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x92e [0257.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x936) returned 0x2350048 [0257.081] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x92e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x92e, lpOverlapped=0x0) returned 1 [0257.082] CloseHandle (hObject=0xdc) returned 1 [0257.083] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf")) returned 1 [0257.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.083] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.083] GetTickCount () returned 0x4f9c8 [0257.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.084] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326088\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326088\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.085] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326088\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326088\\....\\temporaryfile")) returned 0 [0257.085] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326088\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326088\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326088\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326088\\temporaryfile")) returned 1 [0257.086] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326088\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2de620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2de620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2de620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.086] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2de620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2de620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2de620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.086] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2de620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2de620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2de620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.086] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326088\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2de620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2de620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2de620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.086] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2de620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2de620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2de620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.086] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2de620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2de620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2de620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.086] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.086] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326088\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326088\\temporaryfile")) returned 1 [0257.087] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e2de620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e2de620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e2de620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.087] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.087] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326088" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326088")) returned 1 [0257.087] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF") returned 0 [0257.087] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.088] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x938, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x938, lpOverlapped=0x0) returned 1 [0257.089] CloseHandle (hObject=0xdc) returned 1 [0257.089] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.089] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa4e [0257.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa56) returned 0x2350048 [0257.089] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xa4e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xa4e, lpOverlapped=0x0) returned 1 [0257.091] CloseHandle (hObject=0xdc) returned 1 [0257.091] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf")) returned 1 [0257.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.091] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.092] GetTickCount () returned 0x4f9d8 [0257.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.092] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104\\....\\temporaryfile")) returned 0 [0257.093] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104\\temporaryfile")) returned 1 [0257.094] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.094] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.094] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.094] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.094] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104\\temporaryfile")) returned 1 [0257.095] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.095] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.095] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104")) returned 1 [0257.095] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF") returned 0 [0257.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.096] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xa58, lpOverlapped=0x0) returned 1 [0257.096] CloseHandle (hObject=0xdc) returned 1 [0257.097] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.097] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x926 [0257.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x92e) returned 0x2350048 [0257.097] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x926, lpOverlapped=0x0) returned 1 [0257.099] CloseHandle (hObject=0xdc) returned 1 [0257.099] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf")) returned 1 [0257.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.099] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.100] GetTickCount () returned 0x4f9d8 [0257.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.100] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104\\....\\temporaryfile")) returned 0 [0257.101] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104\\temporaryfile")) returned 1 [0257.102] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.102] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.102] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.102] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.102] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.102] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.102] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.102] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104\\temporaryfile")) returned 1 [0257.103] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e304780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e304780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e304780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.103] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.103] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326104" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326104")) returned 1 [0257.103] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF") returned 0 [0257.103] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.104] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x930, lpOverlapped=0x0) returned 1 [0257.104] CloseHandle (hObject=0xdc) returned 1 [0257.105] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.105] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xab2 [0257.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaba) returned 0x2350048 [0257.105] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xab2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xab2, lpOverlapped=0x0) returned 1 [0257.107] CloseHandle (hObject=0xdc) returned 1 [0257.107] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf")) returned 1 [0257.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.108] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.108] GetTickCount () returned 0x4f9e8 [0257.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.109] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.109] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120\\....\\temporaryfile")) returned 0 [0257.109] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120\\temporaryfile")) returned 1 [0257.111] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.111] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.111] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.111] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.111] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.111] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.111] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.111] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120\\temporaryfile")) returned 1 [0257.111] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.111] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.111] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120")) returned 1 [0257.111] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF") returned 0 [0257.112] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.112] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xab8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xab8, lpOverlapped=0x0) returned 1 [0257.113] CloseHandle (hObject=0xdc) returned 1 [0257.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.114] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x82a [0257.114] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x832) returned 0x2350048 [0257.114] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x82a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x82a, lpOverlapped=0x0) returned 1 [0257.115] CloseHandle (hObject=0xdc) returned 1 [0257.115] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf")) returned 1 [0257.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.116] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.116] GetTickCount () returned 0x4f9e8 [0257.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.117] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120\\....\\temporaryfile")) returned 0 [0257.118] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120\\temporaryfile")) returned 1 [0257.119] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.119] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.119] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.119] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.119] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.119] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.119] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.119] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120\\temporaryfile")) returned 1 [0257.119] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e32a8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e32a8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e32a8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.119] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.120] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326120" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326120")) returned 1 [0257.120] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF") returned 0 [0257.120] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.121] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x830, lpOverlapped=0x0) returned 1 [0257.122] CloseHandle (hObject=0xdc) returned 1 [0257.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.123] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcbe [0257.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcc6) returned 0x2350048 [0257.123] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xcbe, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xcbe, lpOverlapped=0x0) returned 1 [0257.124] CloseHandle (hObject=0xdc) returned 1 [0257.124] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf")) returned 1 [0257.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.125] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.126] GetTickCount () returned 0x4f9f7 [0257.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.126] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135\\....\\temporaryfile")) returned 0 [0257.127] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135\\temporaryfile")) returned 1 [0257.128] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.128] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.128] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.128] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.128] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.128] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.128] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.128] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135\\temporaryfile")) returned 1 [0257.128] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.128] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.129] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135")) returned 1 [0257.129] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF") returned 0 [0257.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.130] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xcc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xcc8, lpOverlapped=0x0) returned 1 [0257.130] CloseHandle (hObject=0xdc) returned 1 [0257.131] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.131] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7b2 [0257.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ba) returned 0x2350048 [0257.131] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7b2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7b2, lpOverlapped=0x0) returned 1 [0257.132] CloseHandle (hObject=0xdc) returned 1 [0257.132] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf")) returned 1 [0257.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.133] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.133] GetTickCount () returned 0x4f9f7 [0257.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.134] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135\\....\\temporaryfile")) returned 0 [0257.135] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135\\temporaryfile")) returned 1 [0257.136] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.136] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.136] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.136] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.136] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.136] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.136] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.136] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135\\temporaryfile")) returned 1 [0257.136] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e350a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e350a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e350a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.137] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.137] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326135" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326135")) returned 1 [0257.137] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF") returned 0 [0257.137] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.138] WriteFile (in: hFile=0xdc, lpBuffer=0x2350818*, nNumberOfBytesToWrite=0x7b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350818*, lpNumberOfBytesWritten=0x18fdd8*=0x7b8, lpOverlapped=0x0) returned 1 [0257.139] CloseHandle (hObject=0xdc) returned 1 [0257.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.139] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7938 [0257.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7940) returned 0x2c8700 [0257.139] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7938, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7938, lpOverlapped=0x0) returned 1 [0257.141] CloseHandle (hObject=0xdc) returned 1 [0257.141] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf")) returned 1 [0257.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.142] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.142] GetTickCount () returned 0x4fa07 [0257.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.142] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.143] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151\\....\\temporaryfile")) returned 0 [0257.143] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151\\temporaryfile")) returned 1 [0257.144] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.144] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.144] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.144] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.144] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.144] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.144] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.145] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151\\temporaryfile")) returned 1 [0257.145] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.145] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.145] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151")) returned 1 [0257.145] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF") returned 0 [0257.146] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.146] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0050*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0050*, lpNumberOfBytesWritten=0x18fdd8*=0x7940, lpOverlapped=0x0) returned 1 [0257.147] CloseHandle (hObject=0xdc) returned 1 [0257.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.148] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6958 [0257.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6960) returned 0x2c8700 [0257.148] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6958, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6958, lpOverlapped=0x0) returned 1 [0257.149] CloseHandle (hObject=0xdc) returned 1 [0257.150] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf")) returned 1 [0257.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.151] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.151] GetTickCount () returned 0x4fa07 [0257.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.151] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151\\....\\temporaryfile")) returned 0 [0257.152] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151\\temporaryfile")) returned 1 [0257.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.153] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.153] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.154] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.154] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151\\temporaryfile")) returned 1 [0257.154] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e376ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e376ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e376ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.154] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.154] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326151" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326151")) returned 1 [0257.154] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF") returned 0 [0257.155] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.155] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf070*, nNumberOfBytesToWrite=0x6960, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf070*, lpNumberOfBytesWritten=0x18fdd8*=0x6960, lpOverlapped=0x0) returned 1 [0257.157] CloseHandle (hObject=0xdc) returned 1 [0257.157] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.158] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1100c [0257.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11014) returned 0x2c8700 [0257.158] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1100c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1100c, lpOverlapped=0x0) returned 1 [0257.159] CloseHandle (hObject=0xdc) returned 1 [0257.160] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf")) returned 1 [0257.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.161] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.161] GetTickCount () returned 0x4fa16 [0257.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.162] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326166\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326166\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326166\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326166\\....\\temporaryfile")) returned 0 [0257.162] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326166\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326166\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326166\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326166\\temporaryfile")) returned 1 [0257.163] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326166\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e39cd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e39cd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e39cd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.164] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e39cd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e39cd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e39cd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.164] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e39cd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e39cd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e39cd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.164] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326166\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e39cd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e39cd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e39cd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e39cd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e39cd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e39cd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e39cd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e39cd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e39cd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.164] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.164] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326166\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326166\\temporaryfile")) returned 1 [0257.164] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e39cd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e39cd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e39cd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.164] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.164] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326166" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326166")) returned 1 [0257.164] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF") returned 0 [0257.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.166] WriteFile (in: hFile=0xdc, lpBuffer=0x2d9728*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d9728*, lpNumberOfBytesWritten=0x18fdd8*=0x11010, lpOverlapped=0x0) returned 1 [0257.168] CloseHandle (hObject=0xdc) returned 1 [0257.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.169] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xae2 [0257.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaea) returned 0x2350048 [0257.169] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xae2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xae2, lpOverlapped=0x0) returned 1 [0257.171] CloseHandle (hObject=0xdc) returned 1 [0257.171] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf")) returned 1 [0257.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.172] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.172] GetTickCount () returned 0x4fa26 [0257.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.172] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182\\....\\temporaryfile")) returned 0 [0257.173] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182\\temporaryfile")) returned 1 [0257.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.174] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.174] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.174] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.175] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182\\temporaryfile")) returned 1 [0257.175] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.175] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.175] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182")) returned 1 [0257.175] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF") returned 0 [0257.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.176] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xae8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xae8, lpOverlapped=0x0) returned 1 [0257.177] CloseHandle (hObject=0xdc) returned 1 [0257.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.177] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf56 [0257.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf5e) returned 0x2350048 [0257.177] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xf56, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xf56, lpOverlapped=0x0) returned 1 [0257.179] CloseHandle (hObject=0xdc) returned 1 [0257.179] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf")) returned 1 [0257.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.180] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.180] GetTickCount () returned 0x4fa26 [0257.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.180] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182\\....\\temporaryfile")) returned 0 [0257.181] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182\\temporaryfile")) returned 1 [0257.182] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.182] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.183] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.183] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182\\temporaryfile")) returned 1 [0257.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3c2e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3c2e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3c2e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.183] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.183] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326182" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326182")) returned 1 [0257.183] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF") returned 0 [0257.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.184] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xf60, lpOverlapped=0x0) returned 1 [0257.185] CloseHandle (hObject=0xdc) returned 1 [0257.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.186] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf6a [0257.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf72) returned 0x2b4a88 [0257.186] ReadFile (in: hFile=0xdc, lpBuffer=0x2b4a90, nNumberOfBytesToRead=0xf6a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2b4a90*, lpNumberOfBytesRead=0x18fdf0*=0xf6a, lpOverlapped=0x0) returned 1 [0257.187] CloseHandle (hObject=0xdc) returned 1 [0257.187] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf")) returned 1 [0257.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.188] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.188] GetTickCount () returned 0x4fa36 [0257.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.189] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326198\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326198\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326198\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326198\\....\\temporaryfile")) returned 0 [0257.190] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326198\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326198\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326198\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326198\\temporaryfile")) returned 1 [0257.191] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326198\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3e8fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3e8fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3e8fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.191] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3e8fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3e8fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3e8fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.191] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3e8fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3e8fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3e8fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.191] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326198\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3e8fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3e8fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3e8fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.191] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3e8fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3e8fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3e8fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.191] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3e8fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3e8fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3e8fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.191] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.191] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326198\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326198\\temporaryfile")) returned 1 [0257.192] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e3e8fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e3e8fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e3e8fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.192] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.192] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326198" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326198")) returned 1 [0257.195] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF") returned 0 [0257.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.196] WriteFile (in: hFile=0xdc, lpBuffer=0x2b5a18*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2b5a18*, lpNumberOfBytesWritten=0x18fdd8*=0xf70, lpOverlapped=0x0) returned 1 [0257.197] CloseHandle (hObject=0xdc) returned 1 [0257.197] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.198] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4330 [0257.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4338) returned 0x2c8700 [0257.198] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4330, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4330, lpOverlapped=0x0) returned 1 [0257.207] CloseHandle (hObject=0xdc) returned 1 [0257.207] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf")) returned 1 [0257.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.208] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.208] GetTickCount () returned 0x4fa45 [0257.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.209] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326213\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326213\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326213\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326213\\....\\temporaryfile")) returned 0 [0257.210] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326213\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326213\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326213\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326213\\temporaryfile")) returned 1 [0257.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326213\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e40f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e40f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e40f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e40f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e40f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e40f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.211] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e40f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e40f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e40f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326213\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e40f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e40f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e40f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.212] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e40f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e40f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e40f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.212] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e40f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e40f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e40f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.212] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326213\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326213\\temporaryfile")) returned 1 [0257.212] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e40f120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e40f120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e40f120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.212] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.212] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326213" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326213")) returned 1 [0257.212] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF") returned 0 [0257.213] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.214] WriteFile (in: hFile=0xdc, lpBuffer=0x2cca48*, nNumberOfBytesToWrite=0x4338, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cca48*, lpNumberOfBytesWritten=0x18fdd8*=0x4338, lpOverlapped=0x0) returned 1 [0257.215] CloseHandle (hObject=0xdc) returned 1 [0257.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.216] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x11dee [0257.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11df6) returned 0x2c8700 [0257.216] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x11dee, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x11dee, lpOverlapped=0x0) returned 1 [0257.217] CloseHandle (hObject=0xdc) returned 1 [0257.217] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf")) returned 1 [0257.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.219] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.219] GetTickCount () returned 0x4fa55 [0257.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.219] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229\\....\\temporaryfile")) returned 0 [0257.220] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229\\temporaryfile")) returned 1 [0257.221] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.221] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.222] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.222] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.222] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.222] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.222] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.222] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229\\temporaryfile")) returned 1 [0257.222] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.222] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.222] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229")) returned 1 [0257.222] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF") returned 0 [0257.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.224] WriteFile (in: hFile=0xdc, lpBuffer=0x2da508*, nNumberOfBytesToWrite=0x11df8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2da508*, lpNumberOfBytesWritten=0x18fdd8*=0x11df8, lpOverlapped=0x0) returned 1 [0257.226] CloseHandle (hObject=0xdc) returned 1 [0257.226] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.227] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x94c4 [0257.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x94cc) returned 0x2c8700 [0257.227] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x94c4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x94c4, lpOverlapped=0x0) returned 1 [0257.228] CloseHandle (hObject=0xdc) returned 1 [0257.228] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf")) returned 1 [0257.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.229] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.229] GetTickCount () returned 0x4fa55 [0257.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.230] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229\\....\\temporaryfile")) returned 0 [0257.231] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229\\temporaryfile")) returned 1 [0257.233] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e45b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e45b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.233] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e45b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e45b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.233] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.233] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.233] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.233] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.233] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.233] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229\\temporaryfile")) returned 1 [0257.233] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e435280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e435280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e435280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.233] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.233] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326229" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326229")) returned 1 [0257.234] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF") returned 0 [0257.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.235] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1be0*, nNumberOfBytesToWrite=0x94c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1be0*, lpNumberOfBytesWritten=0x18fdd8*=0x94c8, lpOverlapped=0x0) returned 1 [0257.236] CloseHandle (hObject=0xdc) returned 1 [0257.236] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.237] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb5b4 [0257.237] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb5bc) returned 0x2c8700 [0257.237] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb5b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb5b4, lpOverlapped=0x0) returned 1 [0257.239] CloseHandle (hObject=0xdc) returned 1 [0257.239] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf")) returned 1 [0257.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.240] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.240] GetTickCount () returned 0x4fa64 [0257.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.240] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326244\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326244\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.241] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326244\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326244\\....\\temporaryfile")) returned 0 [0257.241] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326244\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326244\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326244\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326244\\temporaryfile")) returned 1 [0257.242] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326244\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e45b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e45b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e45b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.242] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e45b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e45b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e45b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.243] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e45b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e45b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e45b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.243] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326244\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e45b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e45b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e45b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.243] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e45b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e45b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e45b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.243] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e45b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e45b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e45b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.243] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326244\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326244\\temporaryfile")) returned 1 [0257.243] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e45b3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e45b3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e45b3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.243] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.243] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326244" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326244")) returned 1 [0257.243] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF") returned 0 [0257.244] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.245] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3cd0*, nNumberOfBytesToWrite=0xb5b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3cd0*, lpNumberOfBytesWritten=0x18fdd8*=0xb5b8, lpOverlapped=0x0) returned 1 [0257.246] CloseHandle (hObject=0xdc) returned 1 [0257.246] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.247] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x31dc [0257.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x31e4) returned 0x2c8700 [0257.248] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x31dc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x31dc, lpOverlapped=0x0) returned 1 [0257.249] CloseHandle (hObject=0xdc) returned 1 [0257.249] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf")) returned 1 [0257.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.250] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.250] GetTickCount () returned 0x4fa74 [0257.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.251] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260\\....\\temporaryfile")) returned 0 [0257.251] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260\\temporaryfile")) returned 1 [0257.252] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.253] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.253] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.253] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.253] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.253] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.253] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.253] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260\\temporaryfile")) returned 1 [0257.253] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.253] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.253] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260")) returned 1 [0257.253] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF") returned 0 [0257.254] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.254] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb8f8*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb8f8*, lpNumberOfBytesWritten=0x18fdd8*=0x31e0, lpOverlapped=0x0) returned 1 [0257.255] CloseHandle (hObject=0xdc) returned 1 [0257.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.256] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3854 [0257.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x385c) returned 0x2c8700 [0257.256] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3854, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3854, lpOverlapped=0x0) returned 1 [0257.258] CloseHandle (hObject=0xdc) returned 1 [0257.258] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf")) returned 1 [0257.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.259] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.259] GetTickCount () returned 0x4fa74 [0257.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.260] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.260] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260\\....\\temporaryfile")) returned 0 [0257.261] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260\\temporaryfile")) returned 1 [0257.262] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.262] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.262] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.262] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.262] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.262] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.262] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260\\temporaryfile")) returned 1 [0257.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e481540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e481540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e481540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.263] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326260" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326260")) returned 1 [0257.263] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF") returned 0 [0257.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.264] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbf70*, nNumberOfBytesToWrite=0x3858, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbf70*, lpNumberOfBytesWritten=0x18fdd8*=0x3858, lpOverlapped=0x0) returned 1 [0257.265] CloseHandle (hObject=0xdc) returned 1 [0257.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.266] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2e88 [0257.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e90) returned 0x2c8700 [0257.266] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2e88, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2e88, lpOverlapped=0x0) returned 1 [0257.267] CloseHandle (hObject=0xdc) returned 1 [0257.267] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf")) returned 1 [0257.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.268] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.268] GetTickCount () returned 0x4fa84 [0257.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.269] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.269] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276\\....\\temporaryfile")) returned 0 [0257.270] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276\\temporaryfile")) returned 1 [0257.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4a76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4a76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4a76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.271] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4a76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4a76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4a76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.271] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4a76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4a76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4a76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4a76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4a76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4a76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.271] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4a76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4a76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4a76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.271] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4a76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4a76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4a76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.271] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276\\temporaryfile")) returned 1 [0257.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4a76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4a76a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4a76a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.272] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276")) returned 1 [0257.272] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF") returned 0 [0257.272] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.273] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb5a0*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb5a0*, lpNumberOfBytesWritten=0x18fdd8*=0x2e90, lpOverlapped=0x0) returned 1 [0257.274] CloseHandle (hObject=0xdc) returned 1 [0257.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.275] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30f2 [0257.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30fa) returned 0x2c8700 [0257.275] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x30f2, lpOverlapped=0x0) returned 1 [0257.276] CloseHandle (hObject=0xdc) returned 1 [0257.276] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf")) returned 1 [0257.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.277] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.277] GetTickCount () returned 0x4fa84 [0257.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.278] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276\\....\\temporaryfile")) returned 0 [0257.279] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276\\temporaryfile")) returned 1 [0257.280] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4a76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.280] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4a76a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.280] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.280] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.280] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.280] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.280] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.280] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276\\temporaryfile")) returned 1 [0257.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.281] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.281] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326276" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326276")) returned 1 [0257.281] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF") returned 0 [0257.281] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.282] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb810*, nNumberOfBytesToWrite=0x30f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb810*, lpNumberOfBytesWritten=0x18fdd8*=0x30f8, lpOverlapped=0x0) returned 1 [0257.283] CloseHandle (hObject=0xdc) returned 1 [0257.283] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.283] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3c9e [0257.284] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ca6) returned 0x2c8700 [0257.284] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3c9e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3c9e, lpOverlapped=0x0) returned 1 [0257.285] CloseHandle (hObject=0xdc) returned 1 [0257.285] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf")) returned 1 [0257.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.286] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.286] GetTickCount () returned 0x4fa93 [0257.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.287] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326291\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326291\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326291\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326291\\....\\temporaryfile")) returned 0 [0257.287] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326291\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326291\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326291\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326291\\temporaryfile")) returned 1 [0257.289] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326291\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.289] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.289] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.289] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326291\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.289] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.289] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.289] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.289] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326291\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326291\\temporaryfile")) returned 1 [0257.289] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e4cd800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e4cd800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e4cd800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.289] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.289] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326291" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326291")) returned 1 [0257.289] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF") returned 0 [0257.290] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.290] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc3b8*, nNumberOfBytesToWrite=0x3ca8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc3b8*, lpNumberOfBytesWritten=0x18fdd8*=0x3ca8, lpOverlapped=0x0) returned 1 [0257.291] CloseHandle (hObject=0xdc) returned 1 [0257.292] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.293] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8166 [0257.293] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x816e) returned 0x2c8700 [0257.293] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8166, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8166, lpOverlapped=0x0) returned 1 [0257.303] CloseHandle (hObject=0xdc) returned 1 [0257.315] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf")) returned 1 [0257.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.334] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.334] GetTickCount () returned 0x4fac2 [0257.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.335] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326338\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326338\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.335] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326338\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326338\\....\\temporaryfile")) returned 0 [0257.335] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326338\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326338\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326338\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326338\\temporaryfile")) returned 1 [0257.337] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326338\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e53fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e53fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e53fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.337] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e53fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e53fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e53fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.337] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e53fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e53fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e53fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.337] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326338\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e53fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e53fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e53fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.337] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e53fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e53fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e53fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.337] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e53fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e53fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e53fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.337] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.337] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326338\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326338\\temporaryfile")) returned 1 [0257.338] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e53fc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e53fc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e53fc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.338] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.338] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326338" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326338")) returned 1 [0257.338] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF") returned 0 [0257.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.340] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0880*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0880*, lpNumberOfBytesWritten=0x18fdd8*=0x8170, lpOverlapped=0x0) returned 1 [0257.341] CloseHandle (hObject=0xdc) returned 1 [0257.341] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.342] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3700 [0257.342] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3708) returned 0x2c8700 [0257.342] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3700, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3700, lpOverlapped=0x0) returned 1 [0257.344] CloseHandle (hObject=0xdc) returned 1 [0257.344] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf")) returned 1 [0257.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.345] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.345] GetTickCount () returned 0x4fad2 [0257.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.345] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326354\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326354\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326354\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326354\\....\\temporaryfile")) returned 0 [0257.346] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326354\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326354\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326354\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326354\\temporaryfile")) returned 1 [0257.348] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326354\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e565d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e565d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e565d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.348] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e565d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e565d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e565d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.348] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e565d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e565d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e565d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.348] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326354\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e565d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e565d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e565d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.348] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e565d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e565d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e565d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.348] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e565d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e565d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e565d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.348] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.348] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326354\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326354\\temporaryfile")) returned 1 [0257.348] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e565d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e565d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e565d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.348] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.348] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326354" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326354")) returned 1 [0257.349] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF") returned 0 [0257.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.353] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbe18*, nNumberOfBytesToWrite=0x3708, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbe18*, lpNumberOfBytesWritten=0x18fdd8*=0x3708, lpOverlapped=0x0) returned 1 [0257.354] CloseHandle (hObject=0xdc) returned 1 [0257.354] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.355] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x388a [0257.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3892) returned 0x2c8700 [0257.355] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x388a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x388a, lpOverlapped=0x0) returned 1 [0257.357] CloseHandle (hObject=0xdc) returned 1 [0257.357] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf")) returned 1 [0257.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.358] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.358] GetTickCount () returned 0x4fae1 [0257.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.359] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369\\....\\temporaryfile")) returned 0 [0257.359] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369\\temporaryfile")) returned 1 [0257.361] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.361] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.361] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.361] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.361] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.361] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.361] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.361] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369\\temporaryfile")) returned 1 [0257.361] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.361] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.361] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369")) returned 1 [0257.362] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF") returned 0 [0257.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.363] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbfa8*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbfa8*, lpNumberOfBytesWritten=0x18fdd8*=0x3890, lpOverlapped=0x0) returned 1 [0257.364] CloseHandle (hObject=0xdc) returned 1 [0257.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.365] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2440 [0257.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2448) returned 0x2c8700 [0257.365] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2440, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2440, lpOverlapped=0x0) returned 1 [0257.366] CloseHandle (hObject=0xdc) returned 1 [0257.366] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf")) returned 1 [0257.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.367] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.367] GetTickCount () returned 0x4fae1 [0257.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.368] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369\\....\\temporaryfile")) returned 0 [0257.368] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369\\temporaryfile")) returned 1 [0257.370] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.370] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.370] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.370] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.370] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.370] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.370] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.370] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369\\temporaryfile")) returned 1 [0257.371] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e58bee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e58bee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e58bee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.371] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.371] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326369" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326369")) returned 1 [0257.371] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF") returned 0 [0257.371] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.372] WriteFile (in: hFile=0xdc, lpBuffer=0x2cab58*, nNumberOfBytesToWrite=0x2448, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cab58*, lpNumberOfBytesWritten=0x18fdd8*=0x2448, lpOverlapped=0x0) returned 1 [0257.373] CloseHandle (hObject=0xdc) returned 1 [0257.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.374] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x795c [0257.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7964) returned 0x2c8700 [0257.374] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x795c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x795c, lpOverlapped=0x0) returned 1 [0257.376] CloseHandle (hObject=0xdc) returned 1 [0257.376] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf")) returned 1 [0257.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.377] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.377] GetTickCount () returned 0x4faf1 [0257.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.377] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326385\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326385\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326385\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326385\\....\\temporaryfile")) returned 0 [0257.378] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326385\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326385\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326385\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326385\\temporaryfile")) returned 1 [0257.379] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326385\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5b2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5b2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5b2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5b2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5b2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5b2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5b2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5b2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5b2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326385\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5b2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5b2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5b2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5b2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5b2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5b2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5b2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5b2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5b2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.380] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326385\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326385\\temporaryfile")) returned 1 [0257.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5b2040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5b2040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5b2040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.380] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326385" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326385")) returned 1 [0257.380] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF") returned 0 [0257.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.386] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0078*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0078*, lpNumberOfBytesWritten=0x18fdd8*=0x7960, lpOverlapped=0x0) returned 1 [0257.387] CloseHandle (hObject=0xdc) returned 1 [0257.388] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.389] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x523e [0257.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5246) returned 0x2c8700 [0257.389] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x523e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x523e, lpOverlapped=0x0) returned 1 [0257.391] CloseHandle (hObject=0xdc) returned 1 [0257.391] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf")) returned 1 [0257.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.392] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.392] GetTickCount () returned 0x4fb00 [0257.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.392] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400\\....\\temporaryfile")) returned 0 [0257.393] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400\\temporaryfile")) returned 1 [0257.394] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.394] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.394] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.395] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.395] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.395] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.395] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.395] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400\\temporaryfile")) returned 1 [0257.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.395] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.395] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400")) returned 1 [0257.395] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF") returned 0 [0257.396] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.397] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd958*, nNumberOfBytesToWrite=0x5248, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd958*, lpNumberOfBytesWritten=0x18fdd8*=0x5248, lpOverlapped=0x0) returned 1 [0257.398] CloseHandle (hObject=0xdc) returned 1 [0257.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.398] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2eb4 [0257.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ebc) returned 0x2c8700 [0257.399] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2eb4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2eb4, lpOverlapped=0x0) returned 1 [0257.401] CloseHandle (hObject=0xdc) returned 1 [0257.401] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf")) returned 1 [0257.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.402] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.402] GetTickCount () returned 0x4fb00 [0257.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.402] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400\\....\\temporaryfile")) returned 0 [0257.403] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400\\temporaryfile")) returned 1 [0257.405] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5fe300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5fe300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.405] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5fe300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5fe300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.405] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.405] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.405] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.405] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.405] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.405] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400\\temporaryfile")) returned 1 [0257.405] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5d81a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5d81a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5d81a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.405] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.405] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326400" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326400")) returned 1 [0257.405] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF") returned 0 [0257.406] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.406] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb5d0*, nNumberOfBytesToWrite=0x2eb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb5d0*, lpNumberOfBytesWritten=0x18fdd8*=0x2eb8, lpOverlapped=0x0) returned 1 [0257.407] CloseHandle (hObject=0xdc) returned 1 [0257.408] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.408] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3550 [0257.408] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3558) returned 0x2c8700 [0257.408] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3550, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3550, lpOverlapped=0x0) returned 1 [0257.410] CloseHandle (hObject=0xdc) returned 1 [0257.410] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf")) returned 1 [0257.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.411] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.411] GetTickCount () returned 0x4fb10 [0257.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.411] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326416\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326416\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326416\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326416\\....\\temporaryfile")) returned 0 [0257.412] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326416\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326416\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326416\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326416\\temporaryfile")) returned 1 [0257.413] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326416\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5fe300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5fe300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5fe300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5fe300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5fe300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5fe300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5fe300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5fe300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5fe300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.414] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326416\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5fe300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5fe300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5fe300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.414] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5fe300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5fe300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5fe300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.414] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5fe300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5fe300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5fe300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.414] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.414] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326416\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326416\\temporaryfile")) returned 1 [0257.414] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e5fe300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e5fe300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e5fe300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.414] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.414] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326416" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326416")) returned 1 [0257.414] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF") returned 0 [0257.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.415] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbc68*, nNumberOfBytesToWrite=0x3558, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbc68*, lpNumberOfBytesWritten=0x18fdd8*=0x3558, lpOverlapped=0x0) returned 1 [0257.416] CloseHandle (hObject=0xdc) returned 1 [0257.416] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.417] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x23f4 [0257.418] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23fc) returned 0x2c8700 [0257.418] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x23f4, lpOverlapped=0x0) returned 1 [0257.419] CloseHandle (hObject=0xdc) returned 1 [0257.419] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf")) returned 1 [0257.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.420] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.420] GetTickCount () returned 0x4fb20 [0257.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.421] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.421] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432\\....\\temporaryfile")) returned 0 [0257.421] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432\\temporaryfile")) returned 1 [0257.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.423] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.423] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.423] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.423] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.423] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432\\temporaryfile")) returned 1 [0257.423] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.423] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.423] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432")) returned 1 [0257.423] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF") returned 0 [0257.424] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.424] WriteFile (in: hFile=0xdc, lpBuffer=0x2cab10*, nNumberOfBytesToWrite=0x23f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cab10*, lpNumberOfBytesWritten=0x18fdd8*=0x23f8, lpOverlapped=0x0) returned 1 [0257.425] CloseHandle (hObject=0xdc) returned 1 [0257.426] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.426] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2210 [0257.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2218) returned 0x2c8700 [0257.426] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2210, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2210, lpOverlapped=0x0) returned 1 [0257.429] CloseHandle (hObject=0xdc) returned 1 [0257.429] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf")) returned 1 [0257.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.430] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.430] GetTickCount () returned 0x4fb20 [0257.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.430] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.431] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432\\....\\temporaryfile")) returned 0 [0257.431] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432\\temporaryfile")) returned 1 [0257.433] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.433] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.433] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.433] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.433] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.433] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.433] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.433] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432\\temporaryfile")) returned 1 [0257.433] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e624460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e624460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e624460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.433] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.433] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326432" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326432")) returned 1 [0257.433] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF") returned 0 [0257.434] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.435] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca928*, nNumberOfBytesToWrite=0x2218, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca928*, lpNumberOfBytesWritten=0x18fdd8*=0x2218, lpOverlapped=0x0) returned 1 [0257.436] CloseHandle (hObject=0xdc) returned 1 [0257.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.437] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x21a0 [0257.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x21a8) returned 0x2c8700 [0257.437] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x21a0, lpOverlapped=0x0) returned 1 [0257.439] CloseHandle (hObject=0xdc) returned 1 [0257.439] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf")) returned 1 [0257.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.440] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.440] GetTickCount () returned 0x4fb2f [0257.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.440] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447\\....\\temporaryfile")) returned 0 [0257.441] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447\\temporaryfile")) returned 1 [0257.442] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e64a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e64a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e64a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.442] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e64a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e64a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e64a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.442] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e64a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e64a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e64a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.442] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e64a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e64a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e64a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.442] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e64a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e64a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e64a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.443] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e64a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e64a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e64a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.443] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.443] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447\\temporaryfile")) returned 1 [0257.443] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e64a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e64a5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e64a5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.443] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.443] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447")) returned 1 [0257.443] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF") returned 0 [0257.443] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.444] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca8b8*, nNumberOfBytesToWrite=0x21a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca8b8*, lpNumberOfBytesWritten=0x18fdd8*=0x21a8, lpOverlapped=0x0) returned 1 [0257.445] CloseHandle (hObject=0xdc) returned 1 [0257.446] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.446] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7898 [0257.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78a0) returned 0x2c8700 [0257.446] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7898, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7898, lpOverlapped=0x0) returned 1 [0257.448] CloseHandle (hObject=0xdc) returned 1 [0257.448] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf")) returned 1 [0257.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.449] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.449] GetTickCount () returned 0x4fb2f [0257.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.450] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447\\....\\temporaryfile")) returned 0 [0257.451] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447\\temporaryfile")) returned 1 [0257.452] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e64a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.452] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e64a5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.452] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.452] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.452] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.452] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.453] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.453] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447\\temporaryfile")) returned 1 [0257.453] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.453] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.453] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326447" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326447")) returned 1 [0257.453] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF") returned 0 [0257.454] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.454] WriteFile (in: hFile=0xdc, lpBuffer=0x2cffb0*, nNumberOfBytesToWrite=0x78a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cffb0*, lpNumberOfBytesWritten=0x18fdd8*=0x78a0, lpOverlapped=0x0) returned 1 [0257.456] CloseHandle (hObject=0xdc) returned 1 [0257.456] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.456] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x931a [0257.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9322) returned 0x2c8700 [0257.456] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x931a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x931a, lpOverlapped=0x0) returned 1 [0257.458] CloseHandle (hObject=0xdc) returned 1 [0257.458] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf")) returned 1 [0257.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.459] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.460] GetTickCount () returned 0x4fb3f [0257.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.460] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326463\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326463\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.461] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326463\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326463\\....\\temporaryfile")) returned 0 [0257.461] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326463\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326463\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326463\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326463\\temporaryfile")) returned 1 [0257.462] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326463\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.462] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.463] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326463\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.463] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.463] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.463] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.463] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326463\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326463\\temporaryfile")) returned 1 [0257.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e670720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e670720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e670720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.463] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.463] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326463" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326463")) returned 1 [0257.463] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF") returned 0 [0257.464] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.465] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1a38*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1a38*, lpNumberOfBytesWritten=0x18fdd8*=0x9320, lpOverlapped=0x0) returned 1 [0257.466] CloseHandle (hObject=0xdc) returned 1 [0257.466] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.467] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x80d8 [0257.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x80e0) returned 0x2c8700 [0257.467] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x80d8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x80d8, lpOverlapped=0x0) returned 1 [0257.468] CloseHandle (hObject=0xdc) returned 1 [0257.468] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf")) returned 1 [0257.469] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.470] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.470] GetTickCount () returned 0x4fb4e [0257.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.470] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478\\....\\temporaryfile")) returned 0 [0257.471] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478\\temporaryfile")) returned 1 [0257.472] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.473] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.473] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.473] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.473] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.473] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478\\temporaryfile")) returned 1 [0257.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.473] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.473] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478")) returned 1 [0257.473] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF") returned 0 [0257.474] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.475] WriteFile (in: hFile=0xdc, lpBuffer=0x2d07f0*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d07f0*, lpNumberOfBytesWritten=0x18fdd8*=0x80e0, lpOverlapped=0x0) returned 1 [0257.476] CloseHandle (hObject=0xdc) returned 1 [0257.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.477] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc6d2 [0257.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc6da) returned 0x2c8700 [0257.477] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xc6d2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xc6d2, lpOverlapped=0x0) returned 1 [0257.478] CloseHandle (hObject=0xdc) returned 1 [0257.478] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf")) returned 1 [0257.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.479] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.479] GetTickCount () returned 0x4fb4e [0257.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.480] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.481] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478\\....\\temporaryfile")) returned 0 [0257.481] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478\\temporaryfile")) returned 1 [0257.482] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6bc9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6bc9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.483] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6bc9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6bc9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.483] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.483] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.483] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.483] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.483] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.483] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478\\temporaryfile")) returned 1 [0257.483] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e696880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e696880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e696880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.483] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.483] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326478" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326478")) returned 1 [0257.483] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF") returned 0 [0257.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.485] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4df0*, nNumberOfBytesToWrite=0xc6d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4df0*, lpNumberOfBytesWritten=0x18fdd8*=0xc6d8, lpOverlapped=0x0) returned 1 [0257.486] CloseHandle (hObject=0xdc) returned 1 [0257.487] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.487] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcd10 [0257.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcd18) returned 0x2c8700 [0257.487] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xcd10, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xcd10, lpOverlapped=0x0) returned 1 [0257.489] CloseHandle (hObject=0xdc) returned 1 [0257.489] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf")) returned 1 [0257.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.490] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.490] GetTickCount () returned 0x4fb5e [0257.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.491] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326494\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326494\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326494\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326494\\....\\temporaryfile")) returned 0 [0257.491] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326494\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326494\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326494\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326494\\temporaryfile")) returned 1 [0257.493] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326494\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6bc9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6bc9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6bc9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.493] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6bc9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6bc9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6bc9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.493] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6bc9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6bc9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6bc9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.493] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326494\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6bc9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6bc9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6bc9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.493] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6bc9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6bc9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6bc9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.493] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6bc9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6bc9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6bc9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.493] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.493] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326494\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326494\\temporaryfile")) returned 1 [0257.494] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6bc9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6bc9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6bc9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.494] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.494] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326494" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326494")) returned 1 [0257.494] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF") returned 0 [0257.495] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.503] WriteFile (in: hFile=0xdc, lpBuffer=0x2d5428*, nNumberOfBytesToWrite=0xcd18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d5428*, lpNumberOfBytesWritten=0x18fdd8*=0xcd18, lpOverlapped=0x0) returned 1 [0257.505] CloseHandle (hObject=0xdc) returned 1 [0257.505] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.505] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa80c [0257.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa814) returned 0x2c8700 [0257.505] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa80c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa80c, lpOverlapped=0x0) returned 1 [0257.507] CloseHandle (hObject=0xdc) returned 1 [0257.507] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf")) returned 1 [0257.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.508] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.508] GetTickCount () returned 0x4fb6e [0257.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.509] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326510\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326510\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326510\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326510\\....\\temporaryfile")) returned 0 [0257.509] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326510\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326510\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326510\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326510\\temporaryfile")) returned 1 [0257.511] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326510\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6e2b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6e2b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6e2b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.511] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6e2b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6e2b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6e2b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.511] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6e2b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6e2b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6e2b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.511] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326510\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6e2b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6e2b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6e2b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.511] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6e2b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6e2b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6e2b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.511] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6e2b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6e2b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6e2b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.511] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.511] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326510\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326510\\temporaryfile")) returned 1 [0257.512] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e6e2b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e6e2b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e6e2b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.512] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.512] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326510" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326510")) returned 1 [0257.512] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF") returned 0 [0257.513] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.514] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2f28*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2f28*, lpNumberOfBytesWritten=0x18fdd8*=0xa810, lpOverlapped=0x0) returned 1 [0257.515] CloseHandle (hObject=0xdc) returned 1 [0257.515] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.516] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd6bc [0257.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd6c4) returned 0x2c8700 [0257.516] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xd6bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xd6bc, lpOverlapped=0x0) returned 1 [0257.517] CloseHandle (hObject=0xdc) returned 1 [0257.517] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf")) returned 1 [0257.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.519] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.519] GetTickCount () returned 0x4fb7d [0257.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.519] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.519] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326525\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326525\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326525\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326525\\....\\temporaryfile")) returned 0 [0257.520] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326525\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326525\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326525\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326525\\temporaryfile")) returned 1 [0257.521] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326525\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e708ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e708ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e708ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.521] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e708ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e708ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e708ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.522] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e708ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e708ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e708ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.522] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326525\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e708ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e708ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e708ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.522] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e708ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e708ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e708ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.522] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e708ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e708ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e708ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.522] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.522] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326525\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326525\\temporaryfile")) returned 1 [0257.522] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e708ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e708ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e708ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.522] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.522] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326525" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326525")) returned 1 [0257.522] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF") returned 0 [0257.523] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.524] WriteFile (in: hFile=0xdc, lpBuffer=0x2d5dd8*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d5dd8*, lpNumberOfBytesWritten=0x18fdd8*=0xd6c0, lpOverlapped=0x0) returned 1 [0257.526] CloseHandle (hObject=0xdc) returned 1 [0257.527] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.528] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x89a4 [0257.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x89ac) returned 0x2c8700 [0257.528] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x89a4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x89a4, lpOverlapped=0x0) returned 1 [0257.529] CloseHandle (hObject=0xdc) returned 1 [0257.529] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg")) returned 1 [0257.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.530] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.530] GetTickCount () returned 0x4fb8d [0257.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.531] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541\\....\\temporaryfile")) returned 0 [0257.531] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541\\temporaryfile")) returned 1 [0257.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.533] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541\\temporaryfile")) returned 1 [0257.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.534] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541")) returned 1 [0257.534] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG") returned 0 [0257.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.535] WriteFile (in: hFile=0xdc, lpBuffer=0x2d10c0*, nNumberOfBytesToWrite=0x89a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d10c0*, lpNumberOfBytesWritten=0x18fdd8*=0x89a8, lpOverlapped=0x0) returned 1 [0257.536] CloseHandle (hObject=0xdc) returned 1 [0257.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.537] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x42d1 [0257.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x42d9) returned 0x2c8700 [0257.537] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x42d1, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x42d1, lpOverlapped=0x0) returned 1 [0257.539] CloseHandle (hObject=0xdc) returned 1 [0257.539] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg")) returned 1 [0257.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.540] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.540] GetTickCount () returned 0x4fb8d [0257.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.540] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541\\....\\temporaryfile")) returned 0 [0257.541] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541\\temporaryfile")) returned 1 [0257.543] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.543] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.543] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.543] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.543] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.543] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.543] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.543] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541\\temporaryfile")) returned 1 [0257.543] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e72ee00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e72ee00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e72ee00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.543] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.543] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326541" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326541")) returned 1 [0257.544] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG") returned 0 [0257.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.545] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc9f0*, nNumberOfBytesToWrite=0x42d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc9f0*, lpNumberOfBytesWritten=0x18fdd8*=0x42d8, lpOverlapped=0x0) returned 1 [0257.546] CloseHandle (hObject=0xdc) returned 1 [0257.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.546] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3e91 [0257.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3e99) returned 0x2c8700 [0257.547] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3e91, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3e91, lpOverlapped=0x0) returned 1 [0257.548] CloseHandle (hObject=0xdc) returned 1 [0257.548] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg")) returned 1 [0257.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.549] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.549] GetTickCount () returned 0x4fb9c [0257.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.550] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556\\....\\temporaryfile")) returned 0 [0257.550] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556\\temporaryfile")) returned 1 [0257.551] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.552] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.552] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.552] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.552] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.552] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556\\temporaryfile")) returned 1 [0257.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.552] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.552] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556")) returned 1 [0257.552] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG") returned 0 [0257.553] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.553] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc5b0*, nNumberOfBytesToWrite=0x3e98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc5b0*, lpNumberOfBytesWritten=0x18fdd8*=0x3e98, lpOverlapped=0x0) returned 1 [0257.554] CloseHandle (hObject=0xdc) returned 1 [0257.555] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.555] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x43c5 [0257.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x43cd) returned 0x2c8700 [0257.555] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x43c5, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x43c5, lpOverlapped=0x0) returned 1 [0257.557] CloseHandle (hObject=0xdc) returned 1 [0257.557] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg")) returned 1 [0257.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.558] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.558] GetTickCount () returned 0x4fb9c [0257.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.558] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556\\....\\temporaryfile")) returned 0 [0257.559] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556\\temporaryfile")) returned 1 [0257.561] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e77b0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e77b0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.561] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e77b0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e77b0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.561] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.561] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.561] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.561] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.561] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556\\temporaryfile")) returned 1 [0257.561] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e754f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e754f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e754f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.561] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.561] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326556" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326556")) returned 1 [0257.562] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG") returned 0 [0257.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.563] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccae0*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccae0*, lpNumberOfBytesWritten=0x18fdd8*=0x43d0, lpOverlapped=0x0) returned 1 [0257.564] CloseHandle (hObject=0xdc) returned 1 [0257.564] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.565] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8d86 [0257.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8d8e) returned 0x2c8700 [0257.565] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8d86, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8d86, lpOverlapped=0x0) returned 1 [0257.567] CloseHandle (hObject=0xdc) returned 1 [0257.567] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg")) returned 1 [0257.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.568] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.568] GetTickCount () returned 0x4fbac [0257.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.569] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326572\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326572\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326572\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326572\\....\\temporaryfile")) returned 0 [0257.569] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326572\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326572\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326572\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326572\\temporaryfile")) returned 1 [0257.571] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326572\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e77b0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e77b0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e77b0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.571] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e77b0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e77b0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e77b0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.571] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e77b0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e77b0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e77b0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.571] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326572\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e77b0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e77b0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e77b0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.571] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e77b0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e77b0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e77b0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.571] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e77b0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e77b0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e77b0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.571] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.571] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326572\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326572\\temporaryfile")) returned 1 [0257.571] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e77b0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e77b0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e77b0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.571] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.571] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326572" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326572")) returned 1 [0257.572] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG") returned 0 [0257.572] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.573] WriteFile (in: hFile=0xdc, lpBuffer=0x2d14a0*, nNumberOfBytesToWrite=0x8d90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d14a0*, lpNumberOfBytesWritten=0x18fdd8*=0x8d90, lpOverlapped=0x0) returned 1 [0257.574] CloseHandle (hObject=0xdc) returned 1 [0257.575] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.575] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2d21 [0257.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d29) returned 0x2c8700 [0257.575] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2d21, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2d21, lpOverlapped=0x0) returned 1 [0257.577] CloseHandle (hObject=0xdc) returned 1 [0257.577] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg")) returned 1 [0257.577] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.578] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.578] GetTickCount () returned 0x4fbbc [0257.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.578] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588\\....\\temporaryfile")) returned 0 [0257.579] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588\\temporaryfile")) returned 1 [0257.580] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.580] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.580] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.580] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.580] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.580] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.580] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.580] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588\\temporaryfile")) returned 1 [0257.581] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.581] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.581] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588")) returned 1 [0257.581] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG") returned 0 [0257.581] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.582] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb440*, nNumberOfBytesToWrite=0x2d28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb440*, lpNumberOfBytesWritten=0x18fdd8*=0x2d28, lpOverlapped=0x0) returned 1 [0257.583] CloseHandle (hObject=0xdc) returned 1 [0257.583] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.583] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9e8a [0257.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9e92) returned 0x2c8700 [0257.584] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x9e8a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x9e8a, lpOverlapped=0x0) returned 1 [0257.585] CloseHandle (hObject=0xdc) returned 1 [0257.585] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf")) returned 1 [0257.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.586] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.586] GetTickCount () returned 0x4fbbc [0257.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.587] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588\\....\\temporaryfile")) returned 0 [0257.587] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588\\temporaryfile")) returned 1 [0257.589] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.589] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.589] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.589] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.589] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.589] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.589] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.589] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588\\temporaryfile")) returned 1 [0257.589] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7a1220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7a1220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7a1220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.589] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.589] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326588" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326588")) returned 1 [0257.590] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF") returned 0 [0257.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.597] WriteFile (in: hFile=0xdc, lpBuffer=0x2d25a8*, nNumberOfBytesToWrite=0x9e90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d25a8*, lpNumberOfBytesWritten=0x18fdd8*=0x9e90, lpOverlapped=0x0) returned 1 [0257.598] CloseHandle (hObject=0xdc) returned 1 [0257.598] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.599] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2590 [0257.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2598) returned 0x2c8700 [0257.599] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2590, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2590, lpOverlapped=0x0) returned 1 [0257.600] CloseHandle (hObject=0xdc) returned 1 [0257.600] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf")) returned 1 [0257.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.601] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.601] GetTickCount () returned 0x4fbcb [0257.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.602] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326603\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326603\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.602] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326603\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326603\\....\\temporaryfile")) returned 0 [0257.602] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326603\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326603\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326603\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326603\\temporaryfile")) returned 1 [0257.603] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326603\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7c7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7c7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7c7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.604] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7c7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7c7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7c7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.604] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7c7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7c7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7c7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.604] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326603\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7c7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7c7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7c7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.604] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7c7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7c7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7c7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.604] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7c7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7c7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7c7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.604] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.604] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326603\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326603\\temporaryfile")) returned 1 [0257.604] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7c7380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7c7380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7c7380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.604] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.604] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326603" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326603")) returned 1 [0257.604] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF") returned 0 [0257.605] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.605] WriteFile (in: hFile=0xdc, lpBuffer=0x2caca8*, nNumberOfBytesToWrite=0x2598, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caca8*, lpNumberOfBytesWritten=0x18fdd8*=0x2598, lpOverlapped=0x0) returned 1 [0257.606] CloseHandle (hObject=0xdc) returned 1 [0257.607] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.608] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x20e4 [0257.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20ec) returned 0x2c8700 [0257.608] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x20e4, lpOverlapped=0x0) returned 1 [0257.609] CloseHandle (hObject=0xdc) returned 1 [0257.609] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf")) returned 1 [0257.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.610] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.610] GetTickCount () returned 0x4fbdb [0257.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.611] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619\\....\\temporaryfile")) returned 0 [0257.611] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619\\temporaryfile")) returned 1 [0257.613] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.613] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.613] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.613] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.613] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.613] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.613] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.613] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619\\temporaryfile")) returned 1 [0257.613] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.613] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.613] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619")) returned 1 [0257.613] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF") returned 0 [0257.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.614] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca800*, nNumberOfBytesToWrite=0x20e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca800*, lpNumberOfBytesWritten=0x18fdd8*=0x20e8, lpOverlapped=0x0) returned 1 [0257.615] CloseHandle (hObject=0xdc) returned 1 [0257.616] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.616] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7aa6 [0257.616] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7aae) returned 0x2c8700 [0257.616] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7aa6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7aa6, lpOverlapped=0x0) returned 1 [0257.618] CloseHandle (hObject=0xdc) returned 1 [0257.618] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf")) returned 1 [0257.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.619] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.620] GetTickCount () returned 0x4fbdb [0257.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.620] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619\\....\\temporaryfile")) returned 0 [0257.621] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619\\temporaryfile")) returned 1 [0257.623] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.623] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.623] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.623] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.623] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.623] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.623] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.623] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619\\temporaryfile")) returned 1 [0257.623] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e7ed4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e7ed4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e7ed4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.623] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.623] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326619" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326619")) returned 1 [0257.624] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF") returned 0 [0257.624] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.625] WriteFile (in: hFile=0xdc, lpBuffer=0x2d01c0*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d01c0*, lpNumberOfBytesWritten=0x18fdd8*=0x7ab0, lpOverlapped=0x0) returned 1 [0257.626] CloseHandle (hObject=0xdc) returned 1 [0257.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.628] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b64 [0257.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b6c) returned 0x2c4a70 [0257.628] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b64, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b64, lpOverlapped=0x0) returned 1 [0257.629] CloseHandle (hObject=0xdc) returned 1 [0257.629] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf")) returned 1 [0257.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.630] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.630] GetTickCount () returned 0x4fbea [0257.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.631] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326634\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326634\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326634\\....\\temporaryfile")) returned 0 [0257.632] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326634\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326634\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326634\\temporaryfile")) returned 1 [0257.633] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326634\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e813640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e813640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e813640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.633] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e813640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e813640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e813640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.633] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e813640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e813640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e813640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.633] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326634\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e813640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e813640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e813640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.634] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e813640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e813640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e813640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.634] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e813640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e813640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e813640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.634] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.634] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326634\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326634\\temporaryfile")) returned 1 [0257.634] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e813640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e813640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e813640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.634] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.634] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326634" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326634")) returned 1 [0257.634] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF") returned 0 [0257.635] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.635] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1b68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b68, lpOverlapped=0x0) returned 1 [0257.636] CloseHandle (hObject=0xdc) returned 1 [0257.636] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.638] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3658 [0257.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3660) returned 0x2c8700 [0257.638] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3658, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3658, lpOverlapped=0x0) returned 1 [0257.639] CloseHandle (hObject=0xdc) returned 1 [0257.639] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf")) returned 1 [0257.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.640] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.641] GetTickCount () returned 0x4fbfa [0257.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.641] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650\\....\\temporaryfile")) returned 0 [0257.642] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650\\temporaryfile")) returned 1 [0257.643] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8397a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8397a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8397a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.643] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8397a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8397a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8397a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.643] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8397a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8397a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8397a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.643] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8397a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8397a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8397a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.643] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8397a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8397a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8397a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.643] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8397a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8397a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8397a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.644] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.644] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650\\temporaryfile")) returned 1 [0257.644] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8397a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8397a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8397a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.644] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.644] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650")) returned 1 [0257.644] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF") returned 0 [0257.645] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.645] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbd70*, nNumberOfBytesToWrite=0x3660, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbd70*, lpNumberOfBytesWritten=0x18fdd8*=0x3660, lpOverlapped=0x0) returned 1 [0257.646] CloseHandle (hObject=0xdc) returned 1 [0257.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.647] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4b56 [0257.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4b5e) returned 0x2c8700 [0257.647] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4b56, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4b56, lpOverlapped=0x0) returned 1 [0257.649] CloseHandle (hObject=0xdc) returned 1 [0257.649] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf")) returned 1 [0257.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.650] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.650] GetTickCount () returned 0x4fbfa [0257.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.654] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.654] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650\\....\\temporaryfile")) returned 0 [0257.654] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650\\temporaryfile")) returned 1 [0257.656] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8397a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.656] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8397a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.656] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.656] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.656] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.656] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.656] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.656] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650\\temporaryfile")) returned 1 [0257.657] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.657] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.657] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326650" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326650")) returned 1 [0257.657] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF") returned 0 [0257.657] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.658] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd270*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd270*, lpNumberOfBytesWritten=0x18fdd8*=0x4b60, lpOverlapped=0x0) returned 1 [0257.659] CloseHandle (hObject=0xdc) returned 1 [0257.659] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.660] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x12a6 [0257.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12ae) returned 0x25b528 [0257.660] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12a6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x12a6, lpOverlapped=0x0) returned 1 [0257.661] CloseHandle (hObject=0xdc) returned 1 [0257.661] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf")) returned 1 [0257.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.662] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.662] GetTickCount () returned 0x4fc0a [0257.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.663] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326666\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326666\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326666\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326666\\....\\temporaryfile")) returned 0 [0257.663] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326666\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326666\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326666\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326666\\temporaryfile")) returned 1 [0257.665] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326666\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.665] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.665] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.665] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326666\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.665] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.665] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.665] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.665] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326666\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326666\\temporaryfile")) returned 1 [0257.666] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e85f900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e85f900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e85f900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.666] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.666] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326666" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326666")) returned 1 [0257.666] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF") returned 0 [0257.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.667] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x12b0, lpOverlapped=0x0) returned 1 [0257.668] CloseHandle (hObject=0xdc) returned 1 [0257.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.669] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17be [0257.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17c6) returned 0x2c4a70 [0257.669] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x17be, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x17be, lpOverlapped=0x0) returned 1 [0257.670] CloseHandle (hObject=0xdc) returned 1 [0257.670] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf")) returned 1 [0257.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.671] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.671] GetTickCount () returned 0x4fc19 [0257.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.672] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681\\....\\temporaryfile")) returned 0 [0257.672] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681\\temporaryfile")) returned 1 [0257.674] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.674] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.674] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.674] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.674] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.674] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.674] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.674] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681\\temporaryfile")) returned 1 [0257.674] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.674] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.674] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681")) returned 1 [0257.675] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF") returned 0 [0257.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.676] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x17c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x17c8, lpOverlapped=0x0) returned 1 [0257.676] CloseHandle (hObject=0xdc) returned 1 [0257.677] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.678] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x37de [0257.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x37e6) returned 0x2c8700 [0257.678] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x37de, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x37de, lpOverlapped=0x0) returned 1 [0257.679] CloseHandle (hObject=0xdc) returned 1 [0257.679] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf")) returned 1 [0257.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.680] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.680] GetTickCount () returned 0x4fc19 [0257.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.681] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681\\....\\temporaryfile")) returned 0 [0257.682] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681\\temporaryfile")) returned 1 [0257.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.683] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.683] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.684] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.684] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681\\temporaryfile")) returned 1 [0257.684] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e885a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e885a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e885a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.684] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.684] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326681" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326681")) returned 1 [0257.684] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF") returned 0 [0257.685] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.685] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbef8*, nNumberOfBytesToWrite=0x37e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbef8*, lpNumberOfBytesWritten=0x18fdd8*=0x37e8, lpOverlapped=0x0) returned 1 [0257.686] CloseHandle (hObject=0xdc) returned 1 [0257.687] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.687] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6180 [0257.687] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6188) returned 0x2c8700 [0257.687] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6180, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6180, lpOverlapped=0x0) returned 1 [0257.690] CloseHandle (hObject=0xdc) returned 1 [0257.690] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf")) returned 1 [0257.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.691] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.691] GetTickCount () returned 0x4fc29 [0257.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.691] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326697\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326697\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326697\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326697\\....\\temporaryfile")) returned 0 [0257.692] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326697\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326697\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326697\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326697\\temporaryfile")) returned 1 [0257.693] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326697\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8abbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8abbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8abbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.693] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8abbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8abbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8abbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8abbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8abbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8abbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.694] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326697\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8abbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8abbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8abbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.694] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8abbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8abbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8abbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.694] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8abbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8abbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8abbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.694] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.694] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326697\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326697\\temporaryfile")) returned 1 [0257.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8abbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8abbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8abbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.694] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.694] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326697" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326697")) returned 1 [0257.694] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF") returned 0 [0257.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.696] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce898*, nNumberOfBytesToWrite=0x6188, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce898*, lpNumberOfBytesWritten=0x18fdd8*=0x6188, lpOverlapped=0x0) returned 1 [0257.697] CloseHandle (hObject=0xdc) returned 1 [0257.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.698] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x21b2 [0257.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x21ba) returned 0x2c8700 [0257.698] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x21b2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x21b2, lpOverlapped=0x0) returned 1 [0257.700] CloseHandle (hObject=0xdc) returned 1 [0257.700] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf")) returned 1 [0257.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.701] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.701] GetTickCount () returned 0x4fc38 [0257.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.702] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712\\....\\temporaryfile")) returned 0 [0257.702] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712\\temporaryfile")) returned 1 [0257.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.704] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.704] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.704] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712\\temporaryfile")) returned 1 [0257.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.704] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712")) returned 1 [0257.705] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF") returned 0 [0257.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.706] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca8d0*, nNumberOfBytesToWrite=0x21b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca8d0*, lpNumberOfBytesWritten=0x18fdd8*=0x21b8, lpOverlapped=0x0) returned 1 [0257.706] CloseHandle (hObject=0xdc) returned 1 [0257.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.707] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe42c [0257.707] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe434) returned 0x2c8700 [0257.707] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xe42c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xe42c, lpOverlapped=0x0) returned 1 [0257.709] CloseHandle (hObject=0xdc) returned 1 [0257.709] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf")) returned 1 [0257.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.710] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.710] GetTickCount () returned 0x4fc38 [0257.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.711] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.711] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712\\....\\temporaryfile")) returned 0 [0257.712] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712\\temporaryfile")) returned 1 [0257.713] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.713] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.713] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.713] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.713] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.713] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.713] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.713] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712\\temporaryfile")) returned 1 [0257.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8d1d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8d1d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8d1d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.714] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.714] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326712" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326712")) returned 1 [0257.714] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF") returned 0 [0257.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.716] WriteFile (in: hFile=0xdc, lpBuffer=0x2d6b48*, nNumberOfBytesToWrite=0xe430, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d6b48*, lpNumberOfBytesWritten=0x18fdd8*=0xe430, lpOverlapped=0x0) returned 1 [0257.717] CloseHandle (hObject=0xdc) returned 1 [0257.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.719] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1088e [0257.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10896) returned 0x2c8700 [0257.719] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1088e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1088e, lpOverlapped=0x0) returned 1 [0257.720] CloseHandle (hObject=0xdc) returned 1 [0257.721] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf")) returned 1 [0257.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.722] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.722] GetTickCount () returned 0x4fc48 [0257.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.722] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326728\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326728\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326728\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326728\\....\\temporaryfile")) returned 0 [0257.723] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326728\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326728\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326728\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326728\\temporaryfile")) returned 1 [0257.724] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326728\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8f7e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8f7e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8f7e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8f7e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8f7e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8f7e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.725] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8f7e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8f7e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8f7e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.725] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326728\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8f7e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8f7e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8f7e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.725] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8f7e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8f7e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8f7e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.725] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8f7e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8f7e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8f7e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.725] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326728\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326728\\temporaryfile")) returned 1 [0257.725] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e8f7e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e8f7e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e8f7e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.725] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326728" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326728")) returned 1 [0257.725] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF") returned 0 [0257.726] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.727] WriteFile (in: hFile=0xdc, lpBuffer=0x2d8fa8*, nNumberOfBytesToWrite=0x10898, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d8fa8*, lpNumberOfBytesWritten=0x18fdd8*=0x10898, lpOverlapped=0x0) returned 1 [0257.729] CloseHandle (hObject=0xdc) returned 1 [0257.729] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.730] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x107ec [0257.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x107f4) returned 0x2c8700 [0257.730] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x107ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x107ec, lpOverlapped=0x0) returned 1 [0257.731] CloseHandle (hObject=0xdc) returned 1 [0257.731] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf")) returned 1 [0257.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.733] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.733] GetTickCount () returned 0x4fc58 [0257.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.733] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.734] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744\\....\\temporaryfile")) returned 0 [0257.734] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744\\temporaryfile")) returned 1 [0257.735] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.735] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.735] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.735] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.735] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.736] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.736] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.736] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744\\temporaryfile")) returned 1 [0257.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.736] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.736] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744")) returned 1 [0257.736] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF") returned 0 [0257.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.738] WriteFile (in: hFile=0xdc, lpBuffer=0x2d8f08*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d8f08*, lpNumberOfBytesWritten=0x18fdd8*=0x107f0, lpOverlapped=0x0) returned 1 [0257.740] CloseHandle (hObject=0xdc) returned 1 [0257.740] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.740] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x59ce [0257.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x59d6) returned 0x2c8700 [0257.740] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x59ce, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x59ce, lpOverlapped=0x0) returned 1 [0257.742] CloseHandle (hObject=0xdc) returned 1 [0257.742] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf")) returned 1 [0257.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.743] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.743] GetTickCount () returned 0x4fc58 [0257.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.743] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.744] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744\\....\\temporaryfile")) returned 0 [0257.745] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744\\temporaryfile")) returned 1 [0257.746] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.746] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.747] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.747] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.747] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.747] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.747] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.747] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744\\temporaryfile")) returned 1 [0257.747] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e91dfe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e91dfe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e91dfe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.747] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.747] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326744" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326744")) returned 1 [0257.748] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF") returned 0 [0257.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.749] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce0e8*, nNumberOfBytesToWrite=0x59d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce0e8*, lpNumberOfBytesWritten=0x18fdd8*=0x59d8, lpOverlapped=0x0) returned 1 [0257.750] CloseHandle (hObject=0xdc) returned 1 [0257.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.751] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d24 [0257.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d2c) returned 0x2c8700 [0257.751] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3d24, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3d24, lpOverlapped=0x0) returned 1 [0257.753] CloseHandle (hObject=0xdc) returned 1 [0257.753] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf")) returned 1 [0257.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.754] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.754] GetTickCount () returned 0x4fc67 [0257.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.754] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326759\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326759\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326759\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326759\\....\\temporaryfile")) returned 0 [0257.755] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326759\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326759\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326759\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326759\\temporaryfile")) returned 1 [0257.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326759\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e944140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e944140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e944140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.756] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e944140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e944140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e944140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e944140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e944140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e944140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.757] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326759\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e944140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e944140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e944140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.757] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e944140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e944140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e944140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.757] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e944140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e944140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e944140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.757] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326759\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326759\\temporaryfile")) returned 1 [0257.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e944140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e944140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e944140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.757] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326759" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326759")) returned 1 [0257.757] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF") returned 0 [0257.758] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.758] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc440*, nNumberOfBytesToWrite=0x3d28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc440*, lpNumberOfBytesWritten=0x18fdd8*=0x3d28, lpOverlapped=0x0) returned 1 [0257.760] CloseHandle (hObject=0xdc) returned 1 [0257.760] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.761] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4236 [0257.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x423e) returned 0x2c8700 [0257.761] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4236, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4236, lpOverlapped=0x0) returned 1 [0257.762] CloseHandle (hObject=0xdc) returned 1 [0257.762] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf")) returned 1 [0257.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.765] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.765] GetTickCount () returned 0x4fc77 [0257.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.766] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775\\....\\temporaryfile")) returned 0 [0257.766] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775\\temporaryfile")) returned 1 [0257.768] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.768] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.768] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.768] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.768] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.768] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.768] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.768] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775\\temporaryfile")) returned 1 [0257.768] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.768] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.768] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775")) returned 1 [0257.769] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF") returned 0 [0257.769] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.770] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc950*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc950*, lpNumberOfBytesWritten=0x18fdd8*=0x4240, lpOverlapped=0x0) returned 1 [0257.771] CloseHandle (hObject=0xdc) returned 1 [0257.771] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.771] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3c9c [0257.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ca4) returned 0x2c8700 [0257.771] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3c9c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3c9c, lpOverlapped=0x0) returned 1 [0257.773] CloseHandle (hObject=0xdc) returned 1 [0257.773] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf")) returned 1 [0257.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.774] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.774] GetTickCount () returned 0x4fc77 [0257.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.775] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775\\....\\temporaryfile")) returned 0 [0257.776] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775\\temporaryfile")) returned 1 [0257.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.777] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.777] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.778] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.778] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775\\temporaryfile")) returned 1 [0257.778] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e96a2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e96a2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e96a2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.778] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.778] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326775" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326775")) returned 1 [0257.778] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF") returned 0 [0257.778] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.779] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc3b8*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc3b8*, lpNumberOfBytesWritten=0x18fdd8*=0x3ca0, lpOverlapped=0x0) returned 1 [0257.780] CloseHandle (hObject=0xdc) returned 1 [0257.780] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.782] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x493e [0257.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4946) returned 0x2c8700 [0257.782] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x493e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x493e, lpOverlapped=0x0) returned 1 [0257.783] CloseHandle (hObject=0xdc) returned 1 [0257.783] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf")) returned 1 [0257.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.784] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.784] GetTickCount () returned 0x4fc86 [0257.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.785] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326790\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326790\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326790\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326790\\....\\temporaryfile")) returned 0 [0257.785] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326790\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326790\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326790\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326790\\temporaryfile")) returned 1 [0257.787] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326790\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e990400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e990400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e990400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.787] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e990400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e990400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e990400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.787] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e990400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e990400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e990400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.787] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326790\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e990400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e990400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e990400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.787] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e990400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e990400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e990400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.787] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e990400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e990400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e990400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.787] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.787] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326790\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326790\\temporaryfile")) returned 1 [0257.787] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e990400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e990400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e990400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.788] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.788] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326790" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326790")) returned 1 [0257.788] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF") returned 0 [0257.788] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.789] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd058*, nNumberOfBytesToWrite=0x4948, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd058*, lpNumberOfBytesWritten=0x18fdd8*=0x4948, lpOverlapped=0x0) returned 1 [0257.790] CloseHandle (hObject=0xdc) returned 1 [0257.790] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.791] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4960 [0257.791] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4968) returned 0x2c8700 [0257.791] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4960, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4960, lpOverlapped=0x0) returned 1 [0257.792] CloseHandle (hObject=0xdc) returned 1 [0257.792] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf")) returned 1 [0257.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.794] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.794] GetTickCount () returned 0x4fc96 [0257.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.794] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.795] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806\\....\\temporaryfile")) returned 0 [0257.795] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806\\temporaryfile")) returned 1 [0257.799] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.800] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.800] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.800] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.800] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.800] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.800] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.800] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806\\temporaryfile")) returned 1 [0257.800] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.800] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.800] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806")) returned 1 [0257.801] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF") returned 0 [0257.801] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.802] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd078*, nNumberOfBytesToWrite=0x4968, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd078*, lpNumberOfBytesWritten=0x18fdd8*=0x4968, lpOverlapped=0x0) returned 1 [0257.803] CloseHandle (hObject=0xdc) returned 1 [0257.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.804] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4584 [0257.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x458c) returned 0x2c8700 [0257.804] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4584, lpOverlapped=0x0) returned 1 [0257.806] CloseHandle (hObject=0xdc) returned 1 [0257.806] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf")) returned 1 [0257.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.807] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.807] GetTickCount () returned 0x4fc96 [0257.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.807] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.808] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806\\....\\temporaryfile")) returned 0 [0257.808] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806\\temporaryfile")) returned 1 [0257.810] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.810] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.810] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.810] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.810] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.810] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806\\temporaryfile")) returned 1 [0257.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9b6560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9b6560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9b6560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.810] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.810] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326806" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326806")) returned 1 [0257.810] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF") returned 0 [0257.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.812] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccca0*, nNumberOfBytesToWrite=0x4588, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccca0*, lpNumberOfBytesWritten=0x18fdd8*=0x4588, lpOverlapped=0x0) returned 1 [0257.813] CloseHandle (hObject=0xdc) returned 1 [0257.813] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.813] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2b0e [0257.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b16) returned 0x2c8700 [0257.813] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2b0e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2b0e, lpOverlapped=0x0) returned 1 [0257.815] CloseHandle (hObject=0xdc) returned 1 [0257.815] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf")) returned 1 [0257.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.816] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.816] GetTickCount () returned 0x4fca6 [0257.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.816] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326822\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326822\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326822\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326822\\....\\temporaryfile")) returned 0 [0257.817] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326822\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326822\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326822\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326822\\temporaryfile")) returned 1 [0257.818] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326822\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9dc6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9dc6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9dc6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.818] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9dc6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9dc6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9dc6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.818] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9dc6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9dc6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9dc6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.818] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326822\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9dc6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9dc6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9dc6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.819] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9dc6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9dc6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9dc6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.819] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9dc6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9dc6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9dc6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.819] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.819] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326822\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326822\\temporaryfile")) returned 1 [0257.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9e9dc6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9e9dc6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9e9dc6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.819] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.819] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326822" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326822")) returned 1 [0257.819] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF") returned 0 [0257.820] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.820] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb228*, nNumberOfBytesToWrite=0x2b18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb228*, lpNumberOfBytesWritten=0x18fdd8*=0x2b18, lpOverlapped=0x0) returned 1 [0257.821] CloseHandle (hObject=0xdc) returned 1 [0257.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.822] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2ae8 [0257.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2af0) returned 0x2c8700 [0257.822] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2ae8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2ae8, lpOverlapped=0x0) returned 1 [0257.823] CloseHandle (hObject=0xdc) returned 1 [0257.823] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf")) returned 1 [0257.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.824] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.824] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.824] GetTickCount () returned 0x4fcb5 [0257.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.825] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837\\....\\temporaryfile")) returned 0 [0257.826] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837\\temporaryfile")) returned 1 [0257.828] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.828] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.828] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.828] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.828] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.828] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.828] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.828] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837\\temporaryfile")) returned 1 [0257.829] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.829] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.829] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837")) returned 1 [0257.829] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF") returned 0 [0257.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.830] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb200*, nNumberOfBytesToWrite=0x2af0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb200*, lpNumberOfBytesWritten=0x18fdd8*=0x2af0, lpOverlapped=0x0) returned 1 [0257.831] CloseHandle (hObject=0xdc) returned 1 [0257.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.833] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4a5a [0257.833] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4a62) returned 0x2c8700 [0257.833] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4a5a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4a5a, lpOverlapped=0x0) returned 1 [0257.834] CloseHandle (hObject=0xdc) returned 1 [0257.834] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf")) returned 1 [0257.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.835] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.835] GetTickCount () returned 0x4fcb5 [0257.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.836] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837\\....\\temporaryfile")) returned 0 [0257.837] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837\\temporaryfile")) returned 1 [0257.838] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.838] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.838] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.838] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.838] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.838] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.838] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.839] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837\\temporaryfile")) returned 1 [0257.839] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea02820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea02820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea02820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.839] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.839] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326837" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326837")) returned 1 [0257.839] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF") returned 0 [0257.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.840] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd178*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd178*, lpNumberOfBytesWritten=0x18fdd8*=0x4a60, lpOverlapped=0x0) returned 1 [0257.841] CloseHandle (hObject=0xdc) returned 1 [0257.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.842] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4dfa [0257.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4e02) returned 0x2c8700 [0257.842] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4dfa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4dfa, lpOverlapped=0x0) returned 1 [0257.844] CloseHandle (hObject=0xdc) returned 1 [0257.844] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf")) returned 1 [0257.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.845] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.845] GetTickCount () returned 0x4fcc5 [0257.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.846] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.846] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853\\....\\temporaryfile")) returned 0 [0257.846] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853\\temporaryfile")) returned 1 [0257.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.848] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.848] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.848] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.848] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.848] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.848] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853\\temporaryfile")) returned 1 [0257.848] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.848] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853")) returned 1 [0257.848] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF") returned 0 [0257.849] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.850] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd518*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd518*, lpNumberOfBytesWritten=0x18fdd8*=0x4e00, lpOverlapped=0x0) returned 1 [0257.851] CloseHandle (hObject=0xdc) returned 1 [0257.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.851] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe20 [0257.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe28) returned 0x2350048 [0257.851] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0xe20, lpOverlapped=0x0) returned 1 [0257.853] CloseHandle (hObject=0xdc) returned 1 [0257.853] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf")) returned 1 [0257.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.854] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.854] GetTickCount () returned 0x4fcc5 [0257.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.855] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853\\....\\temporaryfile")) returned 0 [0257.856] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853\\temporaryfile")) returned 1 [0257.857] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea4eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea4eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea4eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea4eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.857] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.857] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.857] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.857] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.857] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853\\temporaryfile")) returned 1 [0257.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea28980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea28980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea28980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.858] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.858] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326853" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326853")) returned 1 [0257.858] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF") returned 0 [0257.858] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.859] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0xe28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0xe28, lpOverlapped=0x0) returned 1 [0257.860] CloseHandle (hObject=0xdc) returned 1 [0257.860] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.860] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x103e [0257.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1046) returned 0x25b528 [0257.860] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x103e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x103e, lpOverlapped=0x0) returned 1 [0257.862] CloseHandle (hObject=0xdc) returned 1 [0257.862] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf")) returned 1 [0257.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.863] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.863] GetTickCount () returned 0x4fcd4 [0257.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.864] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326868\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326868\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326868\\....\\temporaryfile")) returned 0 [0257.865] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326868\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326868\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326868\\temporaryfile")) returned 1 [0257.867] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326868\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea4eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea4eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea4eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.867] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea4eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea4eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea4eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.867] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea4eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea4eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea4eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.867] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326868\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea4eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea4eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea4eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.867] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea4eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea4eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea4eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.867] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea4eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea4eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea4eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.867] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.867] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326868\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326868\\temporaryfile")) returned 1 [0257.868] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea4eae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea4eae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea4eae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.868] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.868] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326868" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326868")) returned 1 [0257.868] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF") returned 0 [0257.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.869] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1048, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1048, lpOverlapped=0x0) returned 1 [0257.870] CloseHandle (hObject=0xdc) returned 1 [0257.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.871] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4a0e [0257.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4a16) returned 0x2c8700 [0257.871] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4a0e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4a0e, lpOverlapped=0x0) returned 1 [0257.873] CloseHandle (hObject=0xdc) returned 1 [0257.873] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf")) returned 1 [0257.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.874] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.874] GetTickCount () returned 0x4fce4 [0257.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.874] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884\\....\\temporaryfile")) returned 0 [0257.875] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884\\temporaryfile")) returned 1 [0257.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.876] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.876] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.876] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.876] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.876] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.876] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.876] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884\\temporaryfile")) returned 1 [0257.877] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.877] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884")) returned 1 [0257.877] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF") returned 0 [0257.877] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.878] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd128*, nNumberOfBytesToWrite=0x4a18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd128*, lpNumberOfBytesWritten=0x18fdd8*=0x4a18, lpOverlapped=0x0) returned 1 [0257.879] CloseHandle (hObject=0xdc) returned 1 [0257.879] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.880] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2cf8 [0257.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2d00) returned 0x2c8700 [0257.880] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2cf8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2cf8, lpOverlapped=0x0) returned 1 [0257.881] CloseHandle (hObject=0xdc) returned 1 [0257.882] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf")) returned 1 [0257.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.882] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.883] GetTickCount () returned 0x4fce4 [0257.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.883] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884\\....\\temporaryfile")) returned 0 [0257.884] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884\\temporaryfile")) returned 1 [0257.885] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.885] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.885] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.885] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.885] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.885] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.885] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.885] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884\\temporaryfile")) returned 1 [0257.886] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea74c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea74c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea74c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.886] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.886] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326884" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326884")) returned 1 [0257.886] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF") returned 0 [0257.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.887] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb410*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb410*, lpNumberOfBytesWritten=0x18fdd8*=0x2d00, lpOverlapped=0x0) returned 1 [0257.888] CloseHandle (hObject=0xdc) returned 1 [0257.888] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.889] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4f8e [0257.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f96) returned 0x2c8700 [0257.889] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4f8e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4f8e, lpOverlapped=0x0) returned 1 [0257.891] CloseHandle (hObject=0xdc) returned 1 [0257.891] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf")) returned 1 [0257.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.892] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.892] GetTickCount () returned 0x4fcf4 [0257.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.892] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900\\....\\temporaryfile")) returned 0 [0257.893] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900\\temporaryfile")) returned 1 [0257.894] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.894] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.894] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.894] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.894] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.894] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.895] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.895] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900\\temporaryfile")) returned 1 [0257.895] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.895] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.895] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900")) returned 1 [0257.895] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF") returned 0 [0257.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.896] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd6a8*, nNumberOfBytesToWrite=0x4f98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd6a8*, lpNumberOfBytesWritten=0x18fdd8*=0x4f98, lpOverlapped=0x0) returned 1 [0257.897] CloseHandle (hObject=0xdc) returned 1 [0257.897] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.898] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x29c4 [0257.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x29cc) returned 0x2c8700 [0257.898] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x29c4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x29c4, lpOverlapped=0x0) returned 1 [0257.899] CloseHandle (hObject=0xdc) returned 1 [0257.899] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg")) returned 1 [0257.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.900] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.900] GetTickCount () returned 0x4fcf4 [0257.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.901] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900\\....\\temporaryfile")) returned 0 [0257.902] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900\\temporaryfile")) returned 1 [0257.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.903] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.903] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.903] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.903] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.903] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.903] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900\\temporaryfile")) returned 1 [0257.904] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ea9ada0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ea9ada0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ea9ada0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.904] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326900" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326900")) returned 1 [0257.904] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG") returned 0 [0257.904] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.905] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb0e0*, nNumberOfBytesToWrite=0x29c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb0e0*, lpNumberOfBytesWritten=0x18fdd8*=0x29c8, lpOverlapped=0x0) returned 1 [0257.906] CloseHandle (hObject=0xdc) returned 1 [0257.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.907] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x544c [0257.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5454) returned 0x2c8700 [0257.907] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x544c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x544c, lpOverlapped=0x0) returned 1 [0257.908] CloseHandle (hObject=0xdc) returned 1 [0257.908] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg")) returned 1 [0257.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.909] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.909] GetTickCount () returned 0x4fd03 [0257.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.910] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326915\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326915\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326915\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326915\\....\\temporaryfile")) returned 0 [0257.911] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326915\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326915\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326915\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326915\\temporaryfile")) returned 1 [0257.912] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326915\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eac0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eac0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eac0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.912] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eac0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eac0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eac0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.912] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eac0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eac0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eac0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.912] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326915\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eac0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eac0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eac0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.912] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eac0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eac0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eac0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.912] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eac0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eac0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eac0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.912] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.912] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326915\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326915\\temporaryfile")) returned 1 [0257.912] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eac0f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eac0f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eac0f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.913] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.913] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326915" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326915")) returned 1 [0257.913] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG") returned 0 [0257.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.914] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdb68*, nNumberOfBytesToWrite=0x5450, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdb68*, lpNumberOfBytesWritten=0x18fdd8*=0x5450, lpOverlapped=0x0) returned 1 [0257.915] CloseHandle (hObject=0xdc) returned 1 [0257.915] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.916] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9a8b [0257.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9a93) returned 0x2c8700 [0257.916] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x9a8b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x9a8b, lpOverlapped=0x0) returned 1 [0257.917] CloseHandle (hObject=0xdc) returned 1 [0257.917] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg")) returned 1 [0257.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.919] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.919] GetTickCount () returned 0x4fd13 [0257.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.919] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931\\....\\temporaryfile")) returned 0 [0257.920] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931\\temporaryfile")) returned 1 [0257.921] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.921] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.921] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.921] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.921] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.921] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.921] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.921] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931\\temporaryfile")) returned 1 [0257.922] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.922] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931")) returned 1 [0257.922] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG") returned 0 [0257.923] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.923] WriteFile (in: hFile=0xdc, lpBuffer=0x2d21a8*, nNumberOfBytesToWrite=0x9a90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d21a8*, lpNumberOfBytesWritten=0x18fdd8*=0x9a90, lpOverlapped=0x0) returned 1 [0257.924] CloseHandle (hObject=0xdc) returned 1 [0257.925] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.925] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x81f0 [0257.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x81f8) returned 0x2c8700 [0257.925] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x81f0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x81f0, lpOverlapped=0x0) returned 1 [0257.927] CloseHandle (hObject=0xdc) returned 1 [0257.927] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg")) returned 1 [0257.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.928] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.928] GetTickCount () returned 0x4fd13 [0257.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.929] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931\\....\\temporaryfile")) returned 0 [0257.930] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931\\temporaryfile")) returned 1 [0257.931] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.931] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.931] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.931] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.931] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.931] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.931] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.931] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931\\temporaryfile")) returned 1 [0257.931] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eae7060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eae7060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eae7060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.931] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.932] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326931" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326931")) returned 1 [0257.932] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG") returned 0 [0257.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.936] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0908*, nNumberOfBytesToWrite=0x81f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0908*, lpNumberOfBytesWritten=0x18fdd8*=0x81f8, lpOverlapped=0x0) returned 1 [0257.938] CloseHandle (hObject=0xdc) returned 1 [0257.938] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.939] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaabb [0257.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaac3) returned 0x2c8700 [0257.939] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xaabb, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xaabb, lpOverlapped=0x0) returned 1 [0257.940] CloseHandle (hObject=0xdc) returned 1 [0257.940] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg")) returned 1 [0257.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.942] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.942] GetTickCount () returned 0x4fd22 [0257.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.943] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326946\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326946\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326946\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326946\\....\\temporaryfile")) returned 0 [0257.944] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326946\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326946\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326946\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326946\\temporaryfile")) returned 1 [0257.945] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326946\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb0d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb0d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb0d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.945] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb0d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb0d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb0d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.946] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb0d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb0d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb0d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326946\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb0d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb0d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb0d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.946] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb0d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb0d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb0d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.946] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb0d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb0d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb0d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.946] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.946] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326946\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326946\\temporaryfile")) returned 1 [0257.946] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb0d1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb0d1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb0d1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.946] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.946] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326946" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326946")) returned 1 [0257.947] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG") returned 0 [0257.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.948] WriteFile (in: hFile=0xdc, lpBuffer=0x2d31d8*, nNumberOfBytesToWrite=0xaac0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d31d8*, lpNumberOfBytesWritten=0x18fdd8*=0xaac0, lpOverlapped=0x0) returned 1 [0257.950] CloseHandle (hObject=0xdc) returned 1 [0257.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.951] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4ada [0257.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4ae2) returned 0x2c8700 [0257.951] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4ada, lpOverlapped=0x0) returned 1 [0257.952] CloseHandle (hObject=0xdc) returned 1 [0257.952] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg")) returned 1 [0257.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.953] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.953] GetTickCount () returned 0x4fd32 [0257.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.953] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.954] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.954] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962\\....\\temporaryfile")) returned 0 [0257.954] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962\\temporaryfile")) returned 1 [0257.955] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.955] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.956] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.956] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.956] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.956] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.956] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.956] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962\\temporaryfile")) returned 1 [0257.956] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.956] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.956] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962")) returned 1 [0257.956] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG") returned 0 [0257.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.957] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd1f8*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd1f8*, lpNumberOfBytesWritten=0x18fdd8*=0x4ae0, lpOverlapped=0x0) returned 1 [0257.958] CloseHandle (hObject=0xdc) returned 1 [0257.958] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.959] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a00 [0257.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a08) returned 0x2c4a70 [0257.959] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a00, lpOverlapped=0x0) returned 1 [0257.960] CloseHandle (hObject=0xdc) returned 1 [0257.960] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf")) returned 1 [0257.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.961] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.961] GetTickCount () returned 0x4fd32 [0257.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.962] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962\\....\\temporaryfile")) returned 0 [0257.963] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962\\temporaryfile")) returned 1 [0257.964] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.964] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.964] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.964] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.964] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.964] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.964] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.964] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962\\temporaryfile")) returned 1 [0257.964] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb33320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb33320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb33320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.964] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.965] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326962" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326962")) returned 1 [0257.965] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF") returned 0 [0257.965] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.966] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1a08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1a08, lpOverlapped=0x0) returned 1 [0257.966] CloseHandle (hObject=0xdc) returned 1 [0257.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.967] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x20e4 [0257.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20ec) returned 0x2c8700 [0257.967] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x20e4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x20e4, lpOverlapped=0x0) returned 1 [0257.970] CloseHandle (hObject=0xdc) returned 1 [0257.970] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf")) returned 1 [0257.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.971] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.971] GetTickCount () returned 0x4fd42 [0257.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.972] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978\\....\\temporaryfile")) returned 0 [0257.972] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978\\temporaryfile")) returned 1 [0257.973] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb59480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb59480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb59480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.974] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb59480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb59480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb59480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.974] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb59480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb59480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb59480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.974] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb59480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb59480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb59480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.974] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb59480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb59480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb59480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.974] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb59480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb59480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb59480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.974] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.974] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978\\temporaryfile")) returned 1 [0257.974] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb59480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb59480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb59480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.974] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.974] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978")) returned 1 [0257.974] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF") returned 0 [0257.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.975] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca800*, nNumberOfBytesToWrite=0x20e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca800*, lpNumberOfBytesWritten=0x18fdd8*=0x20e8, lpOverlapped=0x0) returned 1 [0257.976] CloseHandle (hObject=0xdc) returned 1 [0257.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.977] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2b38 [0257.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b40) returned 0x2c8700 [0257.977] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2b38, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2b38, lpOverlapped=0x0) returned 1 [0257.979] CloseHandle (hObject=0xdc) returned 1 [0257.979] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf")) returned 1 [0257.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0257.980] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.980] GetTickCount () returned 0x4fd42 [0257.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.981] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978\\...."), lpSecurityAttributes=0x256228) returned 1 [0257.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978\\....\\temporaryfile")) returned 0 [0257.982] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978\\temporaryfile")) returned 1 [0257.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.984] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.984] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.984] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.984] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978\\temporaryfile")) returned 1 [0257.984] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.984] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.984] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326978" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326978")) returned 1 [0257.984] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF") returned 0 [0257.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.986] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb250*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb250*, lpNumberOfBytesWritten=0x18fdd8*=0x2b40, lpOverlapped=0x0) returned 1 [0257.987] CloseHandle (hObject=0xdc) returned 1 [0257.987] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.988] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x911a [0257.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9122) returned 0x2c8700 [0257.988] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x911a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x911a, lpOverlapped=0x0) returned 1 [0257.990] CloseHandle (hObject=0xdc) returned 1 [0257.990] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg")) returned 1 [0257.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0257.992] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0257.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0257.992] GetTickCount () returned 0x4fd51 [0257.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0257.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0257.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0257.992] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326993\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326993\\...."), lpSecurityAttributes=0x256210) returned 1 [0257.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326993\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326993\\....\\temporaryfile")) returned 0 [0257.993] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326993\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326993\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326993\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326993\\temporaryfile")) returned 1 [0257.994] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326993\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0257.994] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.994] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0257.994] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326993\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0257.994] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.994] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0257.994] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0257.995] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326993\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326993\\temporaryfile")) returned 1 [0257.995] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eb7f5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eb7f5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eb7f5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0257.995] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0257.995] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18326993" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18326993")) returned 1 [0257.995] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG") returned 0 [0257.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.997] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1838*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1838*, lpNumberOfBytesWritten=0x18fdd8*=0x9120, lpOverlapped=0x0) returned 1 [0257.998] CloseHandle (hObject=0xdc) returned 1 [0257.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0257.999] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa75a [0257.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa762) returned 0x2c8700 [0257.999] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa75a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa75a, lpOverlapped=0x0) returned 1 [0258.000] CloseHandle (hObject=0xdc) returned 1 [0258.000] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg")) returned 1 [0258.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.001] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.001] GetTickCount () returned 0x4fd61 [0258.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.002] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009\\....\\temporaryfile")) returned 0 [0258.002] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009\\temporaryfile")) returned 1 [0258.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eba5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eba5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eba5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eba5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eba5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eba5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eba5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eba5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eba5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eba5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eba5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eba5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.004] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eba5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eba5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eba5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.004] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eba5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eba5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eba5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.004] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.004] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009\\temporaryfile")) returned 1 [0258.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eba5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eba5740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eba5740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.004] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.004] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009")) returned 1 [0258.004] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG") returned 0 [0258.005] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.006] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2e78*, nNumberOfBytesToWrite=0xa760, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2e78*, lpNumberOfBytesWritten=0x18fdd8*=0xa760, lpOverlapped=0x0) returned 1 [0258.007] CloseHandle (hObject=0xdc) returned 1 [0258.007] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.008] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x81ab [0258.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x81b3) returned 0x2c8700 [0258.008] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x81ab, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x81ab, lpOverlapped=0x0) returned 1 [0258.010] CloseHandle (hObject=0xdc) returned 1 [0258.010] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg")) returned 1 [0258.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.011] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.011] GetTickCount () returned 0x4fd61 [0258.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.012] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009\\....\\temporaryfile")) returned 0 [0258.013] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009\\temporaryfile")) returned 1 [0258.015] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eba5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebcb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebcb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.015] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eba5740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebcb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebcb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.015] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebcb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebcb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebcb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.015] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebcb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebcb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebcb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.015] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebcb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebcb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebcb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.015] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebcb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebcb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebcb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.015] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.015] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009\\temporaryfile")) returned 1 [0258.015] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebcb8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebcb8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebcb8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.015] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.015] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327009" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327009")) returned 1 [0258.016] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG") returned 0 [0258.016] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.017] WriteFile (in: hFile=0xdc, lpBuffer=0x2d08c8*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d08c8*, lpNumberOfBytesWritten=0x18fdd8*=0x81b0, lpOverlapped=0x0) returned 1 [0258.018] CloseHandle (hObject=0xdc) returned 1 [0258.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.019] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb9d1 [0258.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb9d9) returned 0x2c8700 [0258.019] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb9d1, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb9d1, lpOverlapped=0x0) returned 1 [0258.036] CloseHandle (hObject=0xdc) returned 1 [0258.038] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg")) returned 1 [0258.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.040] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.040] GetTickCount () returned 0x4fd80 [0258.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.041] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327040\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327040\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327040\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327040\\....\\temporaryfile")) returned 0 [0258.042] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327040\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327040\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327040\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327040\\temporaryfile")) returned 1 [0258.044] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327040\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebf1a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebf1a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebf1a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.044] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebf1a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebf1a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebf1a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.044] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebf1a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebf1a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebf1a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.044] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327040\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebf1a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebf1a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebf1a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.044] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebf1a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebf1a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebf1a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.044] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebf1a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebf1a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebf1a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.044] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.044] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327040\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327040\\temporaryfile")) returned 1 [0258.045] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ebf1a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ebf1a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ebf1a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.045] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.045] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327040" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327040")) returned 1 [0258.045] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG") returned 0 [0258.046] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.047] WriteFile (in: hFile=0xdc, lpBuffer=0x2d40f0*, nNumberOfBytesToWrite=0xb9d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d40f0*, lpNumberOfBytesWritten=0x18fdd8*=0xb9d8, lpOverlapped=0x0) returned 1 [0258.049] CloseHandle (hObject=0xdc) returned 1 [0258.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.050] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x40f2 [0258.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x40fa) returned 0x2c8700 [0258.050] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x40f2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x40f2, lpOverlapped=0x0) returned 1 [0258.052] CloseHandle (hObject=0xdc) returned 1 [0258.052] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg")) returned 1 [0258.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.053] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.053] GetTickCount () returned 0x4fd90 [0258.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.053] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327056\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327056\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327056\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327056\\....\\temporaryfile")) returned 0 [0258.054] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327056\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327056\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327056\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327056\\temporaryfile")) returned 1 [0258.055] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327056\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec17b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec17b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec17b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec17b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec17b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec17b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec17b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec17b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec17b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.055] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327056\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec17b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec17b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec17b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.055] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec17b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec17b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec17b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.056] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec17b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec17b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec17b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.056] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.056] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327056\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327056\\temporaryfile")) returned 1 [0258.056] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec17b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec17b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec17b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.056] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.056] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327056" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327056")) returned 1 [0258.056] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG") returned 0 [0258.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.057] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc810*, nNumberOfBytesToWrite=0x40f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc810*, lpNumberOfBytesWritten=0x18fdd8*=0x40f8, lpOverlapped=0x0) returned 1 [0258.058] CloseHandle (hObject=0xdc) returned 1 [0258.058] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.059] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4b02 [0258.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4b0a) returned 0x2c8700 [0258.059] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4b02, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4b02, lpOverlapped=0x0) returned 1 [0258.060] CloseHandle (hObject=0xdc) returned 1 [0258.061] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg")) returned 1 [0258.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.061] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.062] GetTickCount () returned 0x4fd9f [0258.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.062] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071\\....\\temporaryfile")) returned 0 [0258.063] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071\\temporaryfile")) returned 1 [0258.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.064] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.064] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.064] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.064] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071\\temporaryfile")) returned 1 [0258.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.065] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.065] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071")) returned 1 [0258.065] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG") returned 0 [0258.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.066] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd220*, nNumberOfBytesToWrite=0x4b08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd220*, lpNumberOfBytesWritten=0x18fdd8*=0x4b08, lpOverlapped=0x0) returned 1 [0258.067] CloseHandle (hObject=0xdc) returned 1 [0258.067] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.067] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x423a [0258.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4242) returned 0x2c8700 [0258.068] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x423a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x423a, lpOverlapped=0x0) returned 1 [0258.069] CloseHandle (hObject=0xdc) returned 1 [0258.069] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg")) returned 1 [0258.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.070] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.070] GetTickCount () returned 0x4fd9f [0258.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.071] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071\\....\\temporaryfile")) returned 0 [0258.071] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071\\temporaryfile")) returned 1 [0258.073] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.073] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.073] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.073] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.073] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.073] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.073] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.073] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071\\temporaryfile")) returned 1 [0258.073] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec3dcc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec3dcc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec3dcc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.073] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.073] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327071" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327071")) returned 1 [0258.073] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG") returned 0 [0258.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.075] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc958*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc958*, lpNumberOfBytesWritten=0x18fdd8*=0x4240, lpOverlapped=0x0) returned 1 [0258.076] CloseHandle (hObject=0xdc) returned 1 [0258.077] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.078] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4180 [0258.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4188) returned 0x2c8700 [0258.078] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4180, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4180, lpOverlapped=0x0) returned 1 [0258.079] CloseHandle (hObject=0xdc) returned 1 [0258.079] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf")) returned 1 [0258.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.080] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.080] GetTickCount () returned 0x4fdaf [0258.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.081] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327087\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327087\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327087\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327087\\....\\temporaryfile")) returned 0 [0258.081] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327087\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327087\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327087\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327087\\temporaryfile")) returned 1 [0258.082] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327087\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec63e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec63e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec63e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.083] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec63e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec63e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec63e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.083] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec63e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec63e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec63e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.083] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327087\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec63e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec63e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec63e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.083] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec63e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec63e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec63e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.083] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec63e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec63e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec63e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.083] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.083] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327087\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327087\\temporaryfile")) returned 1 [0258.083] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec63e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec63e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec63e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.083] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.083] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327087" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327087")) returned 1 [0258.083] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF") returned 0 [0258.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.084] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc898*, nNumberOfBytesToWrite=0x4188, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc898*, lpNumberOfBytesWritten=0x18fdd8*=0x4188, lpOverlapped=0x0) returned 1 [0258.086] CloseHandle (hObject=0xdc) returned 1 [0258.086] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.086] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2dfa [0258.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e02) returned 0x2c8700 [0258.087] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2dfa, lpOverlapped=0x0) returned 1 [0258.088] CloseHandle (hObject=0xdc) returned 1 [0258.088] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf")) returned 1 [0258.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.089] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.089] GetTickCount () returned 0x4fdbe [0258.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.090] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102\\....\\temporaryfile")) returned 0 [0258.090] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102\\temporaryfile")) returned 1 [0258.091] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.092] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.092] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.092] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.092] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.092] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.092] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.092] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102\\temporaryfile")) returned 1 [0258.092] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.092] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.092] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102")) returned 1 [0258.092] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF") returned 0 [0258.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.093] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb518*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb518*, lpNumberOfBytesWritten=0x18fdd8*=0x2e00, lpOverlapped=0x0) returned 1 [0258.094] CloseHandle (hObject=0xdc) returned 1 [0258.094] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.095] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x28be [0258.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28c6) returned 0x2c8700 [0258.095] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x28be, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x28be, lpOverlapped=0x0) returned 1 [0258.096] CloseHandle (hObject=0xdc) returned 1 [0258.096] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf")) returned 1 [0258.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.097] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.097] GetTickCount () returned 0x4fdbe [0258.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.098] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102\\....\\temporaryfile")) returned 0 [0258.099] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102\\temporaryfile")) returned 1 [0258.103] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.103] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.103] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.103] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.103] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.103] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.103] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.103] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102\\temporaryfile")) returned 1 [0258.104] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ec89f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ec89f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ec89f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.104] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327102" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327102")) returned 1 [0258.105] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF") returned 0 [0258.105] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.106] WriteFile (in: hFile=0xdc, lpBuffer=0x2cafd8*, nNumberOfBytesToWrite=0x28c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cafd8*, lpNumberOfBytesWritten=0x18fdd8*=0x28c8, lpOverlapped=0x0) returned 1 [0258.107] CloseHandle (hObject=0xdc) returned 1 [0258.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.108] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x24d7 [0258.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24df) returned 0x2c8700 [0258.108] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x24d7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x24d7, lpOverlapped=0x0) returned 1 [0258.110] CloseHandle (hObject=0xdc) returned 1 [0258.110] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg")) returned 1 [0258.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.111] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.111] GetTickCount () returned 0x4fdce [0258.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.112] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327118\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327118\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327118\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327118\\....\\temporaryfile")) returned 0 [0258.113] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327118\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327118\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327118\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327118\\temporaryfile")) returned 1 [0258.114] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327118\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecb00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecb00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecb00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.114] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecb00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecb00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecb00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.114] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecb00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecb00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecb00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.114] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327118\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecb00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecb00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecb00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.114] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecb00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecb00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecb00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.115] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecb00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecb00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecb00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.115] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327118\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327118\\temporaryfile")) returned 1 [0258.115] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecb00e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecb00e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecb00e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.115] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.115] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327118" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327118")) returned 1 [0258.115] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG") returned 0 [0258.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.117] WriteFile (in: hFile=0xdc, lpBuffer=0x2cabf0*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cabf0*, lpNumberOfBytesWritten=0x18fdd8*=0x24e0, lpOverlapped=0x0) returned 1 [0258.118] CloseHandle (hObject=0xdc) returned 1 [0258.118] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.118] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2ff8 [0258.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3000) returned 0x2c8700 [0258.119] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2ff8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2ff8, lpOverlapped=0x0) returned 1 [0258.120] CloseHandle (hObject=0xdc) returned 1 [0258.120] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf")) returned 1 [0258.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.121] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.121] GetTickCount () returned 0x4fdde [0258.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.122] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.122] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134\\....\\temporaryfile")) returned 0 [0258.122] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134\\temporaryfile")) returned 1 [0258.123] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.123] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.123] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.123] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.124] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.124] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.124] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.124] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134\\temporaryfile")) returned 1 [0258.124] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.124] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.124] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134")) returned 1 [0258.124] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF") returned 0 [0258.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.125] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb710*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb710*, lpNumberOfBytesWritten=0x18fdd8*=0x3000, lpOverlapped=0x0) returned 1 [0258.126] CloseHandle (hObject=0xdc) returned 1 [0258.126] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.127] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2e7e [0258.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e86) returned 0x2c8700 [0258.127] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2e7e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2e7e, lpOverlapped=0x0) returned 1 [0258.128] CloseHandle (hObject=0xdc) returned 1 [0258.128] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf")) returned 1 [0258.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.129] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.129] GetTickCount () returned 0x4fdde [0258.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.130] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134\\....\\temporaryfile")) returned 0 [0258.130] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134\\temporaryfile")) returned 1 [0258.132] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.132] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.132] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.132] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.132] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.132] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.132] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.132] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134\\temporaryfile")) returned 1 [0258.132] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecd6240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecd6240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecd6240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.132] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.132] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327134" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327134")) returned 1 [0258.132] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF") returned 0 [0258.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.133] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb598*, nNumberOfBytesToWrite=0x2e88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb598*, lpNumberOfBytesWritten=0x18fdd8*=0x2e88, lpOverlapped=0x0) returned 1 [0258.134] CloseHandle (hObject=0xdc) returned 1 [0258.134] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.135] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3260 [0258.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3268) returned 0x2c8700 [0258.135] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3260, lpOverlapped=0x0) returned 1 [0258.136] CloseHandle (hObject=0xdc) returned 1 [0258.136] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg")) returned 1 [0258.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.137] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.137] GetTickCount () returned 0x4fded [0258.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.138] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149\\....\\temporaryfile")) returned 0 [0258.139] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149\\temporaryfile")) returned 1 [0258.140] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.140] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.140] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.140] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.140] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.140] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.140] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.140] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149\\temporaryfile")) returned 1 [0258.140] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.140] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.140] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149")) returned 1 [0258.141] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG") returned 0 [0258.141] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.142] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb978*, nNumberOfBytesToWrite=0x3268, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb978*, lpNumberOfBytesWritten=0x18fdd8*=0x3268, lpOverlapped=0x0) returned 1 [0258.143] CloseHandle (hObject=0xdc) returned 1 [0258.143] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.144] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x27d4 [0258.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x27dc) returned 0x2c8700 [0258.144] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x27d4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x27d4, lpOverlapped=0x0) returned 1 [0258.145] CloseHandle (hObject=0xdc) returned 1 [0258.145] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg")) returned 1 [0258.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.147] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.147] GetTickCount () returned 0x4fded [0258.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.147] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.147] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149\\....\\temporaryfile")) returned 0 [0258.149] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149\\temporaryfile")) returned 1 [0258.150] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.150] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.150] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.150] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.150] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.150] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.150] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.151] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149\\temporaryfile")) returned 1 [0258.151] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ecfc3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ecfc3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ecfc3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.151] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.151] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327149" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327149")) returned 1 [0258.151] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG") returned 0 [0258.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.153] WriteFile (in: hFile=0xdc, lpBuffer=0x2caef0*, nNumberOfBytesToWrite=0x27d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caef0*, lpNumberOfBytesWritten=0x18fdd8*=0x27d8, lpOverlapped=0x0) returned 1 [0258.154] CloseHandle (hObject=0xdc) returned 1 [0258.155] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.156] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2cdd [0258.156] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ce5) returned 0x2c8700 [0258.156] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2cdd, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2cdd, lpOverlapped=0x0) returned 1 [0258.158] CloseHandle (hObject=0xdc) returned 1 [0258.158] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg")) returned 1 [0258.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.159] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.159] GetTickCount () returned 0x4fdfd [0258.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.159] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327165\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327165\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327165\\....\\temporaryfile")) returned 0 [0258.160] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327165\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327165\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327165\\temporaryfile")) returned 1 [0258.161] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327165\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed22500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed22500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed22500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.161] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed22500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed22500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed22500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.161] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed22500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed22500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed22500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.161] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327165\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed22500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed22500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed22500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.161] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed22500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed22500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed22500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.161] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed22500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed22500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed22500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.161] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.162] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327165\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327165\\temporaryfile")) returned 1 [0258.162] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed22500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed22500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed22500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.162] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.162] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327165" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327165")) returned 1 [0258.162] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG") returned 0 [0258.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.163] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb3f8*, nNumberOfBytesToWrite=0x2ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb3f8*, lpNumberOfBytesWritten=0x18fdd8*=0x2ce8, lpOverlapped=0x0) returned 1 [0258.164] CloseHandle (hObject=0xdc) returned 1 [0258.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.165] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4c6d [0258.165] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c75) returned 0x2c8700 [0258.165] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4c6d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4c6d, lpOverlapped=0x0) returned 1 [0258.166] CloseHandle (hObject=0xdc) returned 1 [0258.166] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg")) returned 1 [0258.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.167] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.167] GetTickCount () returned 0x4fe0c [0258.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.168] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180\\....\\temporaryfile")) returned 0 [0258.168] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180\\temporaryfile")) returned 1 [0258.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.170] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.170] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.170] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.170] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.170] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.170] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180\\temporaryfile")) returned 1 [0258.170] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.170] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.170] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180")) returned 1 [0258.171] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG") returned 0 [0258.171] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.172] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd388*, nNumberOfBytesToWrite=0x4c78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd388*, lpNumberOfBytesWritten=0x18fdd8*=0x4c78, lpOverlapped=0x0) returned 1 [0258.173] CloseHandle (hObject=0xdc) returned 1 [0258.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.174] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4ad8 [0258.174] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4ae0) returned 0x2c8700 [0258.174] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4ad8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4ad8, lpOverlapped=0x0) returned 1 [0258.175] CloseHandle (hObject=0xdc) returned 1 [0258.175] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg")) returned 1 [0258.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.176] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.176] GetTickCount () returned 0x4fe0c [0258.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.176] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.177] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.177] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180\\....\\temporaryfile")) returned 0 [0258.178] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180\\temporaryfile")) returned 1 [0258.179] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.179] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.179] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.179] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.179] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.179] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.179] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.179] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180\\temporaryfile")) returned 1 [0258.180] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed48660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed48660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed48660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.180] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.180] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327180" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327180")) returned 1 [0258.180] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG") returned 0 [0258.180] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.181] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd1f0*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd1f0*, lpNumberOfBytesWritten=0x18fdd8*=0x4ae0, lpOverlapped=0x0) returned 1 [0258.182] CloseHandle (hObject=0xdc) returned 1 [0258.182] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.183] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x52c3 [0258.183] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x52cb) returned 0x2c8700 [0258.183] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x52c3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x52c3, lpOverlapped=0x0) returned 1 [0258.185] CloseHandle (hObject=0xdc) returned 1 [0258.185] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg")) returned 1 [0258.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.186] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.186] GetTickCount () returned 0x4fe1c [0258.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.186] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196\\....\\temporaryfile")) returned 0 [0258.187] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196\\temporaryfile")) returned 1 [0258.188] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.188] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.188] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.188] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.188] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.188] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.188] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.188] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196\\temporaryfile")) returned 1 [0258.189] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.189] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.189] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196")) returned 1 [0258.189] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG") returned 0 [0258.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.190] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd9e0*, nNumberOfBytesToWrite=0x52c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd9e0*, lpNumberOfBytesWritten=0x18fdd8*=0x52c8, lpOverlapped=0x0) returned 1 [0258.191] CloseHandle (hObject=0xdc) returned 1 [0258.191] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.192] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7457 [0258.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x745f) returned 0x2c8700 [0258.192] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7457, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7457, lpOverlapped=0x0) returned 1 [0258.194] CloseHandle (hObject=0xdc) returned 1 [0258.194] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg")) returned 1 [0258.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.195] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.195] GetTickCount () returned 0x4fe1c [0258.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.195] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.196] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196\\....\\temporaryfile")) returned 0 [0258.196] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196\\temporaryfile")) returned 1 [0258.197] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.197] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.197] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.197] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.198] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.198] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.198] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.198] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196\\temporaryfile")) returned 1 [0258.198] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed6e7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed6e7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed6e7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.198] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.198] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327196" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327196")) returned 1 [0258.198] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG") returned 0 [0258.199] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.199] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfb70*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfb70*, lpNumberOfBytesWritten=0x18fdd8*=0x7460, lpOverlapped=0x0) returned 1 [0258.201] CloseHandle (hObject=0xdc) returned 1 [0258.201] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.201] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa9e2 [0258.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa9ea) returned 0x2c8700 [0258.201] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa9e2, lpOverlapped=0x0) returned 1 [0258.210] CloseHandle (hObject=0xdc) returned 1 [0258.210] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg")) returned 1 [0258.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.211] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.211] GetTickCount () returned 0x4fe2c [0258.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.212] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327212\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327212\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327212\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327212\\....\\temporaryfile")) returned 0 [0258.213] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327212\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327212\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327212\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327212\\temporaryfile")) returned 1 [0258.214] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327212\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed94920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed94920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed94920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.214] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed94920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed94920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed94920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.215] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed94920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed94920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed94920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.215] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327212\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed94920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed94920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed94920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.215] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed94920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed94920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed94920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.215] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed94920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed94920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed94920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.215] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.215] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327212\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327212\\temporaryfile")) returned 1 [0258.215] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ed94920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ed94920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ed94920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.215] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.215] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327212" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327212")) returned 1 [0258.215] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG") returned 0 [0258.216] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.217] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3100*, nNumberOfBytesToWrite=0xa9e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3100*, lpNumberOfBytesWritten=0x18fdd8*=0xa9e8, lpOverlapped=0x0) returned 1 [0258.218] CloseHandle (hObject=0xdc) returned 1 [0258.219] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.219] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3ee3 [0258.219] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3eeb) returned 0x2c8700 [0258.219] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3ee3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3ee3, lpOverlapped=0x0) returned 1 [0258.221] CloseHandle (hObject=0xdc) returned 1 [0258.221] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg")) returned 1 [0258.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.222] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.222] GetTickCount () returned 0x4fe3b [0258.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.222] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.223] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327227\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327227\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327227\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327227\\....\\temporaryfile")) returned 0 [0258.224] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327227\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327227\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327227\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327227\\temporaryfile")) returned 1 [0258.225] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327227\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9edbaa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9edbaa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9edbaa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.226] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9edbaa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9edbaa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9edbaa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.226] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9edbaa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9edbaa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9edbaa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.226] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327227\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9edbaa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9edbaa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9edbaa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.226] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9edbaa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9edbaa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9edbaa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.226] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9edbaa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9edbaa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9edbaa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.226] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.226] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327227\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327227\\temporaryfile")) returned 1 [0258.226] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9edbaa80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9edbaa80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9edbaa80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.226] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.226] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327227" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327227")) returned 1 [0258.227] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG") returned 0 [0258.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.228] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc600*, nNumberOfBytesToWrite=0x3ee8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc600*, lpNumberOfBytesWritten=0x18fdd8*=0x3ee8, lpOverlapped=0x0) returned 1 [0258.229] CloseHandle (hObject=0xdc) returned 1 [0258.230] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.230] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f8a [0258.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f92) returned 0x2c8700 [0258.230] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f8a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f8a, lpOverlapped=0x0) returned 1 [0258.232] CloseHandle (hObject=0xdc) returned 1 [0258.232] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg")) returned 1 [0258.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.233] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.233] GetTickCount () returned 0x4fe4b [0258.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.233] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.233] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243\\....\\temporaryfile")) returned 0 [0258.234] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243\\temporaryfile")) returned 1 [0258.235] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.235] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.235] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.235] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.235] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.235] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.236] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.236] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243\\temporaryfile")) returned 1 [0258.236] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.236] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.236] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243")) returned 1 [0258.236] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG") returned 0 [0258.236] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.237] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca6a8*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca6a8*, lpNumberOfBytesWritten=0x18fdd8*=0x1f90, lpOverlapped=0x0) returned 1 [0258.238] CloseHandle (hObject=0xdc) returned 1 [0258.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.239] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5a56 [0258.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5a5e) returned 0x2c8700 [0258.239] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5a56, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5a56, lpOverlapped=0x0) returned 1 [0258.240] CloseHandle (hObject=0xdc) returned 1 [0258.240] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg")) returned 1 [0258.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.241] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.241] GetTickCount () returned 0x4fe4b [0258.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.242] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243\\....\\temporaryfile")) returned 0 [0258.243] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243\\temporaryfile")) returned 1 [0258.244] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.244] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.244] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.244] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.244] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.244] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.244] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.244] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243\\temporaryfile")) returned 1 [0258.244] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ede0be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ede0be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ede0be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.245] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.245] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327243" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327243")) returned 1 [0258.245] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG") returned 0 [0258.246] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.246] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce170*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce170*, lpNumberOfBytesWritten=0x18fdd8*=0x5a60, lpOverlapped=0x0) returned 1 [0258.247] CloseHandle (hObject=0xdc) returned 1 [0258.251] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.252] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6f43 [0258.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6f4b) returned 0x2c8700 [0258.252] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6f43, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6f43, lpOverlapped=0x0) returned 1 [0258.253] CloseHandle (hObject=0xdc) returned 1 [0258.253] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg")) returned 1 [0258.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.255] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.255] GetTickCount () returned 0x4fe5a [0258.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.255] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327258\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327258\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327258\\....\\temporaryfile")) returned 0 [0258.256] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327258\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327258\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327258\\temporaryfile")) returned 1 [0258.257] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327258\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee06d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee06d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee06d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.257] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee06d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee06d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee06d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.257] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee06d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee06d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee06d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.257] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327258\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee06d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee06d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee06d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.257] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee06d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee06d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee06d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.257] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee06d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee06d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee06d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.257] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.257] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327258\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327258\\temporaryfile")) returned 1 [0258.258] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee06d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee06d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee06d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.258] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.258] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327258" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327258")) returned 1 [0258.258] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG") returned 0 [0258.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.259] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf660*, nNumberOfBytesToWrite=0x6f48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf660*, lpNumberOfBytesWritten=0x18fdd8*=0x6f48, lpOverlapped=0x0) returned 1 [0258.260] CloseHandle (hObject=0xdc) returned 1 [0258.261] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.261] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6aa8 [0258.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6ab0) returned 0x2c8700 [0258.261] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6aa8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6aa8, lpOverlapped=0x0) returned 1 [0258.263] CloseHandle (hObject=0xdc) returned 1 [0258.263] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg")) returned 1 [0258.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.264] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.264] GetTickCount () returned 0x4fe6a [0258.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.264] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274\\....\\temporaryfile")) returned 0 [0258.265] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274\\temporaryfile")) returned 1 [0258.266] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.266] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.266] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.267] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.267] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.267] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274\\temporaryfile")) returned 1 [0258.267] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.267] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.267] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274")) returned 1 [0258.267] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG") returned 0 [0258.268] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.268] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf1c0*, nNumberOfBytesToWrite=0x6ab0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf1c0*, lpNumberOfBytesWritten=0x18fdd8*=0x6ab0, lpOverlapped=0x0) returned 1 [0258.269] CloseHandle (hObject=0xdc) returned 1 [0258.270] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.270] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6873 [0258.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x687b) returned 0x2c8700 [0258.270] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6873, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6873, lpOverlapped=0x0) returned 1 [0258.272] CloseHandle (hObject=0xdc) returned 1 [0258.272] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg")) returned 1 [0258.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.273] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.273] GetTickCount () returned 0x4fe6a [0258.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.273] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274\\....\\temporaryfile")) returned 0 [0258.274] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274\\temporaryfile")) returned 1 [0258.276] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.276] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.276] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.276] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.276] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.276] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.276] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.276] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274\\temporaryfile")) returned 1 [0258.276] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee2cea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee2cea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee2cea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.276] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.276] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327274" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327274")) returned 1 [0258.276] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG") returned 0 [0258.277] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.278] WriteFile (in: hFile=0xdc, lpBuffer=0x2cef90*, nNumberOfBytesToWrite=0x6878, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cef90*, lpNumberOfBytesWritten=0x18fdd8*=0x6878, lpOverlapped=0x0) returned 1 [0258.279] CloseHandle (hObject=0xdc) returned 1 [0258.279] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.279] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa497 [0258.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa49f) returned 0x2c8700 [0258.279] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa497, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa497, lpOverlapped=0x0) returned 1 [0258.281] CloseHandle (hObject=0xdc) returned 1 [0258.281] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg")) returned 1 [0258.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.282] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.282] GetTickCount () returned 0x4fe7a [0258.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.282] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.283] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290\\....\\temporaryfile")) returned 0 [0258.283] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290\\temporaryfile")) returned 1 [0258.284] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.284] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.285] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.285] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.285] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.285] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.285] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.285] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290\\temporaryfile")) returned 1 [0258.285] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.285] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.285] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290")) returned 1 [0258.285] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG") returned 0 [0258.286] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.287] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2bb0*, nNumberOfBytesToWrite=0xa4a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2bb0*, lpNumberOfBytesWritten=0x18fdd8*=0xa4a0, lpOverlapped=0x0) returned 1 [0258.288] CloseHandle (hObject=0xdc) returned 1 [0258.288] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.289] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e7b [0258.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e83) returned 0x2c8700 [0258.289] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1e7b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1e7b, lpOverlapped=0x0) returned 1 [0258.290] CloseHandle (hObject=0xdc) returned 1 [0258.290] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg")) returned 1 [0258.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.291] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.291] GetTickCount () returned 0x4fe7a [0258.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.292] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290\\....\\temporaryfile")) returned 0 [0258.293] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290\\temporaryfile")) returned 1 [0258.294] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee79160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee79160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.294] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee79160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee79160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.294] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.294] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.294] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.294] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.294] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.294] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290\\temporaryfile")) returned 1 [0258.295] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee53000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee53000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee53000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.295] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.295] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327290" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327290")) returned 1 [0258.295] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG") returned 0 [0258.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.296] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca598*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca598*, lpNumberOfBytesWritten=0x18fdd8*=0x1e80, lpOverlapped=0x0) returned 1 [0258.297] CloseHandle (hObject=0xdc) returned 1 [0258.297] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.300] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3615 [0258.300] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x361d) returned 0x2c8700 [0258.300] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3615, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3615, lpOverlapped=0x0) returned 1 [0258.301] CloseHandle (hObject=0xdc) returned 1 [0258.302] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg")) returned 1 [0258.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.302] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.303] GetTickCount () returned 0x4fe89 [0258.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.303] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327305\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327305\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327305\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327305\\....\\temporaryfile")) returned 0 [0258.304] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327305\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327305\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327305\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327305\\temporaryfile")) returned 1 [0258.305] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327305\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee79160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee79160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee79160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.305] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee79160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee79160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee79160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.305] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee79160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee79160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee79160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.305] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327305\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee79160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee79160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee79160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.305] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee79160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee79160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee79160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.305] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee79160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee79160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee79160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.305] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.305] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327305\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327305\\temporaryfile")) returned 1 [0258.306] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee79160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee79160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee79160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.306] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.306] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327305" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327305")) returned 1 [0258.306] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG") returned 0 [0258.306] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.307] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbd30*, nNumberOfBytesToWrite=0x3620, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbd30*, lpNumberOfBytesWritten=0x18fdd8*=0x3620, lpOverlapped=0x0) returned 1 [0258.309] CloseHandle (hObject=0xdc) returned 1 [0258.309] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.310] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2026 [0258.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x202e) returned 0x2c8700 [0258.310] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2026, lpOverlapped=0x0) returned 1 [0258.312] CloseHandle (hObject=0xdc) returned 1 [0258.312] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg")) returned 1 [0258.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.313] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.313] GetTickCount () returned 0x4fe99 [0258.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.313] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.313] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321\\....\\temporaryfile")) returned 0 [0258.314] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321\\temporaryfile")) returned 1 [0258.315] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.315] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.315] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.315] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.315] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.315] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.315] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.315] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321\\temporaryfile")) returned 1 [0258.315] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.315] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.316] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321")) returned 1 [0258.316] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG") returned 0 [0258.316] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.317] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca740*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca740*, lpNumberOfBytesWritten=0x18fdd8*=0x2030, lpOverlapped=0x0) returned 1 [0258.317] CloseHandle (hObject=0xdc) returned 1 [0258.318] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.318] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3df7 [0258.318] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3dff) returned 0x2c8700 [0258.318] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3df7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3df7, lpOverlapped=0x0) returned 1 [0258.320] CloseHandle (hObject=0xdc) returned 1 [0258.320] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg")) returned 1 [0258.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.321] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.321] GetTickCount () returned 0x4fe99 [0258.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.321] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321\\....\\temporaryfile")) returned 0 [0258.322] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321\\temporaryfile")) returned 1 [0258.323] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.324] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.324] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.324] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.324] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.324] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.324] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.324] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321\\temporaryfile")) returned 1 [0258.324] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ee9f2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ee9f2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ee9f2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.324] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.324] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327321" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327321")) returned 1 [0258.325] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG") returned 0 [0258.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.326] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc510*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc510*, lpNumberOfBytesWritten=0x18fdd8*=0x3e00, lpOverlapped=0x0) returned 1 [0258.327] CloseHandle (hObject=0xdc) returned 1 [0258.327] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.327] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d7f [0258.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d87) returned 0x2c8700 [0258.327] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3d7f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3d7f, lpOverlapped=0x0) returned 1 [0258.329] CloseHandle (hObject=0xdc) returned 1 [0258.329] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg")) returned 1 [0258.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.330] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.330] GetTickCount () returned 0x4fea8 [0258.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.331] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.331] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336\\....\\temporaryfile")) returned 0 [0258.331] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336\\temporaryfile")) returned 1 [0258.332] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eec5420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eec5420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eec5420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.332] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eec5420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eec5420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eec5420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.332] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eec5420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eec5420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eec5420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.332] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eec5420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eec5420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eec5420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.333] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eec5420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eec5420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eec5420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.333] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eec5420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eec5420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eec5420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.333] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.333] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336\\temporaryfile")) returned 1 [0258.333] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eec5420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eec5420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eec5420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.333] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.333] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336")) returned 1 [0258.333] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG") returned 0 [0258.334] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.334] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc498*, nNumberOfBytesToWrite=0x3d88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc498*, lpNumberOfBytesWritten=0x18fdd8*=0x3d88, lpOverlapped=0x0) returned 1 [0258.335] CloseHandle (hObject=0xdc) returned 1 [0258.335] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.336] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4ec6 [0258.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4ece) returned 0x2c8700 [0258.336] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4ec6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4ec6, lpOverlapped=0x0) returned 1 [0258.337] CloseHandle (hObject=0xdc) returned 1 [0258.337] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg")) returned 1 [0258.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.339] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.339] GetTickCount () returned 0x4fea8 [0258.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.340] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336\\....\\temporaryfile")) returned 0 [0258.340] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336\\temporaryfile")) returned 1 [0258.342] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.342] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.342] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.342] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.342] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.342] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.342] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.342] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336\\temporaryfile")) returned 1 [0258.343] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.343] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.343] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327336" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327336")) returned 1 [0258.343] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG") returned 0 [0258.344] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.344] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd5e0*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd5e0*, lpNumberOfBytesWritten=0x18fdd8*=0x4ed0, lpOverlapped=0x0) returned 1 [0258.346] CloseHandle (hObject=0xdc) returned 1 [0258.346] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.347] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x49ba [0258.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x49c2) returned 0x2c8700 [0258.347] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x49ba, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x49ba, lpOverlapped=0x0) returned 1 [0258.349] CloseHandle (hObject=0xdc) returned 1 [0258.349] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg")) returned 1 [0258.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.350] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.350] GetTickCount () returned 0x4feb8 [0258.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.350] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327352\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327352\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327352\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327352\\....\\temporaryfile")) returned 0 [0258.351] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327352\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327352\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327352\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327352\\temporaryfile")) returned 1 [0258.352] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327352\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.352] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.352] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.352] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327352\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.353] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.353] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.353] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.353] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327352\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327352\\temporaryfile")) returned 1 [0258.353] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eeeb580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eeeb580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eeeb580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.353] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.353] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327352" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327352")) returned 1 [0258.353] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG") returned 0 [0258.354] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.354] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd0d8*, nNumberOfBytesToWrite=0x49c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd0d8*, lpNumberOfBytesWritten=0x18fdd8*=0x49c0, lpOverlapped=0x0) returned 1 [0258.355] CloseHandle (hObject=0xdc) returned 1 [0258.355] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.356] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10bdc [0258.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10be4) returned 0x2c8700 [0258.356] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x10bdc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x10bdc, lpOverlapped=0x0) returned 1 [0258.358] CloseHandle (hObject=0xdc) returned 1 [0258.358] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg")) returned 1 [0258.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.359] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.359] GetTickCount () returned 0x4fec8 [0258.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.360] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368\\....\\temporaryfile")) returned 0 [0258.360] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368\\temporaryfile")) returned 1 [0258.361] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef116e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef116e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef116e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef116e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef116e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef116e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef116e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef116e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef116e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.362] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef116e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef116e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef116e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.362] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef116e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef116e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef116e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.362] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef116e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef116e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef116e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.362] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368\\temporaryfile")) returned 1 [0258.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef116e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef116e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef116e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.362] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368")) returned 1 [0258.362] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG") returned 0 [0258.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.364] WriteFile (in: hFile=0xdc, lpBuffer=0x2d92f8*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d92f8*, lpNumberOfBytesWritten=0x18fdd8*=0x10be0, lpOverlapped=0x0) returned 1 [0258.366] CloseHandle (hObject=0xdc) returned 1 [0258.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.366] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ce5a [0258.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ce62) returned 0x2c8700 [0258.366] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1ce5a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1ce5a, lpOverlapped=0x0) returned 1 [0258.368] CloseHandle (hObject=0xdc) returned 1 [0258.368] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg")) returned 1 [0258.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.370] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.370] GetTickCount () returned 0x4fec8 [0258.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.370] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368\\....\\temporaryfile")) returned 0 [0258.371] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368\\temporaryfile")) returned 1 [0258.372] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef116e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.372] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef116e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.372] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.373] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.373] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.373] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.373] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.373] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368\\temporaryfile")) returned 1 [0258.373] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.373] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.373] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327368" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327368")) returned 1 [0258.373] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG") returned 0 [0258.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.376] WriteFile (in: hFile=0xdc, lpBuffer=0x2e5578*, nNumberOfBytesToWrite=0x1ce60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e5578*, lpNumberOfBytesWritten=0x18fdd8*=0x1ce60, lpOverlapped=0x0) returned 1 [0258.378] CloseHandle (hObject=0xdc) returned 1 [0258.378] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.379] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1672c [0258.379] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16734) returned 0x2c8700 [0258.379] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1672c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1672c, lpOverlapped=0x0) returned 1 [0258.380] CloseHandle (hObject=0xdc) returned 1 [0258.380] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg")) returned 1 [0258.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.382] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.382] GetTickCount () returned 0x4fed7 [0258.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.382] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.383] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327383\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327383\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327383\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327383\\....\\temporaryfile")) returned 0 [0258.384] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327383\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327383\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327383\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327383\\temporaryfile")) returned 1 [0258.386] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327383\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.386] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.386] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.386] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327383\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.386] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.386] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.386] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.386] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327383\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327383\\temporaryfile")) returned 1 [0258.386] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef37840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef37840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef37840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.387] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.387] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327383" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327383")) returned 1 [0258.387] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG") returned 0 [0258.388] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.389] WriteFile (in: hFile=0xdc, lpBuffer=0x2dee48*, nNumberOfBytesToWrite=0x16730, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2dee48*, lpNumberOfBytesWritten=0x18fdd8*=0x16730, lpOverlapped=0x0) returned 1 [0258.391] CloseHandle (hObject=0xdc) returned 1 [0258.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.392] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f86c [0258.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f874) returned 0x2c8700 [0258.392] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f86c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f86c, lpOverlapped=0x0) returned 1 [0258.394] CloseHandle (hObject=0xdc) returned 1 [0258.394] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg")) returned 1 [0258.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.396] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.396] GetTickCount () returned 0x4fee7 [0258.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.397] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327399\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327399\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.400] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327399\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327399\\....\\temporaryfile")) returned 0 [0258.400] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327399\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327399\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327399\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327399\\temporaryfile")) returned 1 [0258.402] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327399\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef5d9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef5d9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef5d9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.402] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef5d9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef5d9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef5d9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.402] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef5d9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef5d9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef5d9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.402] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327399\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef5d9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef5d9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef5d9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.402] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef5d9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef5d9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef5d9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.402] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef5d9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef5d9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef5d9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.402] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.402] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327399\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327399\\temporaryfile")) returned 1 [0258.402] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef5d9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef5d9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef5d9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.402] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.402] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327399" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327399")) returned 1 [0258.403] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG") returned 0 [0258.405] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.405] WriteFile (in: hFile=0xdc, lpBuffer=0x2e7f88*, nNumberOfBytesToWrite=0x1f870, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e7f88*, lpNumberOfBytesWritten=0x18fdd8*=0x1f870, lpOverlapped=0x0) returned 1 [0258.408] CloseHandle (hObject=0xdc) returned 1 [0258.408] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.409] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b83a [0258.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b842) returned 0x2c8700 [0258.409] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1b83a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1b83a, lpOverlapped=0x0) returned 1 [0258.411] CloseHandle (hObject=0xdc) returned 1 [0258.411] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg")) returned 1 [0258.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.412] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.412] GetTickCount () returned 0x4fef6 [0258.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.413] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327414\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327414\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327414\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327414\\....\\temporaryfile")) returned 0 [0258.413] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327414\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327414\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327414\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327414\\temporaryfile")) returned 1 [0258.414] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327414\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef83b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef83b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef83b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef83b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef83b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef83b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef83b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef83b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef83b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327414\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef83b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef83b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef83b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.415] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef83b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef83b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef83b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.415] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef83b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef83b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef83b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.415] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327414\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327414\\temporaryfile")) returned 1 [0258.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ef83b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ef83b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ef83b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.415] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327414" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327414")) returned 1 [0258.415] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG") returned 0 [0258.417] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.418] WriteFile (in: hFile=0xdc, lpBuffer=0x2e3f58*, nNumberOfBytesToWrite=0x1b840, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e3f58*, lpNumberOfBytesWritten=0x18fdd8*=0x1b840, lpOverlapped=0x0) returned 1 [0258.421] CloseHandle (hObject=0xdc) returned 1 [0258.421] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.422] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1df43 [0258.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1df4b) returned 0x2c8700 [0258.422] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1df43, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1df43, lpOverlapped=0x0) returned 1 [0258.423] CloseHandle (hObject=0xdc) returned 1 [0258.423] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg")) returned 1 [0258.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.425] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.425] GetTickCount () returned 0x4ff06 [0258.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.425] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327430\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327430\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327430\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327430\\....\\temporaryfile")) returned 0 [0258.426] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327430\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327430\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327430\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327430\\temporaryfile")) returned 1 [0258.427] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327430\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efa9c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efa9c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efa9c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.427] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efa9c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efa9c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efa9c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.427] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efa9c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efa9c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efa9c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.427] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327430\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efa9c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efa9c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efa9c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.427] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efa9c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efa9c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efa9c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.427] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efa9c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efa9c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efa9c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.427] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.428] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327430\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327430\\temporaryfile")) returned 1 [0258.428] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efa9c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efa9c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efa9c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.428] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.428] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327430" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327430")) returned 1 [0258.428] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG") returned 0 [0258.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.430] WriteFile (in: hFile=0xdc, lpBuffer=0x2e6660*, nNumberOfBytesToWrite=0x1df48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e6660*, lpNumberOfBytesWritten=0x18fdd8*=0x1df48, lpOverlapped=0x0) returned 1 [0258.433] CloseHandle (hObject=0xdc) returned 1 [0258.433] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.434] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x184d3 [0258.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x184db) returned 0x2c8700 [0258.434] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x184d3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x184d3, lpOverlapped=0x0) returned 1 [0258.436] CloseHandle (hObject=0xdc) returned 1 [0258.436] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg")) returned 1 [0258.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.437] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.437] GetTickCount () returned 0x4ff16 [0258.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.438] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327446\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327446\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327446\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327446\\....\\temporaryfile")) returned 0 [0258.438] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327446\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327446\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327446\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327446\\temporaryfile")) returned 1 [0258.439] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327446\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efcfdc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efcfdc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efcfdc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.440] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efcfdc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efcfdc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efcfdc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.440] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efcfdc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efcfdc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efcfdc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.440] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327446\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efcfdc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efcfdc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efcfdc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.440] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efcfdc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efcfdc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efcfdc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.440] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efcfdc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efcfdc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efcfdc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.440] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.440] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327446\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327446\\temporaryfile")) returned 1 [0258.440] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9efcfdc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9efcfdc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9efcfdc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.440] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.440] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327446" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327446")) returned 1 [0258.440] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG") returned 0 [0258.442] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.443] WriteFile (in: hFile=0xdc, lpBuffer=0x2e0bf0*, nNumberOfBytesToWrite=0x184d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e0bf0*, lpNumberOfBytesWritten=0x18fdd8*=0x184d8, lpOverlapped=0x0) returned 1 [0258.445] CloseHandle (hObject=0xdc) returned 1 [0258.445] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.446] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1aba5 [0258.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1abad) returned 0x2c8700 [0258.446] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1aba5, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1aba5, lpOverlapped=0x0) returned 1 [0258.447] CloseHandle (hObject=0xdc) returned 1 [0258.447] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg")) returned 1 [0258.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.449] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.449] GetTickCount () returned 0x4ff25 [0258.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.449] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.450] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461\\....\\temporaryfile")) returned 0 [0258.450] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461\\temporaryfile")) returned 1 [0258.451] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eff5f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eff5f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eff5f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.452] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eff5f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eff5f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eff5f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.452] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eff5f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eff5f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eff5f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.452] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eff5f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eff5f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eff5f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.452] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eff5f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eff5f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eff5f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.452] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eff5f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eff5f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eff5f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.452] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.452] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461\\temporaryfile")) returned 1 [0258.452] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eff5f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9eff5f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9eff5f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.452] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.452] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461")) returned 1 [0258.452] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG") returned 0 [0258.454] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.455] WriteFile (in: hFile=0xdc, lpBuffer=0x2e32c0*, nNumberOfBytesToWrite=0x1abb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e32c0*, lpNumberOfBytesWritten=0x18fdd8*=0x1abb0, lpOverlapped=0x0) returned 1 [0258.457] CloseHandle (hObject=0xdc) returned 1 [0258.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.460] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1653a [0258.460] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16542) returned 0x2c8700 [0258.460] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1653a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1653a, lpOverlapped=0x0) returned 1 [0258.462] CloseHandle (hObject=0xdc) returned 1 [0258.462] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg")) returned 1 [0258.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.463] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.463] GetTickCount () returned 0x4ff25 [0258.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.464] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461\\....\\temporaryfile")) returned 0 [0258.465] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461\\temporaryfile")) returned 1 [0258.466] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eff5f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.467] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9eff5f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.467] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.467] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.467] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.467] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.467] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.467] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461\\temporaryfile")) returned 1 [0258.467] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.467] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.467] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327461" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327461")) returned 1 [0258.468] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG") returned 0 [0258.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.470] WriteFile (in: hFile=0xdc, lpBuffer=0x2dec58*, nNumberOfBytesToWrite=0x16540, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2dec58*, lpNumberOfBytesWritten=0x18fdd8*=0x16540, lpOverlapped=0x0) returned 1 [0258.472] CloseHandle (hObject=0xdc) returned 1 [0258.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.473] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13e1d [0258.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13e25) returned 0x2c8700 [0258.473] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x13e1d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x13e1d, lpOverlapped=0x0) returned 1 [0258.475] CloseHandle (hObject=0xdc) returned 1 [0258.475] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg")) returned 1 [0258.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.477] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.477] GetTickCount () returned 0x4ff35 [0258.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.477] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327477\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327477\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.478] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327477\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327477\\....\\temporaryfile")) returned 0 [0258.478] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327477\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327477\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327477\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327477\\temporaryfile")) returned 1 [0258.480] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327477\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.480] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327477\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.480] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.480] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327477\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327477\\temporaryfile")) returned 1 [0258.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f01c080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f01c080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f01c080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.480] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.480] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327477" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327477")) returned 1 [0258.480] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG") returned 0 [0258.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.482] WriteFile (in: hFile=0xdc, lpBuffer=0x2dc538*, nNumberOfBytesToWrite=0x13e28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2dc538*, lpNumberOfBytesWritten=0x18fdd8*=0x13e28, lpOverlapped=0x0) returned 1 [0258.484] CloseHandle (hObject=0xdc) returned 1 [0258.485] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.485] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1531c [0258.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15324) returned 0x2c8700 [0258.485] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1531c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1531c, lpOverlapped=0x0) returned 1 [0258.488] CloseHandle (hObject=0xdc) returned 1 [0258.488] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg")) returned 1 [0258.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.489] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.489] GetTickCount () returned 0x4ff44 [0258.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.490] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327492\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327492\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.490] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327492\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327492\\....\\temporaryfile")) returned 0 [0258.490] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327492\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327492\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327492\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327492\\temporaryfile")) returned 1 [0258.491] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327492\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0421e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0421e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0421e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.491] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0421e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0421e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0421e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0421e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0421e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0421e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327492\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0421e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0421e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0421e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.492] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0421e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0421e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0421e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.492] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0421e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0421e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0421e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.492] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.492] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327492\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327492\\temporaryfile")) returned 1 [0258.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0421e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0421e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0421e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.492] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.492] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327492" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327492")) returned 1 [0258.492] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG") returned 0 [0258.494] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.494] WriteFile (in: hFile=0xdc, lpBuffer=0x2dda38*, nNumberOfBytesToWrite=0x15320, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2dda38*, lpNumberOfBytesWritten=0x18fdd8*=0x15320, lpOverlapped=0x0) returned 1 [0258.496] CloseHandle (hObject=0xdc) returned 1 [0258.497] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.497] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ad37 [0258.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ad3f) returned 0x2c8700 [0258.497] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1ad37, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1ad37, lpOverlapped=0x0) returned 1 [0258.499] CloseHandle (hObject=0xdc) returned 1 [0258.499] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg")) returned 1 [0258.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.501] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.501] GetTickCount () returned 0x4ff54 [0258.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.501] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327508\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327508\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327508\\....\\temporaryfile")) returned 0 [0258.502] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327508\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327508\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327508\\temporaryfile")) returned 1 [0258.503] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327508\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f068340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f068340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f068340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.503] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f068340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f068340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f068340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.503] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f068340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f068340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f068340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.503] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327508\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f068340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f068340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f068340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.503] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f068340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f068340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f068340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.503] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f068340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f068340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f068340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.503] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.503] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327508\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327508\\temporaryfile")) returned 1 [0258.503] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f068340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f068340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f068340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.504] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.504] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327508" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327508")) returned 1 [0258.504] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG") returned 0 [0258.506] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.506] WriteFile (in: hFile=0xdc, lpBuffer=0x2e3450*, nNumberOfBytesToWrite=0x1ad40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e3450*, lpNumberOfBytesWritten=0x18fdd8*=0x1ad40, lpOverlapped=0x0) returned 1 [0258.508] CloseHandle (hObject=0xdc) returned 1 [0258.508] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.510] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x178d2 [0258.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x178da) returned 0x2c8700 [0258.510] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x178d2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x178d2, lpOverlapped=0x0) returned 1 [0258.512] CloseHandle (hObject=0xdc) returned 1 [0258.512] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg")) returned 1 [0258.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.513] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.513] GetTickCount () returned 0x4ff64 [0258.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.514] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524\\....\\temporaryfile")) returned 0 [0258.514] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524\\temporaryfile")) returned 1 [0258.515] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.516] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.516] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.516] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.516] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.516] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.516] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.516] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524\\temporaryfile")) returned 1 [0258.516] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.516] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.516] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524")) returned 1 [0258.516] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG") returned 0 [0258.518] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.519] WriteFile (in: hFile=0xdc, lpBuffer=0x2dfff0*, nNumberOfBytesToWrite=0x178d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2dfff0*, lpNumberOfBytesWritten=0x18fdd8*=0x178d8, lpOverlapped=0x0) returned 1 [0258.521] CloseHandle (hObject=0xdc) returned 1 [0258.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.522] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17749 [0258.522] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17751) returned 0x2c8700 [0258.522] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x17749, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x17749, lpOverlapped=0x0) returned 1 [0258.523] CloseHandle (hObject=0xdc) returned 1 [0258.523] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg")) returned 1 [0258.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.525] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.525] GetTickCount () returned 0x4ff64 [0258.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.525] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524\\....\\temporaryfile")) returned 0 [0258.526] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524\\temporaryfile")) returned 1 [0258.527] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0b4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0b4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.527] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0b4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0b4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.527] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.528] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.528] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.528] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.528] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.528] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524\\temporaryfile")) returned 1 [0258.528] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f08e4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f08e4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f08e4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.528] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.528] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327524" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327524")) returned 1 [0258.528] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG") returned 0 [0258.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.530] WriteFile (in: hFile=0xdc, lpBuffer=0x2dfe68*, nNumberOfBytesToWrite=0x17750, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2dfe68*, lpNumberOfBytesWritten=0x18fdd8*=0x17750, lpOverlapped=0x0) returned 1 [0258.532] CloseHandle (hObject=0xdc) returned 1 [0258.532] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.533] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15a7f [0258.533] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15a87) returned 0x2c8700 [0258.533] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x15a7f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x15a7f, lpOverlapped=0x0) returned 1 [0258.535] CloseHandle (hObject=0xdc) returned 1 [0258.535] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg")) returned 1 [0258.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.536] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.536] GetTickCount () returned 0x4ff73 [0258.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.537] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.537] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327539\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327539\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327539\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327539\\....\\temporaryfile")) returned 0 [0258.537] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327539\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327539\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327539\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327539\\temporaryfile")) returned 1 [0258.539] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327539\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0b4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0b4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0b4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.539] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0b4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0b4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0b4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.539] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0b4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0b4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0b4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.539] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327539\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0b4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0b4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0b4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.539] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0b4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0b4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0b4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.539] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0b4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0b4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0b4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.539] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.539] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327539\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327539\\temporaryfile")) returned 1 [0258.539] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0b4600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0b4600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0b4600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.539] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.539] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327539" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327539")) returned 1 [0258.540] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG") returned 0 [0258.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.542] WriteFile (in: hFile=0xdc, lpBuffer=0x2de198*, nNumberOfBytesToWrite=0x15a88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2de198*, lpNumberOfBytesWritten=0x18fdd8*=0x15a88, lpOverlapped=0x0) returned 1 [0258.544] CloseHandle (hObject=0xdc) returned 1 [0258.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.544] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15fef [0258.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15ff7) returned 0x2c8700 [0258.544] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x15fef, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x15fef, lpOverlapped=0x0) returned 1 [0258.546] CloseHandle (hObject=0xdc) returned 1 [0258.546] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg")) returned 1 [0258.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.548] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.548] GetTickCount () returned 0x4ff83 [0258.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.549] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327555\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327555\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327555\\....\\temporaryfile")) returned 0 [0258.549] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327555\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327555\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327555\\temporaryfile")) returned 1 [0258.551] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327555\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0da760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0da760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0da760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.551] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0da760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0da760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0da760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.551] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0da760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0da760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0da760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.551] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327555\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0da760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0da760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0da760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.551] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0da760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0da760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0da760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.551] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0da760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0da760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0da760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.551] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.552] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327555\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327555\\temporaryfile")) returned 1 [0258.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f0da760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f0da760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f0da760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.552] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.552] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327555" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327555")) returned 1 [0258.552] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG") returned 0 [0258.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.555] WriteFile (in: hFile=0xdc, lpBuffer=0x2de708*, nNumberOfBytesToWrite=0x15ff8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2de708*, lpNumberOfBytesWritten=0x18fdd8*=0x15ff8, lpOverlapped=0x0) returned 1 [0258.557] CloseHandle (hObject=0xdc) returned 1 [0258.557] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.558] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a9ed [0258.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a9f5) returned 0x2c8700 [0258.558] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1a9ed, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1a9ed, lpOverlapped=0x0) returned 1 [0258.559] CloseHandle (hObject=0xdc) returned 1 [0258.559] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg")) returned 1 [0258.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.561] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.561] GetTickCount () returned 0x4ff92 [0258.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.562] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327570\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327570\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327570\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327570\\....\\temporaryfile")) returned 0 [0258.562] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327570\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327570\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327570\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327570\\temporaryfile")) returned 1 [0258.563] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327570\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1008c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1008c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1008c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.563] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1008c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1008c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1008c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.563] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1008c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1008c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1008c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.563] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327570\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1008c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1008c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1008c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.564] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1008c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1008c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1008c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.564] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1008c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1008c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1008c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.564] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.564] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327570\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327570\\temporaryfile")) returned 1 [0258.564] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1008c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1008c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1008c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.564] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.564] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327570" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327570")) returned 1 [0258.564] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG") returned 0 [0258.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.567] WriteFile (in: hFile=0xdc, lpBuffer=0x2e3108*, nNumberOfBytesToWrite=0x1a9f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e3108*, lpNumberOfBytesWritten=0x18fdd8*=0x1a9f8, lpOverlapped=0x0) returned 1 [0258.569] CloseHandle (hObject=0xdc) returned 1 [0258.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.570] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x193e7 [0258.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x193ef) returned 0x2c8700 [0258.570] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x193e7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x193e7, lpOverlapped=0x0) returned 1 [0258.571] CloseHandle (hObject=0xdc) returned 1 [0258.571] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg")) returned 1 [0258.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.573] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.573] GetTickCount () returned 0x4ffa2 [0258.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.574] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.574] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327586\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327586\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.574] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327586\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327586\\....\\temporaryfile")) returned 0 [0258.574] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327586\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327586\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327586\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327586\\temporaryfile")) returned 1 [0258.579] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327586\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f126a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f126a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f126a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.579] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f126a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f126a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f126a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.579] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f126a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f126a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f126a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.579] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327586\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f126a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f126a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f126a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.579] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f126a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f126a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f126a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.579] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f126a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f126a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f126a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.579] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.579] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327586\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327586\\temporaryfile")) returned 1 [0258.579] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f126a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f126a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f126a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.579] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.579] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327586" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327586")) returned 1 [0258.579] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG") returned 0 [0258.581] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.582] WriteFile (in: hFile=0xdc, lpBuffer=0x2e1b00*, nNumberOfBytesToWrite=0x193f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e1b00*, lpNumberOfBytesWritten=0x18fdd8*=0x193f0, lpOverlapped=0x0) returned 1 [0258.584] CloseHandle (hObject=0xdc) returned 1 [0258.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.586] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14f8a [0258.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14f92) returned 0x2c8700 [0258.586] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x14f8a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x14f8a, lpOverlapped=0x0) returned 1 [0258.587] CloseHandle (hObject=0xdc) returned 1 [0258.587] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg")) returned 1 [0258.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.594] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.594] GetTickCount () returned 0x4ffb2 [0258.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.595] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327602\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327602\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.595] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327602\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327602\\....\\temporaryfile")) returned 0 [0258.596] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327602\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327602\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327602\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327602\\temporaryfile")) returned 1 [0258.597] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327602\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f14cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f14cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f14cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.597] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f14cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f14cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f14cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.597] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f14cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f14cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f14cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.597] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327602\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f14cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f14cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f14cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.597] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f14cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f14cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f14cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.597] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f14cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f14cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f14cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.597] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.597] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327602\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327602\\temporaryfile")) returned 1 [0258.597] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f14cb80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f14cb80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f14cb80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.598] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.598] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327602" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327602")) returned 1 [0258.598] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG") returned 0 [0258.599] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.600] WriteFile (in: hFile=0xdc, lpBuffer=0x2dd6a8*, nNumberOfBytesToWrite=0x14f90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2dd6a8*, lpNumberOfBytesWritten=0x18fdd8*=0x14f90, lpOverlapped=0x0) returned 1 [0258.602] CloseHandle (hObject=0xdc) returned 1 [0258.602] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.603] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a3f4 [0258.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a3fc) returned 0x2c8700 [0258.603] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1a3f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1a3f4, lpOverlapped=0x0) returned 1 [0258.605] CloseHandle (hObject=0xdc) returned 1 [0258.605] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg")) returned 1 [0258.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.606] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.606] GetTickCount () returned 0x4ffc1 [0258.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.607] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.607] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617\\....\\temporaryfile")) returned 0 [0258.608] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617\\temporaryfile")) returned 1 [0258.609] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.609] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.609] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.609] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.609] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.609] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.609] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.609] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617\\temporaryfile")) returned 1 [0258.610] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.610] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.610] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617")) returned 1 [0258.610] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG") returned 0 [0258.612] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.612] WriteFile (in: hFile=0xdc, lpBuffer=0x2e2b10*, nNumberOfBytesToWrite=0x1a3f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e2b10*, lpNumberOfBytesWritten=0x18fdd8*=0x1a3f8, lpOverlapped=0x0) returned 1 [0258.614] CloseHandle (hObject=0xdc) returned 1 [0258.615] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.615] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18ac4 [0258.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18acc) returned 0x2c8700 [0258.615] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x18ac4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x18ac4, lpOverlapped=0x0) returned 1 [0258.617] CloseHandle (hObject=0xdc) returned 1 [0258.617] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg")) returned 1 [0258.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.618] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.618] GetTickCount () returned 0x4ffc1 [0258.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.618] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.619] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617\\....\\temporaryfile")) returned 0 [0258.620] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617\\temporaryfile")) returned 1 [0258.621] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f198e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f198e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.621] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f198e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f198e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.621] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.621] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.621] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.622] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.622] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617\\temporaryfile")) returned 1 [0258.622] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f172ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f172ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f172ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.622] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327617" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327617")) returned 1 [0258.622] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG") returned 0 [0258.624] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.625] WriteFile (in: hFile=0xdc, lpBuffer=0x2e11e0*, nNumberOfBytesToWrite=0x18ac8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e11e0*, lpNumberOfBytesWritten=0x18fdd8*=0x18ac8, lpOverlapped=0x0) returned 1 [0258.627] CloseHandle (hObject=0xdc) returned 1 [0258.627] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.627] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1bef7 [0258.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1beff) returned 0x2c8700 [0258.628] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1bef7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1bef7, lpOverlapped=0x0) returned 1 [0258.629] CloseHandle (hObject=0xdc) returned 1 [0258.629] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg")) returned 1 [0258.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.631] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.631] GetTickCount () returned 0x4ffd1 [0258.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.632] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327633\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327633\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327633\\....\\temporaryfile")) returned 0 [0258.633] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327633\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327633\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327633\\temporaryfile")) returned 1 [0258.635] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327633\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f198e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f198e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f198e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.635] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f198e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f198e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f198e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.635] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f198e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f198e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f198e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.635] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327633\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f198e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f198e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f198e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.635] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f198e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f198e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f198e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.635] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f198e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f198e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f198e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.635] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.635] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327633\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327633\\temporaryfile")) returned 1 [0258.636] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f198e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f198e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f198e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.636] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.636] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327633" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327633")) returned 1 [0258.636] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG") returned 0 [0258.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.639] WriteFile (in: hFile=0xdc, lpBuffer=0x2e4610*, nNumberOfBytesToWrite=0x1bf00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e4610*, lpNumberOfBytesWritten=0x18fdd8*=0x1bf00, lpOverlapped=0x0) returned 1 [0258.641] CloseHandle (hObject=0xdc) returned 1 [0258.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.642] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17dee [0258.642] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17df6) returned 0x2c8700 [0258.642] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x17dee, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x17dee, lpOverlapped=0x0) returned 1 [0258.644] CloseHandle (hObject=0xdc) returned 1 [0258.644] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg")) returned 1 [0258.645] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.645] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.645] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.645] GetTickCount () returned 0x4ffe0 [0258.645] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.645] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.646] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327648\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327648\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327648\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327648\\....\\temporaryfile")) returned 0 [0258.646] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327648\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327648\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327648\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327648\\temporaryfile")) returned 1 [0258.647] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327648\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1befa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1befa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1befa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.648] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1befa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1befa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1befa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.648] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1befa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1befa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1befa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.648] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327648\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1befa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1befa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1befa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.648] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1befa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1befa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1befa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.648] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1befa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1befa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1befa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.648] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.648] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327648\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327648\\temporaryfile")) returned 1 [0258.648] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1befa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1befa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1befa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.648] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.648] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327648" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327648")) returned 1 [0258.648] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG") returned 0 [0258.650] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.651] WriteFile (in: hFile=0xdc, lpBuffer=0x2e0508*, nNumberOfBytesToWrite=0x17df8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e0508*, lpNumberOfBytesWritten=0x18fdd8*=0x17df8, lpOverlapped=0x0) returned 1 [0258.653] CloseHandle (hObject=0xdc) returned 1 [0258.653] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.653] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1bb02 [0258.653] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1bb0a) returned 0x2c8700 [0258.653] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1bb02, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1bb02, lpOverlapped=0x0) returned 1 [0258.655] CloseHandle (hObject=0xdc) returned 1 [0258.655] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg")) returned 1 [0258.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.657] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.657] GetTickCount () returned 0x4fff0 [0258.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.657] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327664\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327664\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327664\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327664\\....\\temporaryfile")) returned 0 [0258.658] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327664\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327664\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327664\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327664\\temporaryfile")) returned 1 [0258.659] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327664\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1e5100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1e5100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1e5100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.659] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1e5100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1e5100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1e5100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.659] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1e5100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1e5100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1e5100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.659] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327664\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1e5100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1e5100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1e5100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.659] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1e5100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1e5100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1e5100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.659] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1e5100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1e5100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1e5100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.659] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.660] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327664\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327664\\temporaryfile")) returned 1 [0258.660] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f1e5100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f1e5100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f1e5100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.660] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.660] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327664" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327664")) returned 1 [0258.660] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG") returned 0 [0258.662] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.662] WriteFile (in: hFile=0xdc, lpBuffer=0x2e4220*, nNumberOfBytesToWrite=0x1bb08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e4220*, lpNumberOfBytesWritten=0x18fdd8*=0x1bb08, lpOverlapped=0x0) returned 1 [0258.665] CloseHandle (hObject=0xdc) returned 1 [0258.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.665] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18888 [0258.665] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18890) returned 0x2c8700 [0258.665] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x18888, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x18888, lpOverlapped=0x0) returned 1 [0258.667] CloseHandle (hObject=0xdc) returned 1 [0258.667] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg")) returned 1 [0258.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.669] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.669] GetTickCount () returned 0x50000 [0258.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.670] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327680\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327680\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327680\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327680\\....\\temporaryfile")) returned 0 [0258.671] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327680\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327680\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327680\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327680\\temporaryfile")) returned 1 [0258.672] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327680\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f20b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f20b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f20b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.672] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f20b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f20b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f20b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.672] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f20b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f20b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f20b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.672] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327680\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f20b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f20b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f20b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.672] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f20b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f20b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f20b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.673] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f20b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f20b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f20b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.673] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.673] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327680\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327680\\temporaryfile")) returned 1 [0258.673] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f20b260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f20b260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f20b260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.673] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.673] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327680" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327680")) returned 1 [0258.673] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG") returned 0 [0258.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.676] WriteFile (in: hFile=0xdc, lpBuffer=0x2e0fa0*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e0fa0*, lpNumberOfBytesWritten=0x18fdd8*=0x18890, lpOverlapped=0x0) returned 1 [0258.678] CloseHandle (hObject=0xdc) returned 1 [0258.678] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.680] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16d08 [0258.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16d10) returned 0x2c8700 [0258.680] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x16d08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x16d08, lpOverlapped=0x0) returned 1 [0258.682] CloseHandle (hObject=0xdc) returned 1 [0258.682] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg")) returned 1 [0258.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.684] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.684] GetTickCount () returned 0x5000f [0258.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.684] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695\\....\\temporaryfile")) returned 0 [0258.685] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695\\temporaryfile")) returned 1 [0258.686] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.687] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.687] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.687] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.687] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.687] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695\\temporaryfile")) returned 1 [0258.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.687] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.687] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695")) returned 1 [0258.687] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG") returned 0 [0258.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.689] WriteFile (in: hFile=0xdc, lpBuffer=0x2df420*, nNumberOfBytesToWrite=0x16d10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2df420*, lpNumberOfBytesWritten=0x18fdd8*=0x16d10, lpOverlapped=0x0) returned 1 [0258.691] CloseHandle (hObject=0xdc) returned 1 [0258.691] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.692] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b75f [0258.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b767) returned 0x2c8700 [0258.692] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1b75f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1b75f, lpOverlapped=0x0) returned 1 [0258.694] CloseHandle (hObject=0xdc) returned 1 [0258.694] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg")) returned 1 [0258.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.695] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.695] GetTickCount () returned 0x5000f [0258.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.696] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.696] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695\\....\\temporaryfile")) returned 0 [0258.697] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695\\temporaryfile")) returned 1 [0258.698] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.698] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.698] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.698] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.698] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.698] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.698] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.698] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695\\temporaryfile")) returned 1 [0258.699] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2313c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2313c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2313c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.699] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.699] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327695" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327695")) returned 1 [0258.699] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG") returned 0 [0258.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.704] WriteFile (in: hFile=0xdc, lpBuffer=0x2e3e78*, nNumberOfBytesToWrite=0x1b768, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e3e78*, lpNumberOfBytesWritten=0x18fdd8*=0x1b768, lpOverlapped=0x0) returned 1 [0258.707] CloseHandle (hObject=0xdc) returned 1 [0258.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.708] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1779f [0258.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x177a7) returned 0x2c8700 [0258.708] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1779f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1779f, lpOverlapped=0x0) returned 1 [0258.710] CloseHandle (hObject=0xdc) returned 1 [0258.710] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg")) returned 1 [0258.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.711] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.711] GetTickCount () returned 0x5001f [0258.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.712] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327711\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327711\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.712] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327711\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327711\\....\\temporaryfile")) returned 0 [0258.712] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327711\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327711\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327711\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327711\\temporaryfile")) returned 1 [0258.714] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327711\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f257520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f257520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f257520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f257520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f257520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f257520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f257520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f257520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f257520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.714] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327711\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f257520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f257520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f257520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.714] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f257520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f257520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f257520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.714] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f257520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f257520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f257520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.714] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.714] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327711\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327711\\temporaryfile")) returned 1 [0258.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f257520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f257520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f257520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.714] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.715] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327711" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327711")) returned 1 [0258.715] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG") returned 0 [0258.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.717] WriteFile (in: hFile=0xdc, lpBuffer=0x2dfeb8*, nNumberOfBytesToWrite=0x177a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2dfeb8*, lpNumberOfBytesWritten=0x18fdd8*=0x177a8, lpOverlapped=0x0) returned 1 [0258.719] CloseHandle (hObject=0xdc) returned 1 [0258.719] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.719] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15b94 [0258.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15b9c) returned 0x2c8700 [0258.720] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x15b94, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x15b94, lpOverlapped=0x0) returned 1 [0258.721] CloseHandle (hObject=0xdc) returned 1 [0258.721] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg")) returned 1 [0258.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.722] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.722] GetTickCount () returned 0x5002e [0258.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.723] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327726\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327726\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327726\\....\\temporaryfile")) returned 0 [0258.724] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327726\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327726\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327726\\temporaryfile")) returned 1 [0258.725] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327726\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f27d680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f27d680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f27d680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.725] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f27d680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f27d680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f27d680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.725] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f27d680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f27d680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f27d680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.725] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327726\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f27d680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f27d680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f27d680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.725] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f27d680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f27d680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f27d680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.725] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f27d680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f27d680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f27d680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.725] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327726\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327726\\temporaryfile")) returned 1 [0258.726] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f27d680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f27d680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f27d680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.726] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.726] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327726" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327726")) returned 1 [0258.726] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG") returned 0 [0258.727] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.728] WriteFile (in: hFile=0xdc, lpBuffer=0x2de2b0*, nNumberOfBytesToWrite=0x15b98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2de2b0*, lpNumberOfBytesWritten=0x18fdd8*=0x15b98, lpOverlapped=0x0) returned 1 [0258.730] CloseHandle (hObject=0xdc) returned 1 [0258.730] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.731] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x190e9 [0258.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x190f1) returned 0x2c8700 [0258.731] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x190e9, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x190e9, lpOverlapped=0x0) returned 1 [0258.732] CloseHandle (hObject=0xdc) returned 1 [0258.732] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg")) returned 1 [0258.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.734] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.734] GetTickCount () returned 0x5003e [0258.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.735] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327742\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327742\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327742\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327742\\....\\temporaryfile")) returned 0 [0258.735] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327742\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327742\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327742\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327742\\temporaryfile")) returned 1 [0258.736] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327742\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2a37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2a37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2a37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2a37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2a37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2a37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2a37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2a37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2a37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.736] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327742\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2a37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2a37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2a37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2a37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2a37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2a37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.737] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2a37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2a37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2a37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.737] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327742\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327742\\temporaryfile")) returned 1 [0258.737] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2a37e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2a37e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2a37e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.737] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.737] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327742" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327742")) returned 1 [0258.737] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG") returned 0 [0258.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.739] WriteFile (in: hFile=0xdc, lpBuffer=0x2e1808*, nNumberOfBytesToWrite=0x190f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e1808*, lpNumberOfBytesWritten=0x18fdd8*=0x190f0, lpOverlapped=0x0) returned 1 [0258.741] CloseHandle (hObject=0xdc) returned 1 [0258.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.742] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17b79 [0258.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17b81) returned 0x2c8700 [0258.742] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x17b79, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x17b79, lpOverlapped=0x0) returned 1 [0258.745] CloseHandle (hObject=0xdc) returned 1 [0258.745] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg")) returned 1 [0258.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.747] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.747] GetTickCount () returned 0x5004e [0258.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.747] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.747] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758\\....\\temporaryfile")) returned 0 [0258.748] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758\\temporaryfile")) returned 1 [0258.749] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.749] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.749] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.749] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.749] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.749] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.749] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.749] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758\\temporaryfile")) returned 1 [0258.750] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.750] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.750] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758")) returned 1 [0258.750] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG") returned 0 [0258.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.752] WriteFile (in: hFile=0xdc, lpBuffer=0x2e0298*, nNumberOfBytesToWrite=0x17b80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e0298*, lpNumberOfBytesWritten=0x18fdd8*=0x17b80, lpOverlapped=0x0) returned 1 [0258.754] CloseHandle (hObject=0xdc) returned 1 [0258.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.755] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14033 [0258.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1403b) returned 0x2c8700 [0258.755] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x14033, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x14033, lpOverlapped=0x0) returned 1 [0258.757] CloseHandle (hObject=0xdc) returned 1 [0258.757] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg")) returned 1 [0258.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.758] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.758] GetTickCount () returned 0x5004e [0258.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.759] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758\\....\\temporaryfile")) returned 0 [0258.759] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758\\temporaryfile")) returned 1 [0258.761] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.761] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.761] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.761] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.761] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.761] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.761] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.762] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758\\temporaryfile")) returned 1 [0258.762] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2c9940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2c9940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2c9940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.762] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.762] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327758" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327758")) returned 1 [0258.762] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG") returned 0 [0258.764] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.768] WriteFile (in: hFile=0xdc, lpBuffer=0x2dc750*, nNumberOfBytesToWrite=0x14038, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2dc750*, lpNumberOfBytesWritten=0x18fdd8*=0x14038, lpOverlapped=0x0) returned 1 [0258.770] CloseHandle (hObject=0xdc) returned 1 [0258.771] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.771] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd8f6 [0258.771] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd8fe) returned 0x2c8700 [0258.771] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xd8f6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xd8f6, lpOverlapped=0x0) returned 1 [0258.773] CloseHandle (hObject=0xdc) returned 1 [0258.773] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg")) returned 1 [0258.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.774] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.774] GetTickCount () returned 0x5005d [0258.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.774] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327773\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327773\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.775] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327773\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327773\\....\\temporaryfile")) returned 0 [0258.775] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327773\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327773\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327773\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327773\\temporaryfile")) returned 1 [0258.776] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327773\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2efaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2efaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2efaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2efaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2efaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2efaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2efaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2efaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2efaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327773\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2efaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2efaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2efaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.777] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2efaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2efaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2efaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.777] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2efaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2efaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2efaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.777] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327773\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327773\\temporaryfile")) returned 1 [0258.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f2efaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f2efaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f2efaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.777] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327773" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327773")) returned 1 [0258.777] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG") returned 0 [0258.778] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.779] WriteFile (in: hFile=0xdc, lpBuffer=0x2d6010*, nNumberOfBytesToWrite=0xd900, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d6010*, lpNumberOfBytesWritten=0x18fdd8*=0xd900, lpOverlapped=0x0) returned 1 [0258.781] CloseHandle (hObject=0xdc) returned 1 [0258.781] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.782] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x11780 [0258.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11788) returned 0x2c8700 [0258.782] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x11780, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x11780, lpOverlapped=0x0) returned 1 [0258.784] CloseHandle (hObject=0xdc) returned 1 [0258.784] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg")) returned 1 [0258.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.785] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.785] GetTickCount () returned 0x5006d [0258.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.786] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327789\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327789\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327789\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327789\\....\\temporaryfile")) returned 0 [0258.787] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327789\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327789\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327789\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327789\\temporaryfile")) returned 1 [0258.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327789\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f315c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f315c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f315c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f315c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f315c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f315c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f315c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f315c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f315c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327789\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f315c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f315c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f315c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.788] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f315c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f315c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f315c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.788] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f315c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f315c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f315c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.789] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327789\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327789\\temporaryfile")) returned 1 [0258.789] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f315c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f315c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f315c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.789] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327789" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327789")) returned 1 [0258.789] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG") returned 0 [0258.790] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.791] WriteFile (in: hFile=0xdc, lpBuffer=0x2d9e98*, nNumberOfBytesToWrite=0x11788, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d9e98*, lpNumberOfBytesWritten=0x18fdd8*=0x11788, lpOverlapped=0x0) returned 1 [0258.793] CloseHandle (hObject=0xdc) returned 1 [0258.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.794] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x787a [0258.794] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7882) returned 0x2c8700 [0258.794] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x787a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x787a, lpOverlapped=0x0) returned 1 [0258.795] CloseHandle (hObject=0xdc) returned 1 [0258.795] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg")) returned 1 [0258.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.796] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.796] GetTickCount () returned 0x5007c [0258.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.797] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.797] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.797] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804\\....\\temporaryfile")) returned 0 [0258.797] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804\\temporaryfile")) returned 1 [0258.799] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f33bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f33bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f33bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.799] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f33bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f33bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f33bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.799] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f33bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f33bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f33bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.799] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f33bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f33bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f33bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.799] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f33bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f33bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f33bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.799] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f33bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f33bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f33bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.799] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.799] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804\\temporaryfile")) returned 1 [0258.799] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f33bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f33bd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f33bd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.799] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.799] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804")) returned 1 [0258.800] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG") returned 0 [0258.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.801] WriteFile (in: hFile=0xdc, lpBuffer=0x2cff98*, nNumberOfBytesToWrite=0x7880, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cff98*, lpNumberOfBytesWritten=0x18fdd8*=0x7880, lpOverlapped=0x0) returned 1 [0258.802] CloseHandle (hObject=0xdc) returned 1 [0258.802] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.803] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa91e [0258.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa926) returned 0x2c8700 [0258.803] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa91e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa91e, lpOverlapped=0x0) returned 1 [0258.805] CloseHandle (hObject=0xdc) returned 1 [0258.805] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg")) returned 1 [0258.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.806] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.806] GetTickCount () returned 0x5007c [0258.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.807] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.808] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804\\....\\temporaryfile")) returned 0 [0258.808] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804\\temporaryfile")) returned 1 [0258.809] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f33bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.809] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f33bd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.809] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.809] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.809] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.809] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.810] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.810] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804\\temporaryfile")) returned 1 [0258.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.810] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.810] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327804" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327804")) returned 1 [0258.810] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG") returned 0 [0258.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.811] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3038*, nNumberOfBytesToWrite=0xa928, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3038*, lpNumberOfBytesWritten=0x18fdd8*=0xa928, lpOverlapped=0x0) returned 1 [0258.813] CloseHandle (hObject=0xdc) returned 1 [0258.813] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.814] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3b43 [0258.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3b4b) returned 0x2c8700 [0258.814] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3b43, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3b43, lpOverlapped=0x0) returned 1 [0258.816] CloseHandle (hObject=0xdc) returned 1 [0258.816] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg")) returned 1 [0258.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.817] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.817] GetTickCount () returned 0x5008c [0258.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.817] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327820\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327820\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.818] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327820\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327820\\....\\temporaryfile")) returned 0 [0258.818] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327820\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327820\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327820\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327820\\temporaryfile")) returned 1 [0258.819] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327820\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.819] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.820] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.820] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327820\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.820] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.820] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.820] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.820] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327820\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327820\\temporaryfile")) returned 1 [0258.820] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f361ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f361ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f361ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.820] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.820] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327820" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327820")) returned 1 [0258.820] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG") returned 0 [0258.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.821] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc260*, nNumberOfBytesToWrite=0x3b48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc260*, lpNumberOfBytesWritten=0x18fdd8*=0x3b48, lpOverlapped=0x0) returned 1 [0258.822] CloseHandle (hObject=0xdc) returned 1 [0258.823] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.823] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x396a [0258.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3972) returned 0x2c8700 [0258.823] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x396a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x396a, lpOverlapped=0x0) returned 1 [0258.824] CloseHandle (hObject=0xdc) returned 1 [0258.825] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg")) returned 1 [0258.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.826] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.826] GetTickCount () returned 0x5009c [0258.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.826] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.826] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836\\....\\temporaryfile")) returned 0 [0258.827] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836\\temporaryfile")) returned 1 [0258.828] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.828] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.828] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.828] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.828] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.828] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.828] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.828] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836\\temporaryfile")) returned 1 [0258.829] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.829] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.829] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836")) returned 1 [0258.829] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG") returned 0 [0258.829] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.830] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc088*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc088*, lpNumberOfBytesWritten=0x18fdd8*=0x3970, lpOverlapped=0x0) returned 1 [0258.832] CloseHandle (hObject=0xdc) returned 1 [0258.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.832] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x693e [0258.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6946) returned 0x2c8700 [0258.832] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x693e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x693e, lpOverlapped=0x0) returned 1 [0258.834] CloseHandle (hObject=0xdc) returned 1 [0258.834] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg")) returned 1 [0258.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.835] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.835] GetTickCount () returned 0x5009c [0258.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.835] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.836] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836\\....\\temporaryfile")) returned 0 [0258.836] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836\\temporaryfile")) returned 1 [0258.838] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.838] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.838] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.838] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.838] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.838] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.838] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.838] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836\\temporaryfile")) returned 1 [0258.838] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f388020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f388020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f388020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.838] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.838] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327836" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327836")) returned 1 [0258.838] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG") returned 0 [0258.839] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.840] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf058*, nNumberOfBytesToWrite=0x6948, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf058*, lpNumberOfBytesWritten=0x18fdd8*=0x6948, lpOverlapped=0x0) returned 1 [0258.841] CloseHandle (hObject=0xdc) returned 1 [0258.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.842] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcb0a [0258.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcb12) returned 0x2c8700 [0258.842] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xcb0a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xcb0a, lpOverlapped=0x0) returned 1 [0258.844] CloseHandle (hObject=0xdc) returned 1 [0258.844] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg")) returned 1 [0258.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.845] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.845] GetTickCount () returned 0x500ab [0258.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.845] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327851\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327851\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327851\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327851\\....\\temporaryfile")) returned 0 [0258.846] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327851\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327851\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327851\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327851\\temporaryfile")) returned 1 [0258.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327851\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3ae180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3ae180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3ae180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.847] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3ae180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3ae180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3ae180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.847] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3ae180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3ae180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3ae180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327851\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3ae180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3ae180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3ae180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.848] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3ae180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3ae180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3ae180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.848] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3ae180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3ae180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3ae180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.848] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327851\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327851\\temporaryfile")) returned 1 [0258.848] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3ae180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3ae180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3ae180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.848] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327851" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327851")) returned 1 [0258.848] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG") returned 0 [0258.849] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.850] WriteFile (in: hFile=0xdc, lpBuffer=0x2d5228*, nNumberOfBytesToWrite=0xcb10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d5228*, lpNumberOfBytesWritten=0x18fdd8*=0xcb10, lpOverlapped=0x0) returned 1 [0258.851] CloseHandle (hObject=0xdc) returned 1 [0258.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.852] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6cec [0258.852] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6cf4) returned 0x2c8700 [0258.852] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6cec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6cec, lpOverlapped=0x0) returned 1 [0258.853] CloseHandle (hObject=0xdc) returned 1 [0258.853] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg")) returned 1 [0258.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.855] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.855] GetTickCount () returned 0x500bb [0258.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.855] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867\\....\\temporaryfile")) returned 0 [0258.856] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867\\temporaryfile")) returned 1 [0258.857] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.857] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.858] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.858] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.858] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.858] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867\\temporaryfile")) returned 1 [0258.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.858] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.858] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867")) returned 1 [0258.858] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG") returned 0 [0258.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.859] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf408*, nNumberOfBytesToWrite=0x6cf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf408*, lpNumberOfBytesWritten=0x18fdd8*=0x6cf0, lpOverlapped=0x0) returned 1 [0258.861] CloseHandle (hObject=0xdc) returned 1 [0258.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.862] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x98c7 [0258.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x98cf) returned 0x2c8700 [0258.862] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x98c7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x98c7, lpOverlapped=0x0) returned 1 [0258.866] CloseHandle (hObject=0xdc) returned 1 [0258.866] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg")) returned 1 [0258.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.867] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.867] GetTickCount () returned 0x500bb [0258.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.868] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867\\....\\temporaryfile")) returned 0 [0258.869] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867\\temporaryfile")) returned 1 [0258.870] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.870] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.870] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.871] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.871] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.871] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867\\temporaryfile")) returned 1 [0258.871] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3d42e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3d42e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3d42e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.871] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.871] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327867" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327867")) returned 1 [0258.871] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG") returned 0 [0258.872] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.872] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1fe0*, nNumberOfBytesToWrite=0x98d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1fe0*, lpNumberOfBytesWritten=0x18fdd8*=0x98d0, lpOverlapped=0x0) returned 1 [0258.874] CloseHandle (hObject=0xdc) returned 1 [0258.874] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.875] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb9bf [0258.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb9c7) returned 0x2c8700 [0258.875] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb9bf, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb9bf, lpOverlapped=0x0) returned 1 [0258.876] CloseHandle (hObject=0xdc) returned 1 [0258.876] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg")) returned 1 [0258.877] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.877] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.878] GetTickCount () returned 0x500ca [0258.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.878] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327882\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327882\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327882\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327882\\....\\temporaryfile")) returned 0 [0258.879] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327882\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327882\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327882\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327882\\temporaryfile")) returned 1 [0258.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327882\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3fa440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3fa440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3fa440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.880] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3fa440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3fa440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3fa440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.880] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3fa440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3fa440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3fa440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.880] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327882\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3fa440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3fa440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3fa440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.880] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3fa440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3fa440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3fa440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.881] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3fa440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3fa440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3fa440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.881] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.881] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327882\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327882\\temporaryfile")) returned 1 [0258.881] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f3fa440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f3fa440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f3fa440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.881] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.881] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327882" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327882")) returned 1 [0258.881] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG") returned 0 [0258.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.883] WriteFile (in: hFile=0xdc, lpBuffer=0x2d40d8*, nNumberOfBytesToWrite=0xb9c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d40d8*, lpNumberOfBytesWritten=0x18fdd8*=0xb9c8, lpOverlapped=0x0) returned 1 [0258.884] CloseHandle (hObject=0xdc) returned 1 [0258.884] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.885] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x98ec [0258.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x98f4) returned 0x2c8700 [0258.885] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x98ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x98ec, lpOverlapped=0x0) returned 1 [0258.886] CloseHandle (hObject=0xdc) returned 1 [0258.886] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg")) returned 1 [0258.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.887] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.887] GetTickCount () returned 0x500da [0258.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.888] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.888] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898\\....\\temporaryfile")) returned 0 [0258.888] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898\\temporaryfile")) returned 1 [0258.890] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.890] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.890] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.890] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.890] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.890] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.890] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.890] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898\\temporaryfile")) returned 1 [0258.891] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.891] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.891] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898")) returned 1 [0258.891] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG") returned 0 [0258.892] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.892] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2008*, nNumberOfBytesToWrite=0x98f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2008*, lpNumberOfBytesWritten=0x18fdd8*=0x98f0, lpOverlapped=0x0) returned 1 [0258.893] CloseHandle (hObject=0xdc) returned 1 [0258.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.895] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7df3 [0258.895] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dfb) returned 0x2c8700 [0258.895] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7df3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7df3, lpOverlapped=0x0) returned 1 [0258.896] CloseHandle (hObject=0xdc) returned 1 [0258.896] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg")) returned 1 [0258.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.897] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.897] GetTickCount () returned 0x500da [0258.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.897] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.898] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898\\....\\temporaryfile")) returned 0 [0258.899] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898\\temporaryfile")) returned 1 [0258.900] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.900] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.900] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.900] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.900] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.900] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.900] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.901] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898\\temporaryfile")) returned 1 [0258.901] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4205a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4205a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4205a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.901] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.901] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327898" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327898")) returned 1 [0258.901] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG") returned 0 [0258.902] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.902] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0510*, nNumberOfBytesToWrite=0x7df8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0510*, lpNumberOfBytesWritten=0x18fdd8*=0x7df8, lpOverlapped=0x0) returned 1 [0258.903] CloseHandle (hObject=0xdc) returned 1 [0258.904] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.904] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x351c [0258.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3524) returned 0x2c8700 [0258.904] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x351c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x351c, lpOverlapped=0x0) returned 1 [0258.906] CloseHandle (hObject=0xdc) returned 1 [0258.906] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg")) returned 1 [0258.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.907] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.907] GetTickCount () returned 0x500ea [0258.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.907] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327914\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327914\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327914\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327914\\....\\temporaryfile")) returned 0 [0258.908] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327914\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327914\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327914\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327914\\temporaryfile")) returned 1 [0258.909] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327914\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f446700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f446700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f446700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f446700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f446700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f446700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.909] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f446700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f446700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f446700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.909] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327914\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f446700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f446700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f446700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.909] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f446700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f446700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f446700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.909] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f446700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f446700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f446700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.909] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.909] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327914\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327914\\temporaryfile")) returned 1 [0258.910] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f446700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f446700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f446700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.910] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.910] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327914" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327914")) returned 1 [0258.910] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG") returned 0 [0258.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.911] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbc38*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbc38*, lpNumberOfBytesWritten=0x18fdd8*=0x3520, lpOverlapped=0x0) returned 1 [0258.912] CloseHandle (hObject=0xdc) returned 1 [0258.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.913] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x31883 [0258.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3188b) returned 0x2c8700 [0258.913] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x31883, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x31883, lpOverlapped=0x0) returned 1 [0258.915] CloseHandle (hObject=0xdc) returned 1 [0258.915] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png")) returned 1 [0258.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.917] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.917] GetTickCount () returned 0x500f9 [0258.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.918] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327929\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327929\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.921] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327929\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327929\\....\\temporaryfile")) returned 0 [0258.922] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327929\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327929\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327929\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327929\\temporaryfile")) returned 1 [0258.923] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327929\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f46c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f46c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f46c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.923] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f46c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f46c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f46c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.923] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f46c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f46c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f46c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.923] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327929\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f46c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f46c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f46c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.923] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f46c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f46c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f46c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.923] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f46c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f46c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f46c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.923] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.923] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327929\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327929\\temporaryfile")) returned 1 [0258.924] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f46c860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f46c860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f46c860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.924] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.924] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327929" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327929")) returned 1 [0258.924] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG") returned 0 [0258.930] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.930] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x31888, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x31888, lpOverlapped=0x0) returned 1 [0258.934] CloseHandle (hObject=0xdc) returned 1 [0258.934] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.935] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15d49 [0258.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15d51) returned 0x2350048 [0258.935] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x15d49, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x15d49, lpOverlapped=0x0) returned 1 [0258.937] CloseHandle (hObject=0xdc) returned 1 [0258.937] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png")) returned 1 [0258.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.938] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.938] GetTickCount () returned 0x50109 [0258.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.939] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327945\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327945\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327945\\....\\temporaryfile")) returned 0 [0258.939] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327945\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327945\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327945\\temporaryfile")) returned 1 [0258.941] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327945\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4929c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4929c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4929c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.941] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4929c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4929c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4929c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.941] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4929c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4929c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4929c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.941] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327945\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4929c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4929c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4929c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.941] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4929c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4929c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4929c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.941] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4929c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4929c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4929c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.941] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.941] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327945\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327945\\temporaryfile")) returned 1 [0258.942] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4929c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4929c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4929c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.942] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.942] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327945" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327945")) returned 1 [0258.942] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG") returned 0 [0258.943] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.944] WriteFile (in: hFile=0xdc, lpBuffer=0x2365db0*, nNumberOfBytesToWrite=0x15d50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2365db0*, lpNumberOfBytesWritten=0x18fdd8*=0x15d50, lpOverlapped=0x0) returned 1 [0258.946] CloseHandle (hObject=0xdc) returned 1 [0258.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.948] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e836 [0258.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e83e) returned 0x2350048 [0258.948] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x1e836, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x1e836, lpOverlapped=0x0) returned 1 [0258.950] CloseHandle (hObject=0xdc) returned 1 [0258.950] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png")) returned 1 [0258.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.952] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.952] GetTickCount () returned 0x50118 [0258.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.952] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327960\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327960\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327960\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327960\\....\\temporaryfile")) returned 0 [0258.953] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327960\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327960\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327960\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327960\\temporaryfile")) returned 1 [0258.954] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327960\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4b8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4b8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4b8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.954] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4b8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4b8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4b8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.954] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4b8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4b8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4b8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.954] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327960\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4b8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4b8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4b8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.954] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4b8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4b8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4b8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.954] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4b8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4b8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4b8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.955] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.955] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327960\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327960\\temporaryfile")) returned 1 [0258.955] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4b8b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4b8b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4b8b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.955] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.955] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327960" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327960")) returned 1 [0258.955] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG") returned 0 [0258.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.958] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1e840, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1e840, lpOverlapped=0x0) returned 1 [0258.960] CloseHandle (hObject=0xdc) returned 1 [0258.961] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.961] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x19a5d [0258.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19a65) returned 0x2350048 [0258.961] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x19a5d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x19a5d, lpOverlapped=0x0) returned 1 [0258.963] CloseHandle (hObject=0xdc) returned 1 [0258.963] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png")) returned 1 [0258.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.964] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.965] GetTickCount () returned 0x50128 [0258.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.965] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976\\....\\temporaryfile")) returned 0 [0258.966] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976\\temporaryfile")) returned 1 [0258.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.967] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.967] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.967] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.967] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.967] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.967] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976\\temporaryfile")) returned 1 [0258.968] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.968] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.968] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976")) returned 1 [0258.968] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG") returned 0 [0258.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.970] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x19a68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x19a68, lpOverlapped=0x0) returned 1 [0258.973] CloseHandle (hObject=0xdc) returned 1 [0258.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.973] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17742 [0258.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1774a) returned 0x2350048 [0258.974] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x17742, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x17742, lpOverlapped=0x0) returned 1 [0258.975] CloseHandle (hObject=0xdc) returned 1 [0258.975] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png")) returned 1 [0258.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.977] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.977] GetTickCount () returned 0x50128 [0258.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.977] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.978] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976\\....\\temporaryfile")) returned 0 [0258.978] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976\\temporaryfile")) returned 1 [0258.980] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.980] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.980] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.980] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.980] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.980] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.980] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.980] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976\\temporaryfile")) returned 1 [0258.980] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f4dec80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f4dec80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f4dec80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.980] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.980] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327976" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327976")) returned 1 [0258.981] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG") returned 0 [0258.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.983] WriteFile (in: hFile=0xdc, lpBuffer=0x23677a8*, nNumberOfBytesToWrite=0x17748, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23677a8*, lpNumberOfBytesWritten=0x18fdd8*=0x17748, lpOverlapped=0x0) returned 1 [0258.985] CloseHandle (hObject=0xdc) returned 1 [0258.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.986] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2645 [0258.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x264d) returned 0x2350048 [0258.986] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x2645, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x2645, lpOverlapped=0x0) returned 1 [0258.987] CloseHandle (hObject=0xdc) returned 1 [0258.987] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 1 [0258.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0258.988] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.988] GetTickCount () returned 0x50138 [0258.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.989] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327992\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327992\\...."), lpSecurityAttributes=0x256210) returned 1 [0258.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327992\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327992\\....\\temporaryfile")) returned 0 [0258.989] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327992\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327992\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327992\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327992\\temporaryfile")) returned 1 [0258.991] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327992\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f504de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f504de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f504de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0258.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f504de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f504de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f504de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f504de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f504de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f504de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0258.991] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327992\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f504de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f504de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f504de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0258.991] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f504de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f504de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f504de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.991] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f504de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f504de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f504de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.991] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0258.991] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327992\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327992\\temporaryfile")) returned 1 [0258.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f504de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f504de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f504de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0258.991] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0258.991] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18327992" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18327992")) returned 1 [0258.992] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 0 [0258.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.993] WriteFile (in: hFile=0xdc, lpBuffer=0x23526a8*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23526a8*, lpNumberOfBytesWritten=0x18fdd8*=0x2650, lpOverlapped=0x0) returned 1 [0258.994] CloseHandle (hObject=0xdc) returned 1 [0258.994] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0258.995] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16d3 [0258.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16db) returned 0x2c4a70 [0258.995] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16d3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16d3, lpOverlapped=0x0) returned 1 [0258.996] CloseHandle (hObject=0xdc) returned 1 [0258.996] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0258.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0258.997] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0258.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0258.997] GetTickCount () returned 0x50147 [0258.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0258.997] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0258.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0258.998] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007\\...."), lpSecurityAttributes=0x256228) returned 1 [0258.998] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007\\....\\temporaryfile")) returned 0 [0258.998] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007\\temporaryfile")) returned 1 [0258.999] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.000] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.000] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.000] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.000] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.000] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.000] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.000] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007\\temporaryfile")) returned 1 [0259.000] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.000] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.000] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007")) returned 1 [0259.000] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 0 [0259.001] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.001] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x16d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x16d8, lpOverlapped=0x0) returned 1 [0259.003] CloseHandle (hObject=0xdc) returned 1 [0259.003] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.004] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15f6 [0259.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15fe) returned 0x2c4a70 [0259.004] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x15f6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x15f6, lpOverlapped=0x0) returned 1 [0259.006] CloseHandle (hObject=0xdc) returned 1 [0259.006] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf")) returned 1 [0259.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.007] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.007] GetTickCount () returned 0x50147 [0259.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.008] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.008] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007\\....\\temporaryfile")) returned 0 [0259.009] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007\\temporaryfile")) returned 1 [0259.010] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.010] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.010] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.010] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.010] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.010] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.010] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.010] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007\\temporaryfile")) returned 1 [0259.011] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f52af40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f52af40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f52af40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.011] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.011] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328007" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328007")) returned 1 [0259.011] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF") returned 0 [0259.011] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.012] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x1600, lpOverlapped=0x0) returned 1 [0259.013] CloseHandle (hObject=0xdc) returned 1 [0259.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.014] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1090 [0259.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1098) returned 0x25b528 [0259.014] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1090, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1090, lpOverlapped=0x0) returned 1 [0259.016] CloseHandle (hObject=0xdc) returned 1 [0259.016] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf")) returned 1 [0259.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.017] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.017] GetTickCount () returned 0x50157 [0259.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.018] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328023\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328023\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328023\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328023\\....\\temporaryfile")) returned 0 [0259.018] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328023\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328023\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328023\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328023\\temporaryfile")) returned 1 [0259.019] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328023\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5510a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5510a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5510a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.020] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5510a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5510a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5510a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.020] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5510a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5510a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5510a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.020] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328023\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5510a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5510a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5510a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.020] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5510a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5510a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5510a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.020] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5510a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5510a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5510a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.020] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.020] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328023\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328023\\temporaryfile")) returned 1 [0259.020] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5510a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5510a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5510a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.020] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.020] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328023" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328023")) returned 1 [0259.020] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF") returned 0 [0259.021] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.021] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1098, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1098, lpOverlapped=0x0) returned 1 [0259.022] CloseHandle (hObject=0xdc) returned 1 [0259.022] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.023] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x31e2 [0259.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x31ea) returned 0x2350048 [0259.023] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x31e2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x31e2, lpOverlapped=0x0) returned 1 [0259.024] CloseHandle (hObject=0xdc) returned 1 [0259.024] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf")) returned 1 [0259.025] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.025] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.026] GetTickCount () returned 0x50166 [0259.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.026] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038\\....\\temporaryfile")) returned 0 [0259.027] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038\\temporaryfile")) returned 1 [0259.028] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.028] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.028] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.028] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.028] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.028] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.028] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.028] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038\\temporaryfile")) returned 1 [0259.029] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.029] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.029] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038")) returned 1 [0259.029] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF") returned 0 [0259.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.030] WriteFile (in: hFile=0xdc, lpBuffer=0x2353248*, nNumberOfBytesToWrite=0x31e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2353248*, lpNumberOfBytesWritten=0x18fdd8*=0x31e8, lpOverlapped=0x0) returned 1 [0259.031] CloseHandle (hObject=0xdc) returned 1 [0259.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.032] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ae0 [0259.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ae8) returned 0x2c4a70 [0259.032] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1ae0, lpOverlapped=0x0) returned 1 [0259.034] CloseHandle (hObject=0xdc) returned 1 [0259.034] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1 [0259.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.035] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.035] GetTickCount () returned 0x50166 [0259.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.035] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038\\....\\temporaryfile")) returned 0 [0259.036] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038\\temporaryfile")) returned 1 [0259.037] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.037] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.037] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.038] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.038] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.038] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.038] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038\\temporaryfile")) returned 1 [0259.038] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f577200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f577200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f577200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.038] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328038" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328038")) returned 1 [0259.038] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 0 [0259.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.039] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x1ae8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x1ae8, lpOverlapped=0x0) returned 1 [0259.040] CloseHandle (hObject=0xdc) returned 1 [0259.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.041] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5044 [0259.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x504c) returned 0x2350048 [0259.041] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x5044, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x5044, lpOverlapped=0x0) returned 1 [0259.043] CloseHandle (hObject=0xdc) returned 1 [0259.043] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf")) returned 1 [0259.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.044] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.044] GetTickCount () returned 0x50176 [0259.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.044] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054\\....\\temporaryfile")) returned 0 [0259.045] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054\\temporaryfile")) returned 1 [0259.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.046] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.046] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.046] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.046] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.046] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054\\temporaryfile")) returned 1 [0259.047] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.047] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054")) returned 1 [0259.047] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF") returned 0 [0259.048] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.048] WriteFile (in: hFile=0xdc, lpBuffer=0x23550a8*, nNumberOfBytesToWrite=0x5048, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23550a8*, lpNumberOfBytesWritten=0x18fdd8*=0x5048, lpOverlapped=0x0) returned 1 [0259.049] CloseHandle (hObject=0xdc) returned 1 [0259.050] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.050] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a42 [0259.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a4a) returned 0x2350048 [0259.050] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x2a42, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x2a42, lpOverlapped=0x0) returned 1 [0259.052] CloseHandle (hObject=0xdc) returned 1 [0259.052] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf")) returned 1 [0259.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.053] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.053] GetTickCount () returned 0x50176 [0259.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.054] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054\\....\\temporaryfile")) returned 0 [0259.054] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054\\temporaryfile")) returned 1 [0259.056] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.056] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.056] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.056] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.056] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.056] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.056] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.056] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054\\temporaryfile")) returned 1 [0259.056] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f59d360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f59d360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f59d360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.056] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.056] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328054" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328054")) returned 1 [0259.057] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF") returned 0 [0259.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.058] WriteFile (in: hFile=0xdc, lpBuffer=0x2352aa8*, nNumberOfBytesToWrite=0x2a48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2352aa8*, lpNumberOfBytesWritten=0x18fdd8*=0x2a48, lpOverlapped=0x0) returned 1 [0259.059] CloseHandle (hObject=0xdc) returned 1 [0259.059] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.059] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xeaa [0259.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xeb2) returned 0x2450048 [0259.059] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xeaa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xeaa, lpOverlapped=0x0) returned 1 [0259.061] CloseHandle (hObject=0xdc) returned 1 [0259.061] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf")) returned 1 [0259.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.062] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.062] GetTickCount () returned 0x50186 [0259.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.062] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070\\....\\temporaryfile")) returned 0 [0259.063] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070\\temporaryfile")) returned 1 [0259.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.064] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.064] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.065] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.065] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070\\temporaryfile")) returned 1 [0259.065] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.065] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.065] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070")) returned 1 [0259.065] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF") returned 0 [0259.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.066] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xeb0, lpOverlapped=0x0) returned 1 [0259.067] CloseHandle (hObject=0xdc) returned 1 [0259.067] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.068] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1324 [0259.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x132c) returned 0x25b528 [0259.068] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1324, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1324, lpOverlapped=0x0) returned 1 [0259.069] CloseHandle (hObject=0xdc) returned 1 [0259.070] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf")) returned 1 [0259.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.070] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.071] GetTickCount () returned 0x50186 [0259.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.071] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070\\....\\temporaryfile")) returned 0 [0259.075] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070\\temporaryfile")) returned 1 [0259.077] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5e9620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5e9620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.077] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5e9620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5e9620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.077] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.077] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.077] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.077] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.077] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.077] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070\\temporaryfile")) returned 1 [0259.077] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5c34c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5c34c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5c34c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.077] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.077] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328070" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328070")) returned 1 [0259.077] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF") returned 0 [0259.078] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.078] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1328, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1328, lpOverlapped=0x0) returned 1 [0259.079] CloseHandle (hObject=0xdc) returned 1 [0259.079] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.080] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1384 [0259.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x138c) returned 0x25b528 [0259.080] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1384, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1384, lpOverlapped=0x0) returned 1 [0259.082] CloseHandle (hObject=0xdc) returned 1 [0259.082] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf")) returned 1 [0259.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.083] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.083] GetTickCount () returned 0x50195 [0259.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.083] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328085\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328085\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.084] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328085\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328085\\....\\temporaryfile")) returned 0 [0259.084] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328085\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328085\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328085\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328085\\temporaryfile")) returned 1 [0259.085] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328085\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5e9620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5e9620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5e9620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.085] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5e9620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5e9620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5e9620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.085] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5e9620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5e9620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5e9620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.085] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328085\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5e9620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5e9620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5e9620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.086] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5e9620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5e9620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5e9620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.086] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5e9620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5e9620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5e9620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.086] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.086] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328085\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328085\\temporaryfile")) returned 1 [0259.086] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f5e9620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f5e9620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f5e9620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.086] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.086] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328085" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328085")) returned 1 [0259.086] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF") returned 0 [0259.087] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.087] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1388, lpOverlapped=0x0) returned 1 [0259.088] CloseHandle (hObject=0xdc) returned 1 [0259.088] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.089] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x864 [0259.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x86c) returned 0x2450048 [0259.089] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x864, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x864, lpOverlapped=0x0) returned 1 [0259.090] CloseHandle (hObject=0xdc) returned 1 [0259.090] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf")) returned 1 [0259.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.091] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.091] GetTickCount () returned 0x501a5 [0259.091] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.092] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.092] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101\\....\\temporaryfile")) returned 0 [0259.093] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101\\temporaryfile")) returned 1 [0259.094] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.094] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.094] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.094] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.094] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.094] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101\\temporaryfile")) returned 1 [0259.094] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.095] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.095] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101")) returned 1 [0259.095] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF") returned 0 [0259.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.096] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x868, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x868, lpOverlapped=0x0) returned 1 [0259.097] CloseHandle (hObject=0xdc) returned 1 [0259.097] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.098] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1172 [0259.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x117a) returned 0x25b528 [0259.098] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1172, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1172, lpOverlapped=0x0) returned 1 [0259.099] CloseHandle (hObject=0xdc) returned 1 [0259.100] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf")) returned 1 [0259.100] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.100] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.101] GetTickCount () returned 0x501a5 [0259.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.101] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101\\....\\temporaryfile")) returned 0 [0259.102] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101\\temporaryfile")) returned 1 [0259.103] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.104] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.104] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.104] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.104] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.104] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.104] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101\\temporaryfile")) returned 1 [0259.104] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f60f780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f60f780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f60f780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.104] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328101" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328101")) returned 1 [0259.105] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF") returned 0 [0259.105] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.106] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1178, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1178, lpOverlapped=0x0) returned 1 [0259.107] CloseHandle (hObject=0xdc) returned 1 [0259.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.109] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x20ca [0259.109] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20d2) returned 0x2350048 [0259.109] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x20ca, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x20ca, lpOverlapped=0x0) returned 1 [0259.110] CloseHandle (hObject=0xdc) returned 1 [0259.110] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf")) returned 1 [0259.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.111] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.111] GetTickCount () returned 0x501b4 [0259.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.112] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.112] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328116\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328116\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328116\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328116\\....\\temporaryfile")) returned 0 [0259.112] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328116\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328116\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328116\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328116\\temporaryfile")) returned 1 [0259.113] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328116\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6358e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6358e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6358e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.114] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6358e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6358e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6358e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.114] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6358e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6358e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6358e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.114] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328116\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6358e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6358e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6358e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.114] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6358e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6358e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6358e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.114] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6358e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6358e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6358e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.114] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.114] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328116\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328116\\temporaryfile")) returned 1 [0259.114] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6358e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6358e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6358e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.114] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.114] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328116" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328116")) returned 1 [0259.114] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF") returned 0 [0259.115] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.115] WriteFile (in: hFile=0xdc, lpBuffer=0x2352130*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2352130*, lpNumberOfBytesWritten=0x18fdd8*=0x20d0, lpOverlapped=0x0) returned 1 [0259.116] CloseHandle (hObject=0xdc) returned 1 [0259.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.117] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x21c2 [0259.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x21ca) returned 0x2350048 [0259.117] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x21c2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x21c2, lpOverlapped=0x0) returned 1 [0259.121] CloseHandle (hObject=0xdc) returned 1 [0259.121] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf")) returned 1 [0259.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.122] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.122] GetTickCount () returned 0x501c4 [0259.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.122] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132\\....\\temporaryfile")) returned 0 [0259.123] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132\\temporaryfile")) returned 1 [0259.124] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.124] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.124] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.125] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.125] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.125] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.125] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132\\temporaryfile")) returned 1 [0259.125] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.125] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.125] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132")) returned 1 [0259.125] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF") returned 0 [0259.126] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.126] WriteFile (in: hFile=0xdc, lpBuffer=0x2352228*, nNumberOfBytesToWrite=0x21c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2352228*, lpNumberOfBytesWritten=0x18fdd8*=0x21c8, lpOverlapped=0x0) returned 1 [0259.127] CloseHandle (hObject=0xdc) returned 1 [0259.127] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.128] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x21ec [0259.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x21f4) returned 0x2350048 [0259.128] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x21ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x21ec, lpOverlapped=0x0) returned 1 [0259.130] CloseHandle (hObject=0xdc) returned 1 [0259.130] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf")) returned 1 [0259.130] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.131] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.131] GetTickCount () returned 0x501c4 [0259.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.131] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.131] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132\\....\\temporaryfile")) returned 0 [0259.132] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132\\temporaryfile")) returned 1 [0259.133] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.133] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.133] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.133] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.134] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.134] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.134] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.134] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132\\temporaryfile")) returned 1 [0259.134] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f65ba40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f65ba40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f65ba40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.134] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.134] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328132" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328132")) returned 1 [0259.134] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF") returned 0 [0259.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.135] WriteFile (in: hFile=0xdc, lpBuffer=0x2352250*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2352250*, lpNumberOfBytesWritten=0x18fdd8*=0x21f0, lpOverlapped=0x0) returned 1 [0259.136] CloseHandle (hObject=0xdc) returned 1 [0259.136] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.137] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2ad4 [0259.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2adc) returned 0x2350048 [0259.138] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x2ad4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x2ad4, lpOverlapped=0x0) returned 1 [0259.139] CloseHandle (hObject=0xdc) returned 1 [0259.139] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf")) returned 1 [0259.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.140] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.140] GetTickCount () returned 0x501d4 [0259.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.141] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328148\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328148\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328148\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328148\\....\\temporaryfile")) returned 0 [0259.142] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328148\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328148\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328148\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328148\\temporaryfile")) returned 1 [0259.144] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328148\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f681ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f681ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f681ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.144] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f681ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f681ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f681ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.144] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f681ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f681ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f681ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.144] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328148\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f681ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f681ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f681ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.144] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f681ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f681ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f681ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.144] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f681ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f681ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f681ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.144] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.144] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328148\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328148\\temporaryfile")) returned 1 [0259.144] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f681ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f681ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f681ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.145] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.145] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328148" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328148")) returned 1 [0259.145] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF") returned 0 [0259.145] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.146] WriteFile (in: hFile=0xdc, lpBuffer=0x2352b38*, nNumberOfBytesToWrite=0x2ad8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2352b38*, lpNumberOfBytesWritten=0x18fdd8*=0x2ad8, lpOverlapped=0x0) returned 1 [0259.147] CloseHandle (hObject=0xdc) returned 1 [0259.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.148] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x194a [0259.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1952) returned 0x2c4a70 [0259.148] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x194a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x194a, lpOverlapped=0x0) returned 1 [0259.150] CloseHandle (hObject=0xdc) returned 1 [0259.150] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf")) returned 1 [0259.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.151] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.151] GetTickCount () returned 0x501e3 [0259.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.151] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163\\....\\temporaryfile")) returned 0 [0259.152] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163\\temporaryfile")) returned 1 [0259.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.153] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.153] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.153] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.154] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.154] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163\\temporaryfile")) returned 1 [0259.154] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.154] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.154] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163")) returned 1 [0259.154] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF") returned 0 [0259.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.155] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x1950, lpOverlapped=0x0) returned 1 [0259.156] CloseHandle (hObject=0xdc) returned 1 [0259.156] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.157] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x38c6 [0259.157] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x38ce) returned 0x2350048 [0259.157] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x38c6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x38c6, lpOverlapped=0x0) returned 1 [0259.158] CloseHandle (hObject=0xdc) returned 1 [0259.158] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf")) returned 1 [0259.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.159] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.159] GetTickCount () returned 0x501e3 [0259.159] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.160] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163\\....\\temporaryfile")) returned 0 [0259.161] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163\\temporaryfile")) returned 1 [0259.162] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.162] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.162] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.162] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.162] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.162] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.163] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163\\temporaryfile")) returned 1 [0259.163] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6a7d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6a7d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6a7d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.163] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328163" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328163")) returned 1 [0259.163] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF") returned 0 [0259.163] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.165] WriteFile (in: hFile=0xdc, lpBuffer=0x2353928*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2353928*, lpNumberOfBytesWritten=0x18fdd8*=0x38d0, lpOverlapped=0x0) returned 1 [0259.166] CloseHandle (hObject=0xdc) returned 1 [0259.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.167] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x173e [0259.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1746) returned 0x2c4a70 [0259.167] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x173e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x173e, lpOverlapped=0x0) returned 1 [0259.168] CloseHandle (hObject=0xdc) returned 1 [0259.168] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf")) returned 1 [0259.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.169] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.169] GetTickCount () returned 0x501f3 [0259.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.170] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179\\....\\temporaryfile")) returned 0 [0259.170] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179\\temporaryfile")) returned 1 [0259.172] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.172] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.172] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.172] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.172] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.172] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.172] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.172] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179\\temporaryfile")) returned 1 [0259.172] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.173] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.173] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179")) returned 1 [0259.173] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF") returned 0 [0259.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.174] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x1748, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x1748, lpOverlapped=0x0) returned 1 [0259.175] CloseHandle (hObject=0xdc) returned 1 [0259.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.175] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4696 [0259.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x469e) returned 0x2350048 [0259.176] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x4696, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x4696, lpOverlapped=0x0) returned 1 [0259.177] CloseHandle (hObject=0xdc) returned 1 [0259.177] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf")) returned 1 [0259.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.179] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.179] GetTickCount () returned 0x501f3 [0259.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.180] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179\\....\\temporaryfile")) returned 0 [0259.181] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179\\temporaryfile")) returned 1 [0259.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.183] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.183] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179\\temporaryfile")) returned 1 [0259.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6cde60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6cde60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6cde60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.184] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328179" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328179")) returned 1 [0259.184] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF") returned 0 [0259.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.185] WriteFile (in: hFile=0xdc, lpBuffer=0x23546f8*, nNumberOfBytesToWrite=0x46a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23546f8*, lpNumberOfBytesWritten=0x18fdd8*=0x46a0, lpOverlapped=0x0) returned 1 [0259.187] CloseHandle (hObject=0xdc) returned 1 [0259.187] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.188] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2f38 [0259.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2f40) returned 0x2350048 [0259.188] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x2f38, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x2f38, lpOverlapped=0x0) returned 1 [0259.190] CloseHandle (hObject=0xdc) returned 1 [0259.190] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf")) returned 1 [0259.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.191] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.191] GetTickCount () returned 0x50202 [0259.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.191] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328194\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328194\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328194\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328194\\....\\temporaryfile")) returned 0 [0259.192] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328194\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328194\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328194\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328194\\temporaryfile")) returned 1 [0259.194] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328194\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6f3fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6f3fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6f3fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.194] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6f3fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6f3fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6f3fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.194] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6f3fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6f3fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6f3fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.194] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328194\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6f3fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6f3fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6f3fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.194] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6f3fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6f3fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6f3fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.194] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6f3fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6f3fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6f3fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.194] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328194\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328194\\temporaryfile")) returned 1 [0259.195] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f6f3fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f6f3fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f6f3fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.195] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.195] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328194" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328194")) returned 1 [0259.195] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF") returned 0 [0259.195] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.196] WriteFile (in: hFile=0xdc, lpBuffer=0x2352f98*, nNumberOfBytesToWrite=0x2f40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2352f98*, lpNumberOfBytesWritten=0x18fdd8*=0x2f40, lpOverlapped=0x0) returned 1 [0259.197] CloseHandle (hObject=0xdc) returned 1 [0259.197] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.198] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14bc [0259.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14c4) returned 0x29b460 [0259.198] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x14bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x14bc, lpOverlapped=0x0) returned 1 [0259.199] CloseHandle (hObject=0xdc) returned 1 [0259.199] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf")) returned 1 [0259.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.200] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.200] GetTickCount () returned 0x50212 [0259.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.201] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328210\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.201] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328210\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328210\\....\\temporaryfile")) returned 0 [0259.201] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328210\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328210\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328210\\temporaryfile")) returned 1 [0259.203] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328210\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f71a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f71a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f71a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.203] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f71a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f71a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f71a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.203] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f71a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f71a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f71a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.203] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328210\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f71a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f71a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f71a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f71a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f71a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f71a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f71a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f71a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f71a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.203] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.203] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328210\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328210\\temporaryfile")) returned 1 [0259.203] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f71a120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f71a120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f71a120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.203] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.203] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328210" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328210")) returned 1 [0259.204] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF") returned 0 [0259.204] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.205] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x14c0, lpOverlapped=0x0) returned 1 [0259.205] CloseHandle (hObject=0xdc) returned 1 [0259.206] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.206] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1580 [0259.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1588) returned 0x29b460 [0259.206] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1580, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1580, lpOverlapped=0x0) returned 1 [0259.215] CloseHandle (hObject=0xdc) returned 1 [0259.215] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf")) returned 1 [0259.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.216] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.216] GetTickCount () returned 0x50222 [0259.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328226\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328226\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328226\\....\\temporaryfile")) returned 0 [0259.218] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328226\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328226\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328226\\temporaryfile")) returned 1 [0259.223] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328226\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f740280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f740280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f740280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.223] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f740280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f740280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f740280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.223] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f740280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f740280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f740280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.223] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328226\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f740280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f740280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f740280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.223] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f740280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f740280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f740280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.223] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f740280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f740280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f740280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.223] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.223] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328226\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328226\\temporaryfile")) returned 1 [0259.223] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f740280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f740280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f740280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.223] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.223] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328226" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328226")) returned 1 [0259.224] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF") returned 0 [0259.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.225] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1588, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1588, lpOverlapped=0x0) returned 1 [0259.226] CloseHandle (hObject=0xdc) returned 1 [0259.226] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.227] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x27a4 [0259.227] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x27ac) returned 0x2350048 [0259.227] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x27a4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x27a4, lpOverlapped=0x0) returned 1 [0259.228] CloseHandle (hObject=0xdc) returned 1 [0259.229] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf")) returned 1 [0259.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.229] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.230] GetTickCount () returned 0x50231 [0259.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.230] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241\\....\\temporaryfile")) returned 0 [0259.231] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241\\temporaryfile")) returned 1 [0259.232] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.232] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.232] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.233] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.233] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.233] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.233] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.233] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241\\temporaryfile")) returned 1 [0259.233] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.233] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.233] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241")) returned 1 [0259.233] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF") returned 0 [0259.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.234] WriteFile (in: hFile=0xdc, lpBuffer=0x2352808*, nNumberOfBytesToWrite=0x27a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2352808*, lpNumberOfBytesWritten=0x18fdd8*=0x27a8, lpOverlapped=0x0) returned 1 [0259.235] CloseHandle (hObject=0xdc) returned 1 [0259.235] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.236] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4f6c [0259.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f74) returned 0x2350048 [0259.236] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x4f6c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x4f6c, lpOverlapped=0x0) returned 1 [0259.237] CloseHandle (hObject=0xdc) returned 1 [0259.238] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf")) returned 1 [0259.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.239] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.239] GetTickCount () returned 0x50231 [0259.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.239] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241\\....\\temporaryfile")) returned 0 [0259.240] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241\\temporaryfile")) returned 1 [0259.242] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.242] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.242] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.242] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.242] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.242] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.242] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.242] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241\\temporaryfile")) returned 1 [0259.242] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7663e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7663e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7663e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.242] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.242] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328241" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328241")) returned 1 [0259.242] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF") returned 0 [0259.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.244] WriteFile (in: hFile=0xdc, lpBuffer=0x2354fd0*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2354fd0*, lpNumberOfBytesWritten=0x18fdd8*=0x4f70, lpOverlapped=0x0) returned 1 [0259.245] CloseHandle (hObject=0xdc) returned 1 [0259.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.246] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc10 [0259.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc18) returned 0x2450048 [0259.246] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xc10, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xc10, lpOverlapped=0x0) returned 1 [0259.248] CloseHandle (hObject=0xdc) returned 1 [0259.248] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf")) returned 1 [0259.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.249] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.249] GetTickCount () returned 0x50241 [0259.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.250] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257\\....\\temporaryfile")) returned 0 [0259.250] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257\\temporaryfile")) returned 1 [0259.252] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f78c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f78c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f78c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.252] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f78c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f78c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f78c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.252] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f78c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f78c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f78c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.252] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f78c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f78c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f78c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.252] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f78c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f78c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f78c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.252] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f78c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f78c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f78c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.252] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.252] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257\\temporaryfile")) returned 1 [0259.253] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f78c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f78c540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f78c540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.253] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.253] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257")) returned 1 [0259.253] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF") returned 0 [0259.253] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.254] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xc18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xc18, lpOverlapped=0x0) returned 1 [0259.255] CloseHandle (hObject=0xdc) returned 1 [0259.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.255] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x938 [0259.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x940) returned 0x2450048 [0259.256] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x938, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x938, lpOverlapped=0x0) returned 1 [0259.257] CloseHandle (hObject=0xdc) returned 1 [0259.257] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf")) returned 1 [0259.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.258] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.258] GetTickCount () returned 0x50241 [0259.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.259] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257\\....\\temporaryfile")) returned 0 [0259.261] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257\\temporaryfile")) returned 1 [0259.262] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f78c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f78c540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.263] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.263] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.263] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257\\temporaryfile")) returned 1 [0259.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.263] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.263] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328257" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328257")) returned 1 [0259.264] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF") returned 0 [0259.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.265] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x940, lpOverlapped=0x0) returned 1 [0259.266] CloseHandle (hObject=0xdc) returned 1 [0259.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.267] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb60 [0259.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb68) returned 0x2450048 [0259.267] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xb60, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xb60, lpOverlapped=0x0) returned 1 [0259.269] CloseHandle (hObject=0xdc) returned 1 [0259.269] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf")) returned 1 [0259.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.270] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.270] GetTickCount () returned 0x50250 [0259.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.270] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328272\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328272\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328272\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328272\\....\\temporaryfile")) returned 0 [0259.271] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328272\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328272\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328272\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328272\\temporaryfile")) returned 1 [0259.272] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328272\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.273] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.273] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.273] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328272\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.273] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.273] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.273] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.273] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328272\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328272\\temporaryfile")) returned 1 [0259.273] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7b26a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7b26a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7b26a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.273] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.273] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328272" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328272")) returned 1 [0259.273] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF") returned 0 [0259.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.274] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xb68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xb68, lpOverlapped=0x0) returned 1 [0259.275] CloseHandle (hObject=0xdc) returned 1 [0259.275] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.276] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6efa [0259.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6f02) returned 0x2350048 [0259.276] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x6efa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x6efa, lpOverlapped=0x0) returned 1 [0259.277] CloseHandle (hObject=0xdc) returned 1 [0259.277] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf")) returned 1 [0259.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.279] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.279] GetTickCount () returned 0x50260 [0259.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.279] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288\\....\\temporaryfile")) returned 0 [0259.280] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288\\temporaryfile")) returned 1 [0259.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.281] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.281] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.281] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.281] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288\\temporaryfile")) returned 1 [0259.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.282] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288")) returned 1 [0259.282] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF") returned 0 [0259.283] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.283] WriteFile (in: hFile=0xdc, lpBuffer=0x2356f60*, nNumberOfBytesToWrite=0x6f00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2356f60*, lpNumberOfBytesWritten=0x18fdd8*=0x6f00, lpOverlapped=0x0) returned 1 [0259.284] CloseHandle (hObject=0xdc) returned 1 [0259.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.286] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5880 [0259.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5888) returned 0x2350048 [0259.286] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x5880, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x5880, lpOverlapped=0x0) returned 1 [0259.287] CloseHandle (hObject=0xdc) returned 1 [0259.287] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf")) returned 1 [0259.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.288] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.288] GetTickCount () returned 0x50260 [0259.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.289] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288\\....\\temporaryfile")) returned 0 [0259.290] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288\\temporaryfile")) returned 1 [0259.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.291] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.291] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.291] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.291] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.291] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288\\temporaryfile")) returned 1 [0259.292] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7d8800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7d8800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7d8800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.292] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.292] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328288" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328288")) returned 1 [0259.292] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF") returned 0 [0259.292] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.293] WriteFile (in: hFile=0xdc, lpBuffer=0x23558e0*, nNumberOfBytesToWrite=0x5888, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23558e0*, lpNumberOfBytesWritten=0x18fdd8*=0x5888, lpOverlapped=0x0) returned 1 [0259.294] CloseHandle (hObject=0xdc) returned 1 [0259.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.295] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x477c [0259.296] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4784) returned 0x2350048 [0259.296] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x477c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x477c, lpOverlapped=0x0) returned 1 [0259.297] CloseHandle (hObject=0xdc) returned 1 [0259.297] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf")) returned 1 [0259.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.298] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.298] GetTickCount () returned 0x50270 [0259.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.299] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328304\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328304\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328304\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328304\\....\\temporaryfile")) returned 0 [0259.299] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328304\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328304\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328304\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328304\\temporaryfile")) returned 1 [0259.300] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328304\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7fe960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7fe960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7fe960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.300] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7fe960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7fe960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7fe960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7fe960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7fe960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7fe960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328304\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7fe960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7fe960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7fe960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7fe960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7fe960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7fe960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7fe960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7fe960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7fe960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.301] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328304\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328304\\temporaryfile")) returned 1 [0259.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f7fe960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f7fe960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f7fe960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.301] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328304" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328304")) returned 1 [0259.301] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF") returned 0 [0259.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.302] WriteFile (in: hFile=0xdc, lpBuffer=0x23547e0*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23547e0*, lpNumberOfBytesWritten=0x18fdd8*=0x4780, lpOverlapped=0x0) returned 1 [0259.304] CloseHandle (hObject=0xdc) returned 1 [0259.304] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.304] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x530 [0259.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x538) returned 0x259e70 [0259.305] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x530, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x530, lpOverlapped=0x0) returned 1 [0259.325] CloseHandle (hObject=0xdc) returned 1 [0259.325] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf")) returned 1 [0259.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.326] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.326] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.326] GetTickCount () returned 0x5027f [0259.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.327] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319\\....\\temporaryfile")) returned 0 [0259.328] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319\\temporaryfile")) returned 1 [0259.330] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.330] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.330] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.330] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.330] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.330] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319\\temporaryfile")) returned 1 [0259.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.330] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.330] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319")) returned 1 [0259.331] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF") returned 0 [0259.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.332] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x538, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x538, lpOverlapped=0x0) returned 1 [0259.333] CloseHandle (hObject=0xdc) returned 1 [0259.333] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.333] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7d14 [0259.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7d1c) returned 0x2350048 [0259.334] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7d14, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7d14, lpOverlapped=0x0) returned 1 [0259.335] CloseHandle (hObject=0xdc) returned 1 [0259.335] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf")) returned 1 [0259.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.336] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.336] GetTickCount () returned 0x5027f [0259.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.336] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.337] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319\\....\\temporaryfile")) returned 0 [0259.338] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319\\temporaryfile")) returned 1 [0259.339] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f84ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f84ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.339] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f84ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f84ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.339] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.339] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.340] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.340] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.340] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.340] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319\\temporaryfile")) returned 1 [0259.340] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f824ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f824ac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f824ac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.340] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.340] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328319" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328319")) returned 1 [0259.340] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF") returned 0 [0259.341] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.341] WriteFile (in: hFile=0xdc, lpBuffer=0x2357d78*, nNumberOfBytesToWrite=0x7d18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2357d78*, lpNumberOfBytesWritten=0x18fdd8*=0x7d18, lpOverlapped=0x0) returned 1 [0259.343] CloseHandle (hObject=0xdc) returned 1 [0259.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.343] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x64c [0259.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x654) returned 0x259e70 [0259.344] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x64c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x64c, lpOverlapped=0x0) returned 1 [0259.345] CloseHandle (hObject=0xdc) returned 1 [0259.345] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf")) returned 1 [0259.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.346] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.346] GetTickCount () returned 0x5028f [0259.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.347] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328335\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328335\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328335\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328335\\....\\temporaryfile")) returned 0 [0259.347] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328335\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328335\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328335\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328335\\temporaryfile")) returned 1 [0259.349] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328335\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f84ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f84ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f84ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.349] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f84ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f84ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f84ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.349] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f84ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f84ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f84ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.349] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328335\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f84ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f84ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f84ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.349] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f84ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f84ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f84ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.349] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f84ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f84ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f84ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.349] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.349] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328335\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328335\\temporaryfile")) returned 1 [0259.349] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f84ac20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f84ac20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f84ac20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.349] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.349] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328335" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328335")) returned 1 [0259.350] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF") returned 0 [0259.350] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.350] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x650, lpOverlapped=0x0) returned 1 [0259.351] CloseHandle (hObject=0xdc) returned 1 [0259.351] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.352] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7658 [0259.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7660) returned 0x2350048 [0259.352] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7658, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7658, lpOverlapped=0x0) returned 1 [0259.354] CloseHandle (hObject=0xdc) returned 1 [0259.354] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf")) returned 1 [0259.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.355] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.356] GetTickCount () returned 0x5029e [0259.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.356] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350\\....\\temporaryfile")) returned 0 [0259.357] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350\\temporaryfile")) returned 1 [0259.358] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.358] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.358] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.358] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.358] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.358] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.358] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.358] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350\\temporaryfile")) returned 1 [0259.359] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.359] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.359] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350")) returned 1 [0259.359] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF") returned 0 [0259.360] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.360] WriteFile (in: hFile=0xdc, lpBuffer=0x23576b8*, nNumberOfBytesToWrite=0x7660, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x23576b8*, lpNumberOfBytesWritten=0x18fdd8*=0x7660, lpOverlapped=0x0) returned 1 [0259.362] CloseHandle (hObject=0xdc) returned 1 [0259.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.362] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x23f8 [0259.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2400) returned 0x2350048 [0259.362] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x23f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x23f8, lpOverlapped=0x0) returned 1 [0259.364] CloseHandle (hObject=0xdc) returned 1 [0259.364] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf")) returned 1 [0259.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.365] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.365] GetTickCount () returned 0x5029e [0259.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.365] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350\\....\\temporaryfile")) returned 0 [0259.366] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350\\temporaryfile")) returned 1 [0259.367] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.368] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.368] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.368] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.368] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.368] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.368] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.368] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350\\temporaryfile")) returned 1 [0259.368] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f870d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f870d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f870d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.368] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.368] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328350" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328350")) returned 1 [0259.369] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF") returned 0 [0259.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.370] WriteFile (in: hFile=0xdc, lpBuffer=0x2352458*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2352458*, lpNumberOfBytesWritten=0x18fdd8*=0x2400, lpOverlapped=0x0) returned 1 [0259.371] CloseHandle (hObject=0xdc) returned 1 [0259.371] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.372] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x788 [0259.372] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x790) returned 0x2450048 [0259.372] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x788, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x788, lpOverlapped=0x0) returned 1 [0259.373] CloseHandle (hObject=0xdc) returned 1 [0259.373] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf")) returned 1 [0259.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.374] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.374] GetTickCount () returned 0x502ae [0259.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.375] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328366\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.375] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328366\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328366\\....\\temporaryfile")) returned 0 [0259.375] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328366\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328366\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328366\\temporaryfile")) returned 1 [0259.377] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328366\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f896ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f896ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f896ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.377] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f896ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f896ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f896ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.377] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f896ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f896ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f896ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.377] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328366\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f896ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f896ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f896ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.377] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f896ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f896ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f896ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.377] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f896ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f896ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f896ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.377] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.377] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328366\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328366\\temporaryfile")) returned 1 [0259.381] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f896ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f896ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f896ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.381] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328366" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328366")) returned 1 [0259.381] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF") returned 0 [0259.382] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.382] WriteFile (in: hFile=0xdc, lpBuffer=0x24507e8*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x24507e8*, lpNumberOfBytesWritten=0x18fdd8*=0x790, lpOverlapped=0x0) returned 1 [0259.383] CloseHandle (hObject=0xdc) returned 1 [0259.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.384] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xba4 [0259.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbac) returned 0x2450048 [0259.384] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xba4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xba4, lpOverlapped=0x0) returned 1 [0259.385] CloseHandle (hObject=0xdc) returned 1 [0259.385] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf")) returned 1 [0259.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.386] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.386] GetTickCount () returned 0x502be [0259.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.387] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.387] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382\\....\\temporaryfile")) returned 0 [0259.387] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382\\temporaryfile")) returned 1 [0259.389] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.389] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.389] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.389] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.389] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.389] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382\\temporaryfile")) returned 1 [0259.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.389] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.390] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382")) returned 1 [0259.390] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF") returned 0 [0259.390] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.391] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xba8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xba8, lpOverlapped=0x0) returned 1 [0259.391] CloseHandle (hObject=0xdc) returned 1 [0259.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.393] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x514 [0259.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x51c) returned 0x259e70 [0259.393] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x514, lpOverlapped=0x0) returned 1 [0259.394] CloseHandle (hObject=0xdc) returned 1 [0259.394] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf")) returned 1 [0259.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.395] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.395] GetTickCount () returned 0x502be [0259.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.396] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382\\....\\temporaryfile")) returned 0 [0259.397] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382\\temporaryfile")) returned 1 [0259.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.398] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.398] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.398] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.398] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382\\temporaryfile")) returned 1 [0259.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8bd040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8bd040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8bd040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.399] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328382" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328382")) returned 1 [0259.399] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF") returned 0 [0259.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.400] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x518, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x518, lpOverlapped=0x0) returned 1 [0259.401] CloseHandle (hObject=0xdc) returned 1 [0259.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.401] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x608 [0259.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x610) returned 0x259e70 [0259.402] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x608, lpOverlapped=0x0) returned 1 [0259.403] CloseHandle (hObject=0xdc) returned 1 [0259.403] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf")) returned 1 [0259.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.404] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.404] GetTickCount () returned 0x502cd [0259.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.405] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397\\....\\temporaryfile")) returned 0 [0259.405] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397\\temporaryfile")) returned 1 [0259.406] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.406] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.406] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.406] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.407] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.407] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.407] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.407] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397\\temporaryfile")) returned 1 [0259.407] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.407] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.407] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397")) returned 1 [0259.407] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF") returned 0 [0259.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.408] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x610, lpOverlapped=0x0) returned 1 [0259.409] CloseHandle (hObject=0xdc) returned 1 [0259.409] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.410] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd58 [0259.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd60) returned 0x2450048 [0259.410] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xd58, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xd58, lpOverlapped=0x0) returned 1 [0259.412] CloseHandle (hObject=0xdc) returned 1 [0259.412] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf")) returned 1 [0259.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.413] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.413] GetTickCount () returned 0x502cd [0259.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.413] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.414] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397\\....\\temporaryfile")) returned 0 [0259.414] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397\\temporaryfile")) returned 1 [0259.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.416] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.416] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.416] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.416] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397\\temporaryfile")) returned 1 [0259.416] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f8e31a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f8e31a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f8e31a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.416] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.416] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328397" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328397")) returned 1 [0259.416] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF") returned 0 [0259.416] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.417] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xd60, lpOverlapped=0x0) returned 1 [0259.418] CloseHandle (hObject=0xdc) returned 1 [0259.418] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.419] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3210 [0259.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3218) returned 0x2350048 [0259.419] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x3210, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x3210, lpOverlapped=0x0) returned 1 [0259.421] CloseHandle (hObject=0xdc) returned 1 [0259.421] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf")) returned 1 [0259.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.422] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.422] GetTickCount () returned 0x502dd [0259.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.422] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328413\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.423] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328413\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328413\\....\\temporaryfile")) returned 0 [0259.423] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328413\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328413\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328413\\temporaryfile")) returned 1 [0259.424] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328413\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f909300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f909300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f909300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.424] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f909300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f909300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f909300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.424] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f909300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f909300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f909300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.424] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328413\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f909300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f909300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f909300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.424] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f909300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f909300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f909300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.424] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f909300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f909300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f909300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.425] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.425] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328413\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328413\\temporaryfile")) returned 1 [0259.425] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f909300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f909300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f909300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.425] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.425] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328413" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328413")) returned 1 [0259.425] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF") returned 0 [0259.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.426] WriteFile (in: hFile=0xdc, lpBuffer=0x2353270*, nNumberOfBytesToWrite=0x3218, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2353270*, lpNumberOfBytesWritten=0x18fdd8*=0x3218, lpOverlapped=0x0) returned 1 [0259.427] CloseHandle (hObject=0xdc) returned 1 [0259.427] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.428] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c46 [0259.428] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c4e) returned 0x2350048 [0259.428] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x7c46, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x7c46, lpOverlapped=0x0) returned 1 [0259.430] CloseHandle (hObject=0xdc) returned 1 [0259.430] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf")) returned 1 [0259.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.431] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.431] GetTickCount () returned 0x502ec [0259.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.431] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.432] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.432] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428\\....\\temporaryfile")) returned 0 [0259.432] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428\\temporaryfile")) returned 1 [0259.434] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.434] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.434] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.434] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.434] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.434] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.434] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.434] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428\\temporaryfile")) returned 1 [0259.434] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.434] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.434] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428")) returned 1 [0259.434] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF") returned 0 [0259.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.436] WriteFile (in: hFile=0xdc, lpBuffer=0x2357ca8*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2357ca8*, lpNumberOfBytesWritten=0x18fdd8*=0x7c50, lpOverlapped=0x0) returned 1 [0259.437] CloseHandle (hObject=0xdc) returned 1 [0259.437] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.438] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x54a8 [0259.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54b0) returned 0x2350048 [0259.438] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x54a8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x54a8, lpOverlapped=0x0) returned 1 [0259.440] CloseHandle (hObject=0xdc) returned 1 [0259.440] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf")) returned 1 [0259.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.441] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.441] GetTickCount () returned 0x502ec [0259.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.442] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.442] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428\\....\\temporaryfile")) returned 0 [0259.442] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428\\temporaryfile")) returned 1 [0259.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.444] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.444] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.444] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.444] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428\\temporaryfile")) returned 1 [0259.444] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f92f460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f92f460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f92f460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.444] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.444] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328428" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328428")) returned 1 [0259.445] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF") returned 0 [0259.445] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.446] WriteFile (in: hFile=0xdc, lpBuffer=0x2355508*, nNumberOfBytesToWrite=0x54b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2355508*, lpNumberOfBytesWritten=0x18fdd8*=0x54b0, lpOverlapped=0x0) returned 1 [0259.447] CloseHandle (hObject=0xdc) returned 1 [0259.447] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.448] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a7e [0259.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a86) returned 0x2c4a70 [0259.448] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1a7e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a7e, lpOverlapped=0x0) returned 1 [0259.449] CloseHandle (hObject=0xdc) returned 1 [0259.449] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf")) returned 1 [0259.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.450] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.450] GetTickCount () returned 0x502fc [0259.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.450] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.451] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.451] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444\\....\\temporaryfile")) returned 0 [0259.451] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444\\temporaryfile")) returned 1 [0259.453] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.453] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.453] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.453] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.453] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.453] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.453] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.453] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444\\temporaryfile")) returned 1 [0259.453] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.453] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.453] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444")) returned 1 [0259.454] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF") returned 0 [0259.454] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.455] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x1a88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x1a88, lpOverlapped=0x0) returned 1 [0259.456] CloseHandle (hObject=0xdc) returned 1 [0259.456] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.456] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e00 [0259.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e08) returned 0x2350048 [0259.456] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x1e00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x1e00, lpOverlapped=0x0) returned 1 [0259.458] CloseHandle (hObject=0xdc) returned 1 [0259.458] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf")) returned 1 [0259.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.459] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.459] GetTickCount () returned 0x502fc [0259.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.459] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444\\....\\temporaryfile")) returned 0 [0259.460] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444\\temporaryfile")) returned 1 [0259.461] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.461] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.462] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.462] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.462] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.462] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.462] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.462] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444\\temporaryfile")) returned 1 [0259.462] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9555c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9555c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9555c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.462] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.462] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328444" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328444")) returned 1 [0259.462] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF") returned 0 [0259.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.463] WriteFile (in: hFile=0xdc, lpBuffer=0x2351e60*, nNumberOfBytesToWrite=0x1e08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2351e60*, lpNumberOfBytesWritten=0x18fdd8*=0x1e08, lpOverlapped=0x0) returned 1 [0259.464] CloseHandle (hObject=0xdc) returned 1 [0259.465] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.465] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb70 [0259.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb78) returned 0x2450048 [0259.465] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xb70, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xb70, lpOverlapped=0x0) returned 1 [0259.467] CloseHandle (hObject=0xdc) returned 1 [0259.467] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf")) returned 1 [0259.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.467] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.468] GetTickCount () returned 0x5030c [0259.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.468] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.468] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460\\....\\temporaryfile")) returned 0 [0259.469] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460\\temporaryfile")) returned 1 [0259.470] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.470] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.470] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.470] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.470] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.470] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.470] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.470] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460\\temporaryfile")) returned 1 [0259.471] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.471] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.471] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460")) returned 1 [0259.471] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF") returned 0 [0259.471] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.472] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xb78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xb78, lpOverlapped=0x0) returned 1 [0259.473] CloseHandle (hObject=0xdc) returned 1 [0259.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.473] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16a0 [0259.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16a8) returned 0x2c4a70 [0259.474] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16a0, lpOverlapped=0x0) returned 1 [0259.475] CloseHandle (hObject=0xdc) returned 1 [0259.475] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf")) returned 1 [0259.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.476] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.476] GetTickCount () returned 0x5030c [0259.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.477] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.478] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460\\....\\temporaryfile")) returned 0 [0259.478] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460\\temporaryfile")) returned 1 [0259.480] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9a1880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9a1880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9a1880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9a1880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.480] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.480] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.480] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460\\temporaryfile")) returned 1 [0259.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f97b720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f97b720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f97b720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.480] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.480] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328460" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328460")) returned 1 [0259.480] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF") returned 0 [0259.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.481] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x16a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x16a8, lpOverlapped=0x0) returned 1 [0259.482] CloseHandle (hObject=0xdc) returned 1 [0259.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.483] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16d8 [0259.483] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16e0) returned 0x2c4a70 [0259.483] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16d8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16d8, lpOverlapped=0x0) returned 1 [0259.485] CloseHandle (hObject=0xdc) returned 1 [0259.485] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf")) returned 1 [0259.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.485] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.486] GetTickCount () returned 0x5031b [0259.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.486] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.486] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328475\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328475\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328475\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328475\\....\\temporaryfile")) returned 0 [0259.487] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328475\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328475\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328475\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328475\\temporaryfile")) returned 1 [0259.488] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328475\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9a1880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9a1880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9a1880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.488] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9a1880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9a1880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9a1880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.488] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9a1880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9a1880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9a1880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.488] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328475\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9a1880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9a1880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9a1880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.488] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9a1880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9a1880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9a1880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.489] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9a1880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9a1880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9a1880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.489] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328475\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328475\\temporaryfile")) returned 1 [0259.489] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9a1880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9a1880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9a1880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.489] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.489] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328475" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328475")) returned 1 [0259.489] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF") returned 0 [0259.489] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.490] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x16e0, lpOverlapped=0x0) returned 1 [0259.491] CloseHandle (hObject=0xdc) returned 1 [0259.491] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.492] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f38 [0259.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f40) returned 0x2350048 [0259.492] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x1f38, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x1f38, lpOverlapped=0x0) returned 1 [0259.493] CloseHandle (hObject=0xdc) returned 1 [0259.493] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf")) returned 1 [0259.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.494] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.494] GetTickCount () returned 0x5032b [0259.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.495] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491\\....\\temporaryfile")) returned 0 [0259.496] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491\\temporaryfile")) returned 1 [0259.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.497] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491\\temporaryfile")) returned 1 [0259.498] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.498] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.498] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491")) returned 1 [0259.498] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF") returned 0 [0259.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.499] WriteFile (in: hFile=0xdc, lpBuffer=0x2351f98*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2351f98*, lpNumberOfBytesWritten=0x18fdd8*=0x1f40, lpOverlapped=0x0) returned 1 [0259.500] CloseHandle (hObject=0xdc) returned 1 [0259.500] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.501] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1248 [0259.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1250) returned 0x25b528 [0259.501] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1248, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1248, lpOverlapped=0x0) returned 1 [0259.502] CloseHandle (hObject=0xdc) returned 1 [0259.503] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf")) returned 1 [0259.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.504] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.504] GetTickCount () returned 0x5032b [0259.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.504] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.505] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491\\....\\temporaryfile")) returned 0 [0259.505] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491\\temporaryfile")) returned 1 [0259.506] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.506] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.506] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.506] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.506] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.507] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.507] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491\\temporaryfile")) returned 1 [0259.507] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9c79e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9c79e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9c79e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.507] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.507] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328491" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328491")) returned 1 [0259.507] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF") returned 0 [0259.507] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.508] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1250, lpOverlapped=0x0) returned 1 [0259.509] CloseHandle (hObject=0xdc) returned 1 [0259.509] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.510] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2230 [0259.510] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2238) returned 0x2350048 [0259.510] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x2230, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x2230, lpOverlapped=0x0) returned 1 [0259.511] CloseHandle (hObject=0xdc) returned 1 [0259.511] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf")) returned 1 [0259.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.512] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.512] GetTickCount () returned 0x5033a [0259.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.512] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.518] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328506\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328506\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328506\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328506\\....\\temporaryfile")) returned 0 [0259.518] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328506\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328506\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328506\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328506\\temporaryfile")) returned 1 [0259.520] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328506\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9edb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9edb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9edb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.520] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9edb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9edb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9edb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.520] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9edb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9edb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9edb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.520] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328506\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9edb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9edb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9edb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.520] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9edb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9edb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9edb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.520] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9edb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9edb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9edb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.520] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.520] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328506\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328506\\temporaryfile")) returned 1 [0259.520] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9f9edb40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9f9edb40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9f9edb40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.520] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.520] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328506" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328506")) returned 1 [0259.520] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF") returned 0 [0259.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.521] WriteFile (in: hFile=0xdc, lpBuffer=0x2352290*, nNumberOfBytesToWrite=0x2238, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2352290*, lpNumberOfBytesWritten=0x18fdd8*=0x2238, lpOverlapped=0x0) returned 1 [0259.522] CloseHandle (hObject=0xdc) returned 1 [0259.523] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.523] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15b0 [0259.523] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15b8) returned 0x2c4a70 [0259.523] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x15b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x15b0, lpOverlapped=0x0) returned 1 [0259.525] CloseHandle (hObject=0xdc) returned 1 [0259.525] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf")) returned 1 [0259.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.526] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.526] GetTickCount () returned 0x5034a [0259.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.526] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522\\....\\temporaryfile")) returned 0 [0259.527] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522\\temporaryfile")) returned 1 [0259.528] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.528] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.528] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.528] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.529] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.529] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.529] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.529] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522\\temporaryfile")) returned 1 [0259.529] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.529] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.529] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522")) returned 1 [0259.529] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF") returned 0 [0259.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.530] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x15b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x15b8, lpOverlapped=0x0) returned 1 [0259.531] CloseHandle (hObject=0xdc) returned 1 [0259.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.532] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1858 [0259.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1860) returned 0x2c4a70 [0259.532] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1858, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1858, lpOverlapped=0x0) returned 1 [0259.533] CloseHandle (hObject=0xdc) returned 1 [0259.533] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf")) returned 1 [0259.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.534] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.534] GetTickCount () returned 0x5034a [0259.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.535] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522\\....\\temporaryfile")) returned 0 [0259.536] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522\\temporaryfile")) returned 1 [0259.537] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.537] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.537] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.537] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.537] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.537] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.537] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.537] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522\\temporaryfile")) returned 1 [0259.538] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa13ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa13ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa13ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.538] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.538] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328522" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328522")) returned 1 [0259.538] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF") returned 0 [0259.538] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.539] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x1860, lpOverlapped=0x0) returned 1 [0259.540] CloseHandle (hObject=0xdc) returned 1 [0259.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.541] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c74 [0259.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c7c) returned 0x2c4a70 [0259.541] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1c74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1c74, lpOverlapped=0x0) returned 1 [0259.543] CloseHandle (hObject=0xdc) returned 1 [0259.543] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf")) returned 1 [0259.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.544] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.544] GetTickCount () returned 0x5035a [0259.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.544] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.544] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538\\....\\temporaryfile")) returned 0 [0259.545] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538\\temporaryfile")) returned 1 [0259.546] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.546] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.546] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.546] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.546] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.547] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.547] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.547] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538\\temporaryfile")) returned 1 [0259.547] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.547] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.547] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538")) returned 1 [0259.547] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF") returned 0 [0259.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.548] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x1c78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x1c78, lpOverlapped=0x0) returned 1 [0259.549] CloseHandle (hObject=0xdc) returned 1 [0259.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.550] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1694 [0259.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x169c) returned 0x2c4a70 [0259.550] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1694, lpOverlapped=0x0) returned 1 [0259.552] CloseHandle (hObject=0xdc) returned 1 [0259.552] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf")) returned 1 [0259.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.553] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.553] GetTickCount () returned 0x5035a [0259.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.554] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.554] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538\\....\\temporaryfile")) returned 0 [0259.555] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538\\temporaryfile")) returned 1 [0259.556] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.556] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.556] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.556] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.556] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.556] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.556] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.557] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538\\temporaryfile")) returned 1 [0259.557] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa39e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa39e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa39e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.557] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.557] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328538" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328538")) returned 1 [0259.557] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF") returned 0 [0259.557] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.558] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x1698, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x1698, lpOverlapped=0x0) returned 1 [0259.559] CloseHandle (hObject=0xdc) returned 1 [0259.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.560] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa04 [0259.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa0c) returned 0x2450048 [0259.560] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xa04, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xa04, lpOverlapped=0x0) returned 1 [0259.561] CloseHandle (hObject=0xdc) returned 1 [0259.561] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf")) returned 1 [0259.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.562] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.562] GetTickCount () returned 0x50369 [0259.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.563] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328553\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328553\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328553\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328553\\....\\temporaryfile")) returned 0 [0259.563] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328553\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328553\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328553\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328553\\temporaryfile")) returned 1 [0259.565] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328553\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa5ff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa5ff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa5ff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.565] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa5ff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa5ff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa5ff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.565] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa5ff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa5ff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa5ff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.565] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328553\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa5ff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa5ff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa5ff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.565] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa5ff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa5ff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa5ff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.565] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa5ff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa5ff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa5ff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.565] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.565] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328553\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328553\\temporaryfile")) returned 1 [0259.565] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa5ff60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa5ff60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa5ff60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.565] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.565] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328553" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328553")) returned 1 [0259.566] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF") returned 0 [0259.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.567] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa08, lpOverlapped=0x0) returned 1 [0259.568] CloseHandle (hObject=0xdc) returned 1 [0259.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.569] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x70f0 [0259.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x70f8) returned 0x2350048 [0259.569] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x70f0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x70f0, lpOverlapped=0x0) returned 1 [0259.571] CloseHandle (hObject=0xdc) returned 1 [0259.571] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf")) returned 1 [0259.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.572] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.572] GetTickCount () returned 0x50379 [0259.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.573] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569\\....\\temporaryfile")) returned 0 [0259.573] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569\\temporaryfile")) returned 1 [0259.574] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.575] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.575] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.575] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.575] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.575] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.575] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.575] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569\\temporaryfile")) returned 1 [0259.575] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.575] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.575] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569")) returned 1 [0259.575] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF") returned 0 [0259.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.577] WriteFile (in: hFile=0xdc, lpBuffer=0x2357150*, nNumberOfBytesToWrite=0x70f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2357150*, lpNumberOfBytesWritten=0x18fdd8*=0x70f8, lpOverlapped=0x0) returned 1 [0259.578] CloseHandle (hObject=0xdc) returned 1 [0259.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.578] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16ae [0259.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16b6) returned 0x2c4a70 [0259.579] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16ae, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16ae, lpOverlapped=0x0) returned 1 [0259.580] CloseHandle (hObject=0xdc) returned 1 [0259.580] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf")) returned 1 [0259.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.581] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.581] GetTickCount () returned 0x50379 [0259.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.582] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569\\....\\temporaryfile")) returned 0 [0259.582] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569\\temporaryfile")) returned 1 [0259.584] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.584] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.584] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.584] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.584] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.584] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.584] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.584] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569\\temporaryfile")) returned 1 [0259.584] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fa860c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fa860c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fa860c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.584] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.584] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328569" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328569")) returned 1 [0259.585] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF") returned 0 [0259.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.585] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x16b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x16b8, lpOverlapped=0x0) returned 1 [0259.586] CloseHandle (hObject=0xdc) returned 1 [0259.586] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.587] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4732 [0259.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x473a) returned 0x2350048 [0259.587] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x4732, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x4732, lpOverlapped=0x0) returned 1 [0259.589] CloseHandle (hObject=0xdc) returned 1 [0259.589] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf")) returned 1 [0259.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.590] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.590] GetTickCount () returned 0x50388 [0259.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.590] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584\\....\\temporaryfile")) returned 0 [0259.591] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584\\temporaryfile")) returned 1 [0259.592] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.592] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.592] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.592] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.592] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.592] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.592] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.593] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584\\temporaryfile")) returned 1 [0259.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.593] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.593] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584")) returned 1 [0259.593] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF") returned 0 [0259.594] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.594] WriteFile (in: hFile=0xdc, lpBuffer=0x2354798*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2354798*, lpNumberOfBytesWritten=0x18fdd8*=0x4738, lpOverlapped=0x0) returned 1 [0259.595] CloseHandle (hObject=0xdc) returned 1 [0259.595] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.596] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6bf6 [0259.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6bfe) returned 0x2350048 [0259.596] ReadFile (in: hFile=0xdc, lpBuffer=0x2350050, nNumberOfBytesToRead=0x6bf6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fdf0*=0x6bf6, lpOverlapped=0x0) returned 1 [0259.598] CloseHandle (hObject=0xdc) returned 1 [0259.598] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf")) returned 1 [0259.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.599] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.599] GetTickCount () returned 0x50388 [0259.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.599] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.600] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584\\....\\temporaryfile")) returned 0 [0259.600] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584\\temporaryfile")) returned 1 [0259.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.602] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.602] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.602] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.602] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.602] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.602] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.602] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584\\temporaryfile")) returned 1 [0259.602] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faac220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faac220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faac220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.602] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.602] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328584" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328584")) returned 1 [0259.602] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF") returned 0 [0259.608] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.609] WriteFile (in: hFile=0xdc, lpBuffer=0x2356c58*, nNumberOfBytesToWrite=0x6c00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2356c58*, lpNumberOfBytesWritten=0x18fdd8*=0x6c00, lpOverlapped=0x0) returned 1 [0259.610] CloseHandle (hObject=0xdc) returned 1 [0259.610] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.611] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd6e [0259.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd76) returned 0x2450048 [0259.611] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xd6e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xd6e, lpOverlapped=0x0) returned 1 [0259.613] CloseHandle (hObject=0xdc) returned 1 [0259.613] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf")) returned 1 [0259.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.614] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.614] GetTickCount () returned 0x50398 [0259.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.614] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328600\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328600\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328600\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328600\\....\\temporaryfile")) returned 0 [0259.615] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328600\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328600\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328600\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328600\\temporaryfile")) returned 1 [0259.616] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328600\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fad2380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fad2380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fad2380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.616] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fad2380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fad2380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fad2380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.616] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fad2380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fad2380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fad2380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.616] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328600\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fad2380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fad2380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fad2380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.616] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fad2380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fad2380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fad2380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.616] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fad2380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fad2380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fad2380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.617] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.617] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328600\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328600\\temporaryfile")) returned 1 [0259.617] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fad2380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fad2380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fad2380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.617] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.617] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328600" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328600")) returned 1 [0259.617] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF") returned 0 [0259.617] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.618] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xd78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xd78, lpOverlapped=0x0) returned 1 [0259.619] CloseHandle (hObject=0xdc) returned 1 [0259.619] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.620] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b74 [0259.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b7c) returned 0x2c4a70 [0259.620] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b74, lpOverlapped=0x0) returned 1 [0259.621] CloseHandle (hObject=0xdc) returned 1 [0259.621] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf")) returned 1 [0259.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.622] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.622] GetTickCount () returned 0x503a8 [0259.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.623] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.623] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328616\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328616\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328616\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328616\\....\\temporaryfile")) returned 0 [0259.623] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328616\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328616\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328616\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328616\\temporaryfile")) returned 1 [0259.624] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328616\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faf84e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faf84e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faf84e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.625] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faf84e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faf84e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faf84e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.625] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faf84e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faf84e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faf84e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.625] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328616\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faf84e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faf84e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faf84e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.625] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faf84e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faf84e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faf84e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.625] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faf84e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faf84e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faf84e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.625] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.625] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328616\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328616\\temporaryfile")) returned 1 [0259.625] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9faf84e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9faf84e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9faf84e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.625] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.625] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328616" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328616")) returned 1 [0259.625] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF") returned 0 [0259.626] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.626] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x1b78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x1b78, lpOverlapped=0x0) returned 1 [0259.627] CloseHandle (hObject=0xdc) returned 1 [0259.628] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.628] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x40412 [0259.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4041a) returned 0x2c8700 [0259.628] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x40412, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x40412, lpOverlapped=0x0) returned 1 [0259.633] CloseHandle (hObject=0xdc) returned 1 [0259.633] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf")) returned 1 [0259.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.636] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.636] GetTickCount () returned 0x503b7 [0259.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.636] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.637] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328631\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328631\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328631\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328631\\....\\temporaryfile")) returned 0 [0259.638] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328631\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328631\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328631\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328631\\temporaryfile")) returned 1 [0259.639] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328631\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb1e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb1e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb1e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.639] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb1e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb1e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb1e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.639] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb1e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb1e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb1e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.639] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328631\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb1e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb1e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb1e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.639] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb1e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb1e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb1e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.639] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb1e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb1e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb1e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.639] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.639] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328631\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328631\\temporaryfile")) returned 1 [0259.640] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb1e640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb1e640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb1e640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.640] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.640] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328631" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328631")) returned 1 [0259.640] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF") returned 0 [0259.645] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.646] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x40418, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x40418, lpOverlapped=0x0) returned 1 [0259.651] CloseHandle (hObject=0xdc) returned 1 [0259.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.652] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2b16e [0259.652] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b176) returned 0x2c8700 [0259.652] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2b16e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2b16e, lpOverlapped=0x0) returned 1 [0259.655] CloseHandle (hObject=0xdc) returned 1 [0259.656] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf")) returned 1 [0259.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.657] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.657] GetTickCount () returned 0x503c7 [0259.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.658] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328647\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328647\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328647\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328647\\....\\temporaryfile")) returned 0 [0259.659] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328647\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328647\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328647\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328647\\temporaryfile")) returned 1 [0259.660] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328647\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb447a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb447a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb447a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.660] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb447a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb447a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb447a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.660] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb447a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb447a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb447a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.660] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328647\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb447a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb447a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb447a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.660] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb447a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb447a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb447a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.660] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb447a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb447a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb447a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.660] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.660] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328647\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328647\\temporaryfile")) returned 1 [0259.661] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb447a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb447a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb447a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.661] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.661] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328647" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328647")) returned 1 [0259.661] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF") returned 0 [0259.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.664] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x2b178, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x2b178, lpOverlapped=0x0) returned 1 [0259.667] CloseHandle (hObject=0xdc) returned 1 [0259.667] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.668] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4e82 [0259.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4e8a) returned 0x2c8700 [0259.669] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4e82, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4e82, lpOverlapped=0x0) returned 1 [0259.670] CloseHandle (hObject=0xdc) returned 1 [0259.670] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf")) returned 1 [0259.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.671] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.671] GetTickCount () returned 0x503d6 [0259.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.672] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328662\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328662\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328662\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328662\\....\\temporaryfile")) returned 0 [0259.672] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328662\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328662\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328662\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328662\\temporaryfile")) returned 1 [0259.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328662\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb6a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb6a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb6a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb6a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb6a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb6a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb6a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb6a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb6a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328662\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb6a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb6a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb6a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.678] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb6a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb6a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb6a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.678] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb6a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb6a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb6a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.678] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328662\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328662\\temporaryfile")) returned 1 [0259.679] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb6a900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb6a900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb6a900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.679] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328662" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328662")) returned 1 [0259.679] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF") returned 0 [0259.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.680] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd5a0*, nNumberOfBytesToWrite=0x4e88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd5a0*, lpNumberOfBytesWritten=0x18fdd8*=0x4e88, lpOverlapped=0x0) returned 1 [0259.681] CloseHandle (hObject=0xdc) returned 1 [0259.682] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.682] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4ada [0259.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4ae2) returned 0x2c8700 [0259.682] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4ada, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4ada, lpOverlapped=0x0) returned 1 [0259.684] CloseHandle (hObject=0xdc) returned 1 [0259.684] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf")) returned 1 [0259.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.685] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.685] GetTickCount () returned 0x503e6 [0259.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.685] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.686] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678\\....\\temporaryfile")) returned 0 [0259.686] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678\\temporaryfile")) returned 1 [0259.687] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.688] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.688] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.688] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.688] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.688] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.688] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678\\temporaryfile")) returned 1 [0259.688] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.688] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.688] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678")) returned 1 [0259.688] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF") returned 0 [0259.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.689] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd1f8*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd1f8*, lpNumberOfBytesWritten=0x18fdd8*=0x4ae0, lpOverlapped=0x0) returned 1 [0259.690] CloseHandle (hObject=0xdc) returned 1 [0259.691] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.691] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2028 [0259.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2030) returned 0x2c8700 [0259.691] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2028, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2028, lpOverlapped=0x0) returned 1 [0259.693] CloseHandle (hObject=0xdc) returned 1 [0259.693] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf")) returned 1 [0259.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.694] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.694] GetTickCount () returned 0x503e6 [0259.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.694] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.694] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678\\....\\temporaryfile")) returned 0 [0259.695] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678\\temporaryfile")) returned 1 [0259.696] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.697] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.697] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.697] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.697] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678\\temporaryfile")) returned 1 [0259.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fb90a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fb90a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fb90a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.697] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328678" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328678")) returned 1 [0259.697] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF") returned 0 [0259.698] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.698] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca740*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca740*, lpNumberOfBytesWritten=0x18fdd8*=0x2030, lpOverlapped=0x0) returned 1 [0259.699] CloseHandle (hObject=0xdc) returned 1 [0259.700] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.701] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x28ae [0259.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28b6) returned 0x2c8700 [0259.701] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x28ae, lpOverlapped=0x0) returned 1 [0259.702] CloseHandle (hObject=0xdc) returned 1 [0259.702] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf")) returned 1 [0259.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.703] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.703] GetTickCount () returned 0x503f6 [0259.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.704] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328694\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328694\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328694\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328694\\....\\temporaryfile")) returned 0 [0259.704] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328694\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328694\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328694\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328694\\temporaryfile")) returned 1 [0259.706] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328694\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbb6bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbb6bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbb6bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbb6bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbb6bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbb6bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbb6bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbb6bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbb6bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.706] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328694\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbb6bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbb6bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbb6bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.706] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbb6bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbb6bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbb6bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.706] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbb6bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbb6bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbb6bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.706] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.706] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328694\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328694\\temporaryfile")) returned 1 [0259.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbb6bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbb6bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbb6bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.706] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.706] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328694" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328694")) returned 1 [0259.706] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF") returned 0 [0259.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.707] WriteFile (in: hFile=0xdc, lpBuffer=0x2cafc8*, nNumberOfBytesToWrite=0x28b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cafc8*, lpNumberOfBytesWritten=0x18fdd8*=0x28b8, lpOverlapped=0x0) returned 1 [0259.710] CloseHandle (hObject=0xdc) returned 1 [0259.710] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.711] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x349c [0259.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x34a4) returned 0x2c8700 [0259.711] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x349c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x349c, lpOverlapped=0x0) returned 1 [0259.712] CloseHandle (hObject=0xdc) returned 1 [0259.712] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf")) returned 1 [0259.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.713] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.714] GetTickCount () returned 0x50405 [0259.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.714] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.714] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709\\....\\temporaryfile")) returned 0 [0259.715] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709\\temporaryfile")) returned 1 [0259.716] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.716] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.716] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.716] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.716] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.716] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.716] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.716] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709\\temporaryfile")) returned 1 [0259.717] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.717] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.717] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709")) returned 1 [0259.717] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF") returned 0 [0259.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.718] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbbb8*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbbb8*, lpNumberOfBytesWritten=0x18fdd8*=0x34a0, lpOverlapped=0x0) returned 1 [0259.719] CloseHandle (hObject=0xdc) returned 1 [0259.719] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.720] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xce0 [0259.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xce8) returned 0x2450048 [0259.720] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xce0, lpOverlapped=0x0) returned 1 [0259.721] CloseHandle (hObject=0xdc) returned 1 [0259.721] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf")) returned 1 [0259.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.722] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.722] GetTickCount () returned 0x50405 [0259.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.723] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.723] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709\\....\\temporaryfile")) returned 0 [0259.723] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709\\temporaryfile")) returned 1 [0259.725] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.725] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.725] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.725] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.725] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.725] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.725] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709\\temporaryfile")) returned 1 [0259.725] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fbdcd20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fbdcd20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fbdcd20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.725] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.725] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328709" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328709")) returned 1 [0259.726] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF") returned 0 [0259.726] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.726] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xce8, lpOverlapped=0x0) returned 1 [0259.727] CloseHandle (hObject=0xdc) returned 1 [0259.728] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.728] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb9e [0259.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xba6) returned 0x2450048 [0259.728] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xb9e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xb9e, lpOverlapped=0x0) returned 1 [0259.730] CloseHandle (hObject=0xdc) returned 1 [0259.730] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf")) returned 1 [0259.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.731] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.731] GetTickCount () returned 0x50415 [0259.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.731] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725\\....\\temporaryfile")) returned 0 [0259.732] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725\\temporaryfile")) returned 1 [0259.733] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.733] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.733] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.733] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.733] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.733] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725\\temporaryfile")) returned 1 [0259.734] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.734] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.734] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725")) returned 1 [0259.734] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF") returned 0 [0259.734] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.735] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xba8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xba8, lpOverlapped=0x0) returned 1 [0259.736] CloseHandle (hObject=0xdc) returned 1 [0259.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.736] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc88 [0259.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc90) returned 0x2450048 [0259.736] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xc88, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xc88, lpOverlapped=0x0) returned 1 [0259.738] CloseHandle (hObject=0xdc) returned 1 [0259.738] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf")) returned 1 [0259.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.739] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.739] GetTickCount () returned 0x50415 [0259.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.739] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725\\....\\temporaryfile")) returned 0 [0259.740] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725\\temporaryfile")) returned 1 [0259.742] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.742] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.742] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.742] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.742] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.742] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.742] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.742] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725\\temporaryfile")) returned 1 [0259.743] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc02e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc02e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc02e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.743] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.743] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328725" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328725")) returned 1 [0259.743] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF") returned 0 [0259.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.744] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xc90, lpOverlapped=0x0) returned 1 [0259.745] CloseHandle (hObject=0xdc) returned 1 [0259.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.746] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14c4 [0259.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14cc) returned 0x29b460 [0259.746] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x14c4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x14c4, lpOverlapped=0x0) returned 1 [0259.748] CloseHandle (hObject=0xdc) returned 1 [0259.748] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf")) returned 1 [0259.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.749] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.749] GetTickCount () returned 0x50424 [0259.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.749] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.750] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740\\....\\temporaryfile")) returned 0 [0259.750] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740\\temporaryfile")) returned 1 [0259.752] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.752] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.752] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.752] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.752] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.752] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.752] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.752] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740\\temporaryfile")) returned 1 [0259.752] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.752] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.753] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740")) returned 1 [0259.753] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF") returned 0 [0259.753] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.754] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x14c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x14c8, lpOverlapped=0x0) returned 1 [0259.754] CloseHandle (hObject=0xdc) returned 1 [0259.755] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.755] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x460 [0259.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x468) returned 0x259e70 [0259.755] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x460, lpOverlapped=0x0) returned 1 [0259.757] CloseHandle (hObject=0xdc) returned 1 [0259.757] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf")) returned 1 [0259.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.758] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.758] GetTickCount () returned 0x50424 [0259.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.758] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.758] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740\\....\\temporaryfile")) returned 0 [0259.759] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740\\temporaryfile")) returned 1 [0259.760] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc4f140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc4f140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.760] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc4f140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc4f140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.761] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.761] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.761] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.761] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.761] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.761] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740\\temporaryfile")) returned 1 [0259.761] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc28fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc28fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc28fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.761] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.761] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328740" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328740")) returned 1 [0259.761] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF") returned 0 [0259.762] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.762] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x468, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x468, lpOverlapped=0x0) returned 1 [0259.763] CloseHandle (hObject=0xdc) returned 1 [0259.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.764] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x270 [0259.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x278) returned 0x259e70 [0259.765] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x270, lpOverlapped=0x0) returned 1 [0259.766] CloseHandle (hObject=0xdc) returned 1 [0259.766] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf")) returned 1 [0259.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.766] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.766] GetTickCount () returned 0x50434 [0259.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.767] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.767] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328756\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328756\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328756\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328756\\....\\temporaryfile")) returned 0 [0259.768] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328756\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328756\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328756\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328756\\temporaryfile")) returned 1 [0259.769] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328756\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc4f140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc4f140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc4f140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.769] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc4f140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc4f140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc4f140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.769] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc4f140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc4f140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc4f140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.769] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328756\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc4f140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc4f140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc4f140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.769] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc4f140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc4f140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc4f140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.769] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc4f140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc4f140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc4f140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.769] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.769] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328756\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328756\\temporaryfile")) returned 1 [0259.770] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc4f140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc4f140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc4f140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.770] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.770] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328756" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328756")) returned 1 [0259.770] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF") returned 0 [0259.770] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.771] WriteFile (in: hFile=0xdc, lpBuffer=0x25a0f8*, nNumberOfBytesToWrite=0x278, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a0f8*, lpNumberOfBytesWritten=0x18fdd8*=0x278, lpOverlapped=0x0) returned 1 [0259.772] CloseHandle (hObject=0xdc) returned 1 [0259.772] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.772] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1138 [0259.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1140) returned 0x25b528 [0259.772] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1138, lpOverlapped=0x0) returned 1 [0259.774] CloseHandle (hObject=0xdc) returned 1 [0259.774] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf")) returned 1 [0259.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.775] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.775] GetTickCount () returned 0x50444 [0259.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.775] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.775] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772\\....\\temporaryfile")) returned 0 [0259.776] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772\\temporaryfile")) returned 1 [0259.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.777] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.777] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.777] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.777] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772\\temporaryfile")) returned 1 [0259.778] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.778] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.778] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772")) returned 1 [0259.778] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF") returned 0 [0259.778] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.779] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1140, lpOverlapped=0x0) returned 1 [0259.780] CloseHandle (hObject=0xdc) returned 1 [0259.780] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.781] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10c8 [0259.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10d0) returned 0x25b528 [0259.781] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x10c8, lpOverlapped=0x0) returned 1 [0259.782] CloseHandle (hObject=0xdc) returned 1 [0259.782] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf")) returned 1 [0259.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.783] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.783] GetTickCount () returned 0x50444 [0259.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.784] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.784] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772\\....\\temporaryfile")) returned 0 [0259.785] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772\\temporaryfile")) returned 1 [0259.786] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.786] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.786] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.786] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.786] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.786] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.786] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.786] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772\\temporaryfile")) returned 1 [0259.787] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc752a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc752a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc752a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.787] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.787] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328772" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328772")) returned 1 [0259.787] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF") returned 0 [0259.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.788] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x10d0, lpOverlapped=0x0) returned 1 [0259.789] CloseHandle (hObject=0xdc) returned 1 [0259.789] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.790] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdb8 [0259.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xdc0) returned 0x2450048 [0259.790] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xdb8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xdb8, lpOverlapped=0x0) returned 1 [0259.791] CloseHandle (hObject=0xdc) returned 1 [0259.791] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf")) returned 1 [0259.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.792] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.792] GetTickCount () returned 0x50453 [0259.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.793] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.793] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787\\....\\temporaryfile")) returned 0 [0259.793] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787\\temporaryfile")) returned 1 [0259.795] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.795] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.795] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.795] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.795] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.795] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.795] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.795] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787\\temporaryfile")) returned 1 [0259.795] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.795] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.795] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787")) returned 1 [0259.795] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF") returned 0 [0259.796] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.796] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xdc0, lpOverlapped=0x0) returned 1 [0259.797] CloseHandle (hObject=0xdc) returned 1 [0259.797] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.798] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x27e0 [0259.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x27e8) returned 0x2c8700 [0259.798] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x27e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x27e0, lpOverlapped=0x0) returned 1 [0259.799] CloseHandle (hObject=0xdc) returned 1 [0259.799] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf")) returned 1 [0259.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.800] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.800] GetTickCount () returned 0x50453 [0259.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.801] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787\\....\\temporaryfile")) returned 0 [0259.802] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787\\temporaryfile")) returned 1 [0259.803] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.803] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.803] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.803] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.803] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.803] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.803] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.803] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787\\temporaryfile")) returned 1 [0259.804] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fc9b400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fc9b400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fc9b400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.804] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328787" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328787")) returned 1 [0259.804] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF") returned 0 [0259.804] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.805] WriteFile (in: hFile=0xdc, lpBuffer=0x2caef8*, nNumberOfBytesToWrite=0x27e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caef8*, lpNumberOfBytesWritten=0x18fdd8*=0x27e8, lpOverlapped=0x0) returned 1 [0259.811] CloseHandle (hObject=0xdc) returned 1 [0259.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.811] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x918 [0259.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x920) returned 0x2450048 [0259.811] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x918, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x918, lpOverlapped=0x0) returned 1 [0259.813] CloseHandle (hObject=0xdc) returned 1 [0259.813] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf")) returned 1 [0259.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.814] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.814] GetTickCount () returned 0x50463 [0259.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.814] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328803\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328803\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.815] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328803\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328803\\....\\temporaryfile")) returned 0 [0259.815] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328803\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328803\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328803\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328803\\temporaryfile")) returned 1 [0259.816] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328803\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fcc1560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fcc1560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fcc1560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.816] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fcc1560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fcc1560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fcc1560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.816] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fcc1560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fcc1560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fcc1560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.816] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328803\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fcc1560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fcc1560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fcc1560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.816] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fcc1560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fcc1560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fcc1560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.816] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fcc1560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fcc1560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fcc1560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.816] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.816] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328803\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328803\\temporaryfile")) returned 1 [0259.817] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fcc1560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fcc1560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fcc1560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.817] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.817] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328803" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328803")) returned 1 [0259.817] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF") returned 0 [0259.817] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.818] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x920, lpOverlapped=0x0) returned 1 [0259.819] CloseHandle (hObject=0xdc) returned 1 [0259.819] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.820] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x43c [0259.820] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x444) returned 0x259e70 [0259.820] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x43c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x43c, lpOverlapped=0x0) returned 1 [0259.821] CloseHandle (hObject=0xdc) returned 1 [0259.821] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf")) returned 1 [0259.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.822] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.822] GetTickCount () returned 0x50472 [0259.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.823] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818\\....\\temporaryfile")) returned 0 [0259.823] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818\\temporaryfile")) returned 1 [0259.825] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.825] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.825] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.825] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.825] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.825] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.825] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.825] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818\\temporaryfile")) returned 1 [0259.825] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.825] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.826] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818")) returned 1 [0259.826] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF") returned 0 [0259.826] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.826] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x440, lpOverlapped=0x0) returned 1 [0259.827] CloseHandle (hObject=0xdc) returned 1 [0259.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.828] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x474 [0259.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x47c) returned 0x259e70 [0259.828] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x474, lpOverlapped=0x0) returned 1 [0259.829] CloseHandle (hObject=0xdc) returned 1 [0259.830] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf")) returned 1 [0259.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.830] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.830] GetTickCount () returned 0x50472 [0259.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.831] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818\\....\\temporaryfile")) returned 0 [0259.832] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818\\temporaryfile")) returned 1 [0259.833] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.833] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.833] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.833] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.833] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818\\temporaryfile")) returned 1 [0259.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fce76c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fce76c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fce76c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.834] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328818" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328818")) returned 1 [0259.834] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF") returned 0 [0259.834] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.835] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x478, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x478, lpOverlapped=0x0) returned 1 [0259.836] CloseHandle (hObject=0xdc) returned 1 [0259.836] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.836] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x66c [0259.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x674) returned 0x259e70 [0259.837] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x66c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x66c, lpOverlapped=0x0) returned 1 [0259.839] CloseHandle (hObject=0xdc) returned 1 [0259.839] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf")) returned 1 [0259.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.839] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.839] GetTickCount () returned 0x50482 [0259.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.840] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834\\....\\temporaryfile")) returned 0 [0259.841] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834\\temporaryfile")) returned 1 [0259.842] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.842] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.842] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.842] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.842] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.842] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834\\temporaryfile")) returned 1 [0259.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.842] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.842] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834")) returned 1 [0259.843] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF") returned 0 [0259.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.843] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x670, lpOverlapped=0x0) returned 1 [0259.844] CloseHandle (hObject=0xdc) returned 1 [0259.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.845] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a0 [0259.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a8) returned 0x259e70 [0259.845] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2a0, lpOverlapped=0x0) returned 1 [0259.846] CloseHandle (hObject=0xdc) returned 1 [0259.846] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf")) returned 1 [0259.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.847] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.847] GetTickCount () returned 0x50482 [0259.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.848] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834\\....\\temporaryfile")) returned 0 [0259.848] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834\\temporaryfile")) returned 1 [0259.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.850] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.850] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.850] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834\\temporaryfile")) returned 1 [0259.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd0d820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd0d820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd0d820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.850] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328834" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328834")) returned 1 [0259.851] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF") returned 0 [0259.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.851] WriteFile (in: hFile=0xdc, lpBuffer=0x25a128*, nNumberOfBytesToWrite=0x2a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a128*, lpNumberOfBytesWritten=0x18fdd8*=0x2a8, lpOverlapped=0x0) returned 1 [0259.853] CloseHandle (hObject=0xdc) returned 1 [0259.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.853] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1fe8 [0259.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ff0) returned 0x2c8700 [0259.853] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1fe8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1fe8, lpOverlapped=0x0) returned 1 [0259.855] CloseHandle (hObject=0xdc) returned 1 [0259.855] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf")) returned 1 [0259.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.856] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.856] GetTickCount () returned 0x50492 [0259.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.856] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850\\....\\temporaryfile")) returned 0 [0259.857] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850\\temporaryfile")) returned 1 [0259.858] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.858] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.858] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.858] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.858] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.858] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850\\temporaryfile")) returned 1 [0259.859] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.859] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.859] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850")) returned 1 [0259.859] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF") returned 0 [0259.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.860] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca700*, nNumberOfBytesToWrite=0x1ff0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca700*, lpNumberOfBytesWritten=0x18fdd8*=0x1ff0, lpOverlapped=0x0) returned 1 [0259.861] CloseHandle (hObject=0xdc) returned 1 [0259.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.862] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4816 [0259.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x481e) returned 0x2c8700 [0259.862] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4816, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4816, lpOverlapped=0x0) returned 1 [0259.864] CloseHandle (hObject=0xdc) returned 1 [0259.864] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf")) returned 1 [0259.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.865] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.865] GetTickCount () returned 0x50492 [0259.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.865] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850\\....\\temporaryfile")) returned 0 [0259.866] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850\\temporaryfile")) returned 1 [0259.867] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.868] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.868] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.868] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.868] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.868] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.868] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.868] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850\\temporaryfile")) returned 1 [0259.868] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd33980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd33980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd33980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.868] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.868] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328850" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328850")) returned 1 [0259.868] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF") returned 0 [0259.869] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.870] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccf30*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccf30*, lpNumberOfBytesWritten=0x18fdd8*=0x4820, lpOverlapped=0x0) returned 1 [0259.871] CloseHandle (hObject=0xdc) returned 1 [0259.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.871] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c50 [0259.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c58) returned 0x2c8700 [0259.871] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7c50, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7c50, lpOverlapped=0x0) returned 1 [0259.873] CloseHandle (hObject=0xdc) returned 1 [0259.873] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf")) returned 1 [0259.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.874] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.874] GetTickCount () returned 0x504a1 [0259.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.875] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328865\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328865\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328865\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328865\\....\\temporaryfile")) returned 0 [0259.875] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328865\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328865\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328865\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328865\\temporaryfile")) returned 1 [0259.877] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328865\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd59ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd59ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd59ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.877] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd59ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd59ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd59ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.877] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd59ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd59ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd59ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.877] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328865\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd59ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd59ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd59ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.877] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd59ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd59ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd59ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.877] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd59ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd59ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd59ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.877] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328865\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328865\\temporaryfile")) returned 1 [0259.877] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd59ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd59ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd59ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.877] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328865" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328865")) returned 1 [0259.878] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF") returned 0 [0259.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.879] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0368*, nNumberOfBytesToWrite=0x7c58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0368*, lpNumberOfBytesWritten=0x18fdd8*=0x7c58, lpOverlapped=0x0) returned 1 [0259.880] CloseHandle (hObject=0xdc) returned 1 [0259.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.882] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xfe4 [0259.882] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfec) returned 0x25f580 [0259.882] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xfe4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xfe4, lpOverlapped=0x0) returned 1 [0259.883] CloseHandle (hObject=0xdc) returned 1 [0259.883] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf")) returned 1 [0259.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.884] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.884] GetTickCount () returned 0x504b1 [0259.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.885] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.885] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881\\....\\temporaryfile")) returned 0 [0259.885] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881\\temporaryfile")) returned 1 [0259.887] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.887] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.887] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.887] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.887] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.887] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.887] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.887] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881\\temporaryfile")) returned 1 [0259.887] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.887] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.887] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881")) returned 1 [0259.887] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF") returned 0 [0259.888] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.888] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xfe8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xfe8, lpOverlapped=0x0) returned 1 [0259.889] CloseHandle (hObject=0xdc) returned 1 [0259.889] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.890] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd00 [0259.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd08) returned 0x2450048 [0259.890] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xd00, lpOverlapped=0x0) returned 1 [0259.891] CloseHandle (hObject=0xdc) returned 1 [0259.891] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf")) returned 1 [0259.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.892] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.892] GetTickCount () returned 0x504b1 [0259.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.893] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881\\....\\temporaryfile")) returned 0 [0259.894] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881\\temporaryfile")) returned 1 [0259.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.895] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.895] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.895] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.895] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.895] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.896] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881\\temporaryfile")) returned 1 [0259.896] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fd7fc40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fd7fc40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fd7fc40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.896] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.896] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328881" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328881")) returned 1 [0259.896] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF") returned 0 [0259.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.897] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xd08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xd08, lpOverlapped=0x0) returned 1 [0259.898] CloseHandle (hObject=0xdc) returned 1 [0259.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.898] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8e0 [0259.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8e8) returned 0x2450048 [0259.899] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x8e0, lpOverlapped=0x0) returned 1 [0259.900] CloseHandle (hObject=0xdc) returned 1 [0259.900] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf")) returned 1 [0259.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.901] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.901] GetTickCount () returned 0x504c0 [0259.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.902] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896\\....\\temporaryfile")) returned 0 [0259.902] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896\\temporaryfile")) returned 1 [0259.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.904] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.904] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.904] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.904] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896\\temporaryfile")) returned 1 [0259.904] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.904] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896")) returned 1 [0259.904] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF") returned 0 [0259.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.905] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x8e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x8e8, lpOverlapped=0x0) returned 1 [0259.906] CloseHandle (hObject=0xdc) returned 1 [0259.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.907] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe14 [0259.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe1c) returned 0x2450048 [0259.907] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xe14, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xe14, lpOverlapped=0x0) returned 1 [0259.910] CloseHandle (hObject=0xdc) returned 1 [0259.910] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf")) returned 1 [0259.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.911] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.911] GetTickCount () returned 0x504c0 [0259.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.912] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896\\....\\temporaryfile")) returned 0 [0259.913] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896\\temporaryfile")) returned 1 [0259.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.914] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.914] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.914] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.914] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.914] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896\\temporaryfile")) returned 1 [0259.915] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fda5da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fda5da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fda5da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.915] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.915] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328896" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328896")) returned 1 [0259.915] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF") returned 0 [0259.915] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.916] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xe18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xe18, lpOverlapped=0x0) returned 1 [0259.917] CloseHandle (hObject=0xdc) returned 1 [0259.917] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.917] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17c4 [0259.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17cc) returned 0x2c4a70 [0259.917] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x17c4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x17c4, lpOverlapped=0x0) returned 1 [0259.919] CloseHandle (hObject=0xdc) returned 1 [0259.919] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf")) returned 1 [0259.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.920] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.920] GetTickCount () returned 0x504d0 [0259.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.920] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.921] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.921] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.921] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912\\....\\temporaryfile")) returned 0 [0259.921] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912\\temporaryfile")) returned 1 [0259.922] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.922] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.922] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.923] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.923] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.923] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.923] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.923] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912\\temporaryfile")) returned 1 [0259.923] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.923] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.923] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912")) returned 1 [0259.923] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF") returned 0 [0259.924] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.924] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x17c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x17c8, lpOverlapped=0x0) returned 1 [0259.925] CloseHandle (hObject=0xdc) returned 1 [0259.926] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.927] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd28 [0259.927] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd30) returned 0x2450048 [0259.927] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xd28, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xd28, lpOverlapped=0x0) returned 1 [0259.928] CloseHandle (hObject=0xdc) returned 1 [0259.928] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf")) returned 1 [0259.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.929] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.929] GetTickCount () returned 0x504d0 [0259.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.930] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912\\....\\temporaryfile")) returned 0 [0259.931] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912\\temporaryfile")) returned 1 [0259.932] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdf2060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdf2060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.932] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdf2060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdf2060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.932] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.932] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.932] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.932] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.932] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.933] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912\\temporaryfile")) returned 1 [0259.933] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdcbf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdcbf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdcbf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.933] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.933] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328912" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328912")) returned 1 [0259.933] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF") returned 0 [0259.933] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.934] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xd30, lpOverlapped=0x0) returned 1 [0259.935] CloseHandle (hObject=0xdc) returned 1 [0259.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.936] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc74 [0259.936] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc7c) returned 0x2450048 [0259.936] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xc74, lpOverlapped=0x0) returned 1 [0259.937] CloseHandle (hObject=0xdc) returned 1 [0259.937] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf")) returned 1 [0259.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.938] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.938] GetTickCount () returned 0x504e0 [0259.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.939] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328928\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328928\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328928\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328928\\....\\temporaryfile")) returned 0 [0259.939] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328928\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328928\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328928\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328928\\temporaryfile")) returned 1 [0259.945] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328928\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdf2060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdf2060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdf2060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.945] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdf2060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdf2060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdf2060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.946] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdf2060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdf2060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdf2060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328928\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdf2060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdf2060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdf2060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.946] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdf2060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdf2060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdf2060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.946] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdf2060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdf2060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdf2060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.946] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.946] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328928\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328928\\temporaryfile")) returned 1 [0259.946] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fdf2060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fdf2060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fdf2060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.946] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.946] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328928" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328928")) returned 1 [0259.946] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF") returned 0 [0259.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.947] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xc78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xc78, lpOverlapped=0x0) returned 1 [0259.948] CloseHandle (hObject=0xdc) returned 1 [0259.948] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.949] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcec [0259.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcf4) returned 0x2450048 [0259.949] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xcec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xcec, lpOverlapped=0x0) returned 1 [0259.950] CloseHandle (hObject=0xdc) returned 1 [0259.950] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf")) returned 1 [0259.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.951] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.951] GetTickCount () returned 0x504ef [0259.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.952] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328943\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328943\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328943\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328943\\....\\temporaryfile")) returned 0 [0259.952] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328943\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328943\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328943\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328943\\temporaryfile")) returned 1 [0259.953] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328943\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe181c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe181c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe181c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.954] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe181c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe181c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe181c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.954] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe181c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe181c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe181c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.954] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328943\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe181c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe181c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe181c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.954] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe181c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe181c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe181c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.954] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe181c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe181c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe181c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.954] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.954] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328943\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328943\\temporaryfile")) returned 1 [0259.954] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe181c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe181c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe181c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.954] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.954] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328943" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328943")) returned 1 [0259.954] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF") returned 0 [0259.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.955] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xcf0, lpOverlapped=0x0) returned 1 [0259.956] CloseHandle (hObject=0xdc) returned 1 [0259.956] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.960] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbd8 [0259.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbe0) returned 0x2450048 [0259.960] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xbd8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xbd8, lpOverlapped=0x0) returned 1 [0259.961] CloseHandle (hObject=0xdc) returned 1 [0259.961] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf")) returned 1 [0259.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.962] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.962] GetTickCount () returned 0x504ff [0259.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.963] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.963] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959\\....\\temporaryfile")) returned 0 [0259.963] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959\\temporaryfile")) returned 1 [0259.964] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.964] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.964] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.965] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.965] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.965] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.965] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.965] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959\\temporaryfile")) returned 1 [0259.965] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.965] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.965] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959")) returned 1 [0259.965] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF") returned 0 [0259.966] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.967] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xbe0, lpOverlapped=0x0) returned 1 [0259.968] CloseHandle (hObject=0xdc) returned 1 [0259.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.968] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x948 [0259.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x950) returned 0x2450048 [0259.968] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x948, lpOverlapped=0x0) returned 1 [0259.970] CloseHandle (hObject=0xdc) returned 1 [0259.970] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf")) returned 1 [0259.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.971] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.971] GetTickCount () returned 0x504ff [0259.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.971] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959\\....\\temporaryfile")) returned 0 [0259.972] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959\\temporaryfile")) returned 1 [0259.973] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.974] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.974] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.974] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.974] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.974] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.974] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959\\temporaryfile")) returned 1 [0259.974] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe3e320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe3e320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe3e320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.974] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.974] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328959" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328959")) returned 1 [0259.974] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF") returned 0 [0259.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.975] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x950, lpOverlapped=0x0) returned 1 [0259.976] CloseHandle (hObject=0xdc) returned 1 [0259.976] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.977] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc84 [0259.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc8c) returned 0x2450048 [0259.977] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xc84, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xc84, lpOverlapped=0x0) returned 1 [0259.979] CloseHandle (hObject=0xdc) returned 1 [0259.979] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf")) returned 1 [0259.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.980] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.980] GetTickCount () returned 0x5050e [0259.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.981] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974\\....\\temporaryfile")) returned 0 [0259.981] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974\\temporaryfile")) returned 1 [0259.982] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.982] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.983] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.983] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.983] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974\\temporaryfile")) returned 1 [0259.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.983] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974")) returned 1 [0259.983] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF") returned 0 [0259.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.984] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xc88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xc88, lpOverlapped=0x0) returned 1 [0259.985] CloseHandle (hObject=0xdc) returned 1 [0259.985] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.986] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb2c [0259.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb34) returned 0x2450048 [0259.986] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xb2c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xb2c, lpOverlapped=0x0) returned 1 [0259.988] CloseHandle (hObject=0xdc) returned 1 [0259.988] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf")) returned 1 [0259.988] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0259.989] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.989] GetTickCount () returned 0x5050e [0259.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.989] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974\\...."), lpSecurityAttributes=0x256210) returned 1 [0259.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974\\....\\temporaryfile")) returned 0 [0259.990] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974\\temporaryfile")) returned 1 [0259.992] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0259.992] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.992] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0259.992] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0259.992] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.992] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.992] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0259.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974\\temporaryfile")) returned 1 [0259.992] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe64480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe64480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe64480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0259.992] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0259.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328974" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328974")) returned 1 [0259.993] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF") returned 0 [0259.993] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.994] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xb30, lpOverlapped=0x0) returned 1 [0259.995] CloseHandle (hObject=0xdc) returned 1 [0259.995] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0259.995] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe64 [0259.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe6c) returned 0x2450048 [0259.995] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xe64, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xe64, lpOverlapped=0x0) returned 1 [0259.997] CloseHandle (hObject=0xdc) returned 1 [0259.997] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf")) returned 1 [0259.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0259.998] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0259.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0259.998] GetTickCount () returned 0x5051e [0259.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0259.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0259.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0259.998] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990\\...."), lpSecurityAttributes=0x256228) returned 1 [0259.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990\\....\\temporaryfile")) returned 0 [0259.999] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990\\temporaryfile")) returned 1 [0260.000] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.000] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.000] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.000] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.000] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.000] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.000] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.001] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990\\temporaryfile")) returned 1 [0260.001] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.001] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.001] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990")) returned 1 [0260.001] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF") returned 0 [0260.001] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.002] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xe68, lpOverlapped=0x0) returned 1 [0260.003] CloseHandle (hObject=0xdc) returned 1 [0260.003] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.003] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e98 [0260.004] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ea0) returned 0x2c8700 [0260.004] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1e98, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1e98, lpOverlapped=0x0) returned 1 [0260.005] CloseHandle (hObject=0xdc) returned 1 [0260.005] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf")) returned 1 [0260.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.006] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.006] GetTickCount () returned 0x5051e [0260.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.006] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.006] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990\\....\\temporaryfile")) returned 0 [0260.007] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990\\temporaryfile")) returned 1 [0260.009] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.009] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.009] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.009] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.009] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.009] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.009] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.009] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990\\temporaryfile")) returned 1 [0260.009] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fe8a5e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fe8a5e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fe8a5e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.010] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.010] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18328990" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18328990")) returned 1 [0260.010] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF") returned 0 [0260.010] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.011] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca5b0*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca5b0*, lpNumberOfBytesWritten=0x18fdd8*=0x1ea0, lpOverlapped=0x0) returned 1 [0260.012] CloseHandle (hObject=0xdc) returned 1 [0260.012] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.032] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd24 [0260.032] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd2c) returned 0x2450048 [0260.032] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xd24, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xd24, lpOverlapped=0x0) returned 1 [0260.034] CloseHandle (hObject=0xdc) returned 1 [0260.034] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf")) returned 1 [0260.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.035] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.035] GetTickCount () returned 0x5053d [0260.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.035] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.035] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329021\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329021\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329021\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329021\\....\\temporaryfile")) returned 0 [0260.036] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329021\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329021\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329021\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329021\\temporaryfile")) returned 1 [0260.037] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329021\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fed68a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fed68a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fed68a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.038] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fed68a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fed68a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fed68a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.038] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fed68a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fed68a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fed68a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.038] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329021\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fed68a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fed68a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fed68a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.038] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fed68a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fed68a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fed68a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.038] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fed68a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fed68a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fed68a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.038] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329021\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329021\\temporaryfile")) returned 1 [0260.038] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fed68a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fed68a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fed68a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.038] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.038] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329021" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329021")) returned 1 [0260.038] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF") returned 0 [0260.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.039] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xd28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xd28, lpOverlapped=0x0) returned 1 [0260.040] CloseHandle (hObject=0xdc) returned 1 [0260.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.042] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2120 [0260.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2128) returned 0x2c8700 [0260.042] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2120, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2120, lpOverlapped=0x0) returned 1 [0260.043] CloseHandle (hObject=0xdc) returned 1 [0260.043] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf")) returned 1 [0260.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.044] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.044] GetTickCount () returned 0x5054d [0260.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.044] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.045] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.045] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037\\....\\temporaryfile")) returned 0 [0260.045] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037\\temporaryfile")) returned 1 [0260.046] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.047] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.047] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.047] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.047] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.047] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.047] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037\\temporaryfile")) returned 1 [0260.047] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.047] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037")) returned 1 [0260.047] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF") returned 0 [0260.048] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.048] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca838*, nNumberOfBytesToWrite=0x2128, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca838*, lpNumberOfBytesWritten=0x18fdd8*=0x2128, lpOverlapped=0x0) returned 1 [0260.049] CloseHandle (hObject=0xdc) returned 1 [0260.050] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.050] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5080 [0260.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5088) returned 0x2c8700 [0260.050] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5080, lpOverlapped=0x0) returned 1 [0260.052] CloseHandle (hObject=0xdc) returned 1 [0260.052] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf")) returned 1 [0260.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.053] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.053] GetTickCount () returned 0x5054d [0260.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.053] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037\\....\\temporaryfile")) returned 0 [0260.054] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037\\temporaryfile")) returned 1 [0260.056] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.056] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.056] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.056] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.056] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.056] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.056] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.056] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037\\temporaryfile")) returned 1 [0260.056] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9fefca00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9fefca00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9fefca00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.056] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.056] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329037" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329037")) returned 1 [0260.056] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF") returned 0 [0260.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.058] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd798*, nNumberOfBytesToWrite=0x5088, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd798*, lpNumberOfBytesWritten=0x18fdd8*=0x5088, lpOverlapped=0x0) returned 1 [0260.059] CloseHandle (hObject=0xdc) returned 1 [0260.059] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.059] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1fc8 [0260.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1fd0) returned 0x2c8700 [0260.059] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1fc8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1fc8, lpOverlapped=0x0) returned 1 [0260.061] CloseHandle (hObject=0xdc) returned 1 [0260.061] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf")) returned 1 [0260.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.062] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.062] GetTickCount () returned 0x5055c [0260.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.062] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329052\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329052\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329052\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329052\\....\\temporaryfile")) returned 0 [0260.063] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329052\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329052\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329052\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329052\\temporaryfile")) returned 1 [0260.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329052\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff22b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff22b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff22b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.065] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff22b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff22b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff22b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.065] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff22b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff22b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff22b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.065] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329052\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff22b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff22b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff22b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.065] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff22b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff22b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff22b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.065] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff22b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff22b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff22b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.065] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.065] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329052\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329052\\temporaryfile")) returned 1 [0260.065] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff22b60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff22b60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff22b60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.065] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.065] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329052" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329052")) returned 1 [0260.065] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF") returned 0 [0260.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.066] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca6e0*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca6e0*, lpNumberOfBytesWritten=0x18fdd8*=0x1fd0, lpOverlapped=0x0) returned 1 [0260.067] CloseHandle (hObject=0xdc) returned 1 [0260.067] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.068] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x28ec [0260.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28f4) returned 0x2c8700 [0260.068] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x28ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x28ec, lpOverlapped=0x0) returned 1 [0260.069] CloseHandle (hObject=0xdc) returned 1 [0260.069] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf")) returned 1 [0260.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.070] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.071] GetTickCount () returned 0x5056c [0260.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.071] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068\\....\\temporaryfile")) returned 0 [0260.072] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068\\temporaryfile")) returned 1 [0260.073] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.073] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.073] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.073] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.073] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.073] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.073] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.073] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068\\temporaryfile")) returned 1 [0260.074] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.074] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.074] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068")) returned 1 [0260.074] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF") returned 0 [0260.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.075] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb008*, nNumberOfBytesToWrite=0x28f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb008*, lpNumberOfBytesWritten=0x18fdd8*=0x28f0, lpOverlapped=0x0) returned 1 [0260.076] CloseHandle (hObject=0xdc) returned 1 [0260.076] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.076] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb24 [0260.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb2c) returned 0x2450048 [0260.077] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xb24, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xb24, lpOverlapped=0x0) returned 1 [0260.078] CloseHandle (hObject=0xdc) returned 1 [0260.078] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf")) returned 1 [0260.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.079] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.079] GetTickCount () returned 0x5056c [0260.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.079] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.080] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068\\....\\temporaryfile")) returned 0 [0260.080] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068\\temporaryfile")) returned 1 [0260.081] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.081] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.081] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.082] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.082] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.082] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.082] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.082] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068\\temporaryfile")) returned 1 [0260.082] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff48cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff48cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff48cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.082] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.082] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329068" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329068")) returned 1 [0260.082] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF") returned 0 [0260.082] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.083] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xb28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xb28, lpOverlapped=0x0) returned 1 [0260.084] CloseHandle (hObject=0xdc) returned 1 [0260.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.085] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2fb8 [0260.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2fc0) returned 0x2c8700 [0260.085] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2fb8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2fb8, lpOverlapped=0x0) returned 1 [0260.086] CloseHandle (hObject=0xdc) returned 1 [0260.086] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf")) returned 1 [0260.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.087] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.087] GetTickCount () returned 0x5057c [0260.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.088] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084\\....\\temporaryfile")) returned 0 [0260.088] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084\\temporaryfile")) returned 1 [0260.089] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff6ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff6ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff6ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.090] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff6ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff6ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff6ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.090] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff6ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff6ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff6ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.090] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff6ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff6ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff6ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff6ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff6ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff6ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff6ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff6ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff6ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.090] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084\\temporaryfile")) returned 1 [0260.090] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff6ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff6ee20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff6ee20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.090] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084")) returned 1 [0260.090] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF") returned 0 [0260.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.096] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb6d0*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb6d0*, lpNumberOfBytesWritten=0x18fdd8*=0x2fc0, lpOverlapped=0x0) returned 1 [0260.098] CloseHandle (hObject=0xdc) returned 1 [0260.098] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.099] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x53c [0260.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x544) returned 0x259e70 [0260.099] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x53c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x53c, lpOverlapped=0x0) returned 1 [0260.100] CloseHandle (hObject=0xdc) returned 1 [0260.100] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf")) returned 1 [0260.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.101] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.101] GetTickCount () returned 0x5057c [0260.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.101] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.102] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084\\....\\temporaryfile")) returned 0 [0260.103] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084\\temporaryfile")) returned 1 [0260.104] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff6ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.104] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff6ee20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.104] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.104] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.104] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.104] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.104] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084\\temporaryfile")) returned 1 [0260.104] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.105] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.105] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329084" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329084")) returned 1 [0260.105] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF") returned 0 [0260.105] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.106] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x540, lpOverlapped=0x0) returned 1 [0260.106] CloseHandle (hObject=0xdc) returned 1 [0260.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.107] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1948 [0260.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1950) returned 0x2c4a70 [0260.107] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1948, lpOverlapped=0x0) returned 1 [0260.109] CloseHandle (hObject=0xdc) returned 1 [0260.109] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf")) returned 1 [0260.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.110] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.110] GetTickCount () returned 0x5058b [0260.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.110] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329099\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329099\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.111] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329099\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329099\\....\\temporaryfile")) returned 0 [0260.111] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329099\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329099\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329099\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329099\\temporaryfile")) returned 1 [0260.112] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329099\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.112] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.112] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.112] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329099\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.112] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.113] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.113] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.113] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329099\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329099\\temporaryfile")) returned 1 [0260.113] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ff94f80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ff94f80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ff94f80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.113] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.113] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329099" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329099")) returned 1 [0260.113] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF") returned 0 [0260.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.114] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1950, lpOverlapped=0x0) returned 1 [0260.115] CloseHandle (hObject=0xdc) returned 1 [0260.115] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.116] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c2c [0260.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c34) returned 0x2c4a70 [0260.116] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1c2c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1c2c, lpOverlapped=0x0) returned 1 [0260.117] CloseHandle (hObject=0xdc) returned 1 [0260.117] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf")) returned 1 [0260.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.118] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.118] GetTickCount () returned 0x5059b [0260.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.118] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.119] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115\\....\\temporaryfile")) returned 0 [0260.119] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115\\temporaryfile")) returned 1 [0260.121] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.121] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.121] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.121] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.121] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.121] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.121] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.121] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115\\temporaryfile")) returned 1 [0260.121] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.121] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.121] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115")) returned 1 [0260.121] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF") returned 0 [0260.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.122] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1c30, lpOverlapped=0x0) returned 1 [0260.123] CloseHandle (hObject=0xdc) returned 1 [0260.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.125] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xff8 [0260.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1000) returned 0x26aa38 [0260.125] ReadFile (in: hFile=0xdc, lpBuffer=0x26aa40, nNumberOfBytesToRead=0xff8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x26aa40*, lpNumberOfBytesRead=0x18fdf0*=0xff8, lpOverlapped=0x0) returned 1 [0260.126] CloseHandle (hObject=0xdc) returned 1 [0260.126] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf")) returned 1 [0260.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.127] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.127] GetTickCount () returned 0x5059b [0260.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.127] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115\\....\\temporaryfile")) returned 0 [0260.128] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115\\temporaryfile")) returned 1 [0260.129] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.129] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.130] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.130] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.130] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.130] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.130] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.130] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115\\temporaryfile")) returned 1 [0260.130] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffbb0e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffbb0e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffbb0e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.130] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.130] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329115" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329115")) returned 1 [0260.130] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF") returned 0 [0260.131] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.131] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x1000, lpOverlapped=0x0) returned 1 [0260.132] CloseHandle (hObject=0xdc) returned 1 [0260.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.133] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1434 [0260.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x143c) returned 0x25b528 [0260.133] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1434, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1434, lpOverlapped=0x0) returned 1 [0260.134] CloseHandle (hObject=0xdc) returned 1 [0260.134] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf")) returned 1 [0260.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.135] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.135] GetTickCount () returned 0x505aa [0260.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.136] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130\\....\\temporaryfile")) returned 0 [0260.136] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130\\temporaryfile")) returned 1 [0260.137] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.138] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.138] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.138] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.138] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.138] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.138] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.138] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130\\temporaryfile")) returned 1 [0260.138] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.138] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.138] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130")) returned 1 [0260.138] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF") returned 0 [0260.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.139] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1438, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1438, lpOverlapped=0x0) returned 1 [0260.140] CloseHandle (hObject=0xdc) returned 1 [0260.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.141] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3218 [0260.141] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3220) returned 0x2c8700 [0260.141] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3218, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3218, lpOverlapped=0x0) returned 1 [0260.143] CloseHandle (hObject=0xdc) returned 1 [0260.143] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf")) returned 1 [0260.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.144] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.144] GetTickCount () returned 0x505aa [0260.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.144] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.145] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130\\....\\temporaryfile")) returned 0 [0260.145] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130\\temporaryfile")) returned 1 [0260.147] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.147] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.147] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.147] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.147] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.147] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.147] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.147] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130\\temporaryfile")) returned 1 [0260.147] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9ffe1240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0x9ffe1240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0x9ffe1240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.147] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.147] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329130" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329130")) returned 1 [0260.148] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF") returned 0 [0260.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.149] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb930*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb930*, lpNumberOfBytesWritten=0x18fdd8*=0x3220, lpOverlapped=0x0) returned 1 [0260.150] CloseHandle (hObject=0xdc) returned 1 [0260.150] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.151] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x55c [0260.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x564) returned 0x259e70 [0260.151] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x55c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x55c, lpOverlapped=0x0) returned 1 [0260.152] CloseHandle (hObject=0xdc) returned 1 [0260.152] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf")) returned 1 [0260.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.153] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.153] GetTickCount () returned 0x505ba [0260.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.153] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.153] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146\\....\\temporaryfile")) returned 0 [0260.154] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146\\temporaryfile")) returned 1 [0260.155] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.155] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.155] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.155] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.155] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.155] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.156] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.156] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146\\temporaryfile")) returned 1 [0260.156] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.156] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.156] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146")) returned 1 [0260.156] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF") returned 0 [0260.156] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.157] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x560, lpOverlapped=0x0) returned 1 [0260.158] CloseHandle (hObject=0xdc) returned 1 [0260.158] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.158] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x88c [0260.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x894) returned 0x2450048 [0260.158] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x88c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x88c, lpOverlapped=0x0) returned 1 [0260.160] CloseHandle (hObject=0xdc) returned 1 [0260.160] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf")) returned 1 [0260.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.161] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.161] GetTickCount () returned 0x505ba [0260.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.162] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.162] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.162] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146\\....\\temporaryfile")) returned 0 [0260.162] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146\\temporaryfile")) returned 1 [0260.164] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.164] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.164] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.164] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.164] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.164] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.164] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146\\temporaryfile")) returned 1 [0260.164] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00073a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00073a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00073a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.164] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.164] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329146" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329146")) returned 1 [0260.164] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF") returned 0 [0260.165] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.165] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x890, lpOverlapped=0x0) returned 1 [0260.166] CloseHandle (hObject=0xdc) returned 1 [0260.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.167] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa34 [0260.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa3c) returned 0x2450048 [0260.167] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xa34, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xa34, lpOverlapped=0x0) returned 1 [0260.171] CloseHandle (hObject=0xdc) returned 1 [0260.171] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf")) returned 1 [0260.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.172] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.172] GetTickCount () returned 0x505ca [0260.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.172] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329162\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329162\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329162\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329162\\....\\temporaryfile")) returned 0 [0260.173] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329162\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329162\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329162\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329162\\temporaryfile")) returned 1 [0260.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329162\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa002d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa002d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa002d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa002d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa002d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa002d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa002d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa002d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa002d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329162\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa002d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa002d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa002d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.174] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa002d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa002d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa002d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.174] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa002d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa002d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa002d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.175] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.175] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329162\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329162\\temporaryfile")) returned 1 [0260.175] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa002d500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa002d500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa002d500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.175] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.175] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329162" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329162")) returned 1 [0260.175] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF") returned 0 [0260.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.176] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa38, lpOverlapped=0x0) returned 1 [0260.177] CloseHandle (hObject=0xdc) returned 1 [0260.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.178] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8a0 [0260.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8a8) returned 0x2450048 [0260.178] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x8a0, lpOverlapped=0x0) returned 1 [0260.179] CloseHandle (hObject=0xdc) returned 1 [0260.179] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf")) returned 1 [0260.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.180] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.180] GetTickCount () returned 0x505d9 [0260.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.181] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177\\....\\temporaryfile")) returned 0 [0260.182] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177\\temporaryfile")) returned 1 [0260.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.183] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.183] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177\\temporaryfile")) returned 1 [0260.184] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.184] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177")) returned 1 [0260.184] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF") returned 0 [0260.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.185] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x8a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x8a8, lpOverlapped=0x0) returned 1 [0260.186] CloseHandle (hObject=0xdc) returned 1 [0260.186] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.186] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc28 [0260.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc30) returned 0x2450048 [0260.186] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xc28, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xc28, lpOverlapped=0x0) returned 1 [0260.188] CloseHandle (hObject=0xdc) returned 1 [0260.188] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf")) returned 1 [0260.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.189] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.189] GetTickCount () returned 0x505d9 [0260.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.189] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177\\....\\temporaryfile")) returned 0 [0260.190] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177\\temporaryfile")) returned 1 [0260.191] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.191] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.191] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.191] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.191] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.192] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.192] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.192] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177\\temporaryfile")) returned 1 [0260.192] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0053660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0053660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0053660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.192] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.192] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329177" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329177")) returned 1 [0260.192] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF") returned 0 [0260.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.193] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xc30, lpOverlapped=0x0) returned 1 [0260.194] CloseHandle (hObject=0xdc) returned 1 [0260.194] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.195] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd70 [0260.195] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd78) returned 0x2450048 [0260.195] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xd70, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xd70, lpOverlapped=0x0) returned 1 [0260.197] CloseHandle (hObject=0xdc) returned 1 [0260.197] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf")) returned 1 [0260.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.198] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.198] GetTickCount () returned 0x505e9 [0260.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.198] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193\\....\\temporaryfile")) returned 0 [0260.199] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193\\temporaryfile")) returned 1 [0260.200] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.200] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.200] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.200] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.200] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.200] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.200] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.200] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193\\temporaryfile")) returned 1 [0260.201] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.201] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.201] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193")) returned 1 [0260.201] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF") returned 0 [0260.201] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.202] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xd78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xd78, lpOverlapped=0x0) returned 1 [0260.203] CloseHandle (hObject=0xdc) returned 1 [0260.203] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.203] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd3c [0260.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd44) returned 0x2450048 [0260.204] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xd3c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xd3c, lpOverlapped=0x0) returned 1 [0260.205] CloseHandle (hObject=0xdc) returned 1 [0260.205] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf")) returned 1 [0260.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.206] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.206] GetTickCount () returned 0x505e9 [0260.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.206] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193\\....\\temporaryfile")) returned 0 [0260.207] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193\\temporaryfile")) returned 1 [0260.208] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.209] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.209] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.209] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.209] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.209] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.209] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.209] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193\\temporaryfile")) returned 1 [0260.209] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00797c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00797c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00797c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.209] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.209] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329193" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329193")) returned 1 [0260.209] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF") returned 0 [0260.210] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.210] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xd40, lpOverlapped=0x0) returned 1 [0260.211] CloseHandle (hObject=0xdc) returned 1 [0260.211] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.220] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1750 [0260.220] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1758) returned 0x2c4a70 [0260.220] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1750, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1750, lpOverlapped=0x0) returned 1 [0260.222] CloseHandle (hObject=0xdc) returned 1 [0260.222] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0260.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.223] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.223] GetTickCount () returned 0x505f8 [0260.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.223] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.223] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329208\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329208\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.224] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329208\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329208\\....\\temporaryfile")) returned 0 [0260.224] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329208\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329208\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329208\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329208\\temporaryfile")) returned 1 [0260.225] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329208\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa009f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa009f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa009f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.226] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa009f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa009f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa009f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.226] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa009f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa009f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa009f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.226] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329208\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa009f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa009f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa009f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.226] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa009f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa009f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa009f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.226] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa009f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa009f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa009f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.226] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.226] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329208\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329208\\temporaryfile")) returned 1 [0260.226] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa009f920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa009f920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa009f920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.226] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.226] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329208" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329208")) returned 1 [0260.226] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 0 [0260.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.228] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1758, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1758, lpOverlapped=0x0) returned 1 [0260.228] CloseHandle (hObject=0xdc) returned 1 [0260.229] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.230] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1540 [0260.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1548) returned 0x29b460 [0260.230] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1540, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1540, lpOverlapped=0x0) returned 1 [0260.231] CloseHandle (hObject=0xdc) returned 1 [0260.231] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0260.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.232] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.232] GetTickCount () returned 0x50608 [0260.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.238] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329224\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329224\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329224\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329224\\....\\temporaryfile")) returned 0 [0260.238] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329224\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329224\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329224\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329224\\temporaryfile")) returned 1 [0260.240] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329224\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00c5a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00c5a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00c5a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.240] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00c5a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00c5a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00c5a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.240] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00c5a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00c5a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00c5a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.240] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329224\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00c5a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00c5a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00c5a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.240] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00c5a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00c5a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00c5a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.240] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00c5a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00c5a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00c5a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.240] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.240] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329224\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329224\\temporaryfile")) returned 1 [0260.240] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00c5a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00c5a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00c5a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.240] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.240] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329224" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329224")) returned 1 [0260.240] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 0 [0260.241] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.241] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1548, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1548, lpOverlapped=0x0) returned 1 [0260.243] CloseHandle (hObject=0xdc) returned 1 [0260.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.244] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x19f4 [0260.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19fc) returned 0x2c4a70 [0260.244] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x19f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x19f4, lpOverlapped=0x0) returned 1 [0260.245] CloseHandle (hObject=0xdc) returned 1 [0260.245] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0260.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.246] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.246] GetTickCount () returned 0x50618 [0260.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.247] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240\\....\\temporaryfile")) returned 0 [0260.247] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240\\temporaryfile")) returned 1 [0260.249] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.249] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.249] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.249] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.249] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240\\temporaryfile")) returned 1 [0260.249] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.250] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.250] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240")) returned 1 [0260.250] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 0 [0260.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.251] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x19f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x19f8, lpOverlapped=0x0) returned 1 [0260.252] CloseHandle (hObject=0xdc) returned 1 [0260.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.252] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a6b [0260.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a73) returned 0x2c4a70 [0260.252] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1a6b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a6b, lpOverlapped=0x0) returned 1 [0260.254] CloseHandle (hObject=0xdc) returned 1 [0260.254] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0260.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.255] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.255] GetTickCount () returned 0x50618 [0260.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.255] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.255] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240\\....\\temporaryfile")) returned 0 [0260.256] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240\\temporaryfile")) returned 1 [0260.257] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.258] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.258] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.258] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.258] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.258] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.258] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.258] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240\\temporaryfile")) returned 1 [0260.258] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa00ebbe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa00ebbe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa00ebbe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.258] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.258] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329240" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329240")) returned 1 [0260.259] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 0 [0260.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.259] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1a70, lpOverlapped=0x0) returned 1 [0260.260] CloseHandle (hObject=0xdc) returned 1 [0260.261] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.261] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x195b [0260.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1963) returned 0x2c4a70 [0260.261] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x195b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x195b, lpOverlapped=0x0) returned 1 [0260.262] CloseHandle (hObject=0xdc) returned 1 [0260.263] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0260.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.263] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.264] GetTickCount () returned 0x50627 [0260.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.264] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255\\....\\temporaryfile")) returned 0 [0260.265] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255\\temporaryfile")) returned 1 [0260.266] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.266] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.267] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.267] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.267] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.267] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255\\temporaryfile")) returned 1 [0260.267] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.267] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.267] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255")) returned 1 [0260.267] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 0 [0260.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.268] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1960, lpOverlapped=0x0) returned 1 [0260.269] CloseHandle (hObject=0xdc) returned 1 [0260.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.270] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1652 [0260.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x165a) returned 0x2c4a70 [0260.270] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1652, lpOverlapped=0x0) returned 1 [0260.271] CloseHandle (hObject=0xdc) returned 1 [0260.271] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0260.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.272] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.272] GetTickCount () returned 0x50627 [0260.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.273] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.273] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255\\....\\temporaryfile")) returned 0 [0260.273] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255\\temporaryfile")) returned 1 [0260.275] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0137ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0137ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.275] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0137ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0137ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.275] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.275] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.275] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.275] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.275] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.275] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255\\temporaryfile")) returned 1 [0260.275] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0111d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0111d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0111d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.275] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.276] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329255" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329255")) returned 1 [0260.276] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 0 [0260.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.277] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1658, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1658, lpOverlapped=0x0) returned 1 [0260.278] CloseHandle (hObject=0xdc) returned 1 [0260.278] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.278] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x215a [0260.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2162) returned 0x2c8700 [0260.278] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x215a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x215a, lpOverlapped=0x0) returned 1 [0260.280] CloseHandle (hObject=0xdc) returned 1 [0260.280] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0260.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.281] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.281] GetTickCount () returned 0x50637 [0260.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.281] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329271\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329271\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329271\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329271\\....\\temporaryfile")) returned 0 [0260.282] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329271\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329271\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329271\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329271\\temporaryfile")) returned 1 [0260.283] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329271\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0137ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0137ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0137ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0137ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0137ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0137ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.284] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0137ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0137ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0137ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.284] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329271\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0137ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0137ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0137ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.284] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0137ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0137ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0137ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.284] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0137ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0137ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0137ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.284] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.284] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329271\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329271\\temporaryfile")) returned 1 [0260.284] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0137ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0137ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0137ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.284] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.284] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329271" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329271")) returned 1 [0260.284] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 0 [0260.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.285] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca878*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca878*, lpNumberOfBytesWritten=0x18fdd8*=0x2160, lpOverlapped=0x0) returned 1 [0260.286] CloseHandle (hObject=0xdc) returned 1 [0260.286] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.288] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17b6 [0260.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17be) returned 0x2c4a70 [0260.288] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x17b6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x17b6, lpOverlapped=0x0) returned 1 [0260.290] CloseHandle (hObject=0xdc) returned 1 [0260.290] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0260.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.291] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.291] GetTickCount () returned 0x50646 [0260.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.291] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.291] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286\\....\\temporaryfile")) returned 0 [0260.292] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286\\temporaryfile")) returned 1 [0260.293] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.293] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.294] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.294] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.294] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.294] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286\\temporaryfile")) returned 1 [0260.294] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.294] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.294] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286")) returned 1 [0260.294] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 0 [0260.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.295] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x17c0, lpOverlapped=0x0) returned 1 [0260.296] CloseHandle (hObject=0xdc) returned 1 [0260.296] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.297] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1784 [0260.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x178c) returned 0x2c4a70 [0260.297] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1784, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1784, lpOverlapped=0x0) returned 1 [0260.301] CloseHandle (hObject=0xdc) returned 1 [0260.301] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0260.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.302] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.302] GetTickCount () returned 0x50646 [0260.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.302] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.303] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.303] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286\\....\\temporaryfile")) returned 0 [0260.303] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286\\temporaryfile")) returned 1 [0260.305] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.305] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.305] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.305] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.305] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.305] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.305] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.305] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286\\temporaryfile")) returned 1 [0260.306] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa015e000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa015e000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa015e000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.306] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.306] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329286" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329286")) returned 1 [0260.306] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 0 [0260.306] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.307] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1788, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1788, lpOverlapped=0x0) returned 1 [0260.308] CloseHandle (hObject=0xdc) returned 1 [0260.308] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.308] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e58 [0260.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e60) returned 0x2c8700 [0260.308] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1e58, lpOverlapped=0x0) returned 1 [0260.310] CloseHandle (hObject=0xdc) returned 1 [0260.310] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0260.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.311] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.311] GetTickCount () returned 0x50656 [0260.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.312] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329302\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329302\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329302\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329302\\....\\temporaryfile")) returned 0 [0260.312] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329302\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329302\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329302\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329302\\temporaryfile")) returned 1 [0260.314] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329302\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0184160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0184160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0184160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.314] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0184160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0184160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0184160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.314] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0184160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0184160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0184160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.314] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329302\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0184160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0184160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0184160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.314] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0184160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0184160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0184160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.314] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0184160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0184160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0184160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.314] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.314] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329302\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329302\\temporaryfile")) returned 1 [0260.314] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0184160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0184160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0184160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.314] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.314] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329302" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329302")) returned 1 [0260.314] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 0 [0260.315] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.315] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca570*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca570*, lpNumberOfBytesWritten=0x18fdd8*=0x1e60, lpOverlapped=0x0) returned 1 [0260.317] CloseHandle (hObject=0xdc) returned 1 [0260.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.318] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x19a4 [0260.318] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19ac) returned 0x2c4a70 [0260.318] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x19a4, lpOverlapped=0x0) returned 1 [0260.319] CloseHandle (hObject=0xdc) returned 1 [0260.319] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0260.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.320] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.321] GetTickCount () returned 0x50666 [0260.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.321] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.321] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318\\....\\temporaryfile")) returned 0 [0260.322] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318\\temporaryfile")) returned 1 [0260.323] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.323] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.323] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.323] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.323] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.323] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.323] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.323] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318\\temporaryfile")) returned 1 [0260.324] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.324] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.324] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318")) returned 1 [0260.324] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 0 [0260.324] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.325] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x19a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x19a8, lpOverlapped=0x0) returned 1 [0260.326] CloseHandle (hObject=0xdc) returned 1 [0260.326] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.327] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1cb3 [0260.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1cbb) returned 0x2c8700 [0260.327] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1cb3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1cb3, lpOverlapped=0x0) returned 1 [0260.328] CloseHandle (hObject=0xdc) returned 1 [0260.328] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0260.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.329] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.329] GetTickCount () returned 0x50666 [0260.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.329] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.330] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318\\....\\temporaryfile")) returned 0 [0260.330] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318\\temporaryfile")) returned 1 [0260.332] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.332] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.332] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.332] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.332] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.332] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.332] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.332] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318\\temporaryfile")) returned 1 [0260.332] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01aa2c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01aa2c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01aa2c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.332] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.332] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329318" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329318")) returned 1 [0260.333] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 0 [0260.333] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.334] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca3d0*, nNumberOfBytesToWrite=0x1cb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca3d0*, lpNumberOfBytesWritten=0x18fdd8*=0x1cb8, lpOverlapped=0x0) returned 1 [0260.335] CloseHandle (hObject=0xdc) returned 1 [0260.335] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.335] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a6c [0260.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a74) returned 0x2c4a70 [0260.335] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1a6c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a6c, lpOverlapped=0x0) returned 1 [0260.337] CloseHandle (hObject=0xdc) returned 1 [0260.337] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0260.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.338] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.338] GetTickCount () returned 0x50675 [0260.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.338] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.338] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333\\....\\temporaryfile")) returned 0 [0260.339] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333\\temporaryfile")) returned 1 [0260.340] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.340] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.340] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.340] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.341] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.341] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.341] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.341] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333\\temporaryfile")) returned 1 [0260.341] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.341] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.341] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333")) returned 1 [0260.341] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 0 [0260.341] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.342] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1a70, lpOverlapped=0x0) returned 1 [0260.343] CloseHandle (hObject=0xdc) returned 1 [0260.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.344] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1511 [0260.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1519) returned 0x29b460 [0260.344] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1511, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1511, lpOverlapped=0x0) returned 1 [0260.345] CloseHandle (hObject=0xdc) returned 1 [0260.345] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0260.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.346] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.346] GetTickCount () returned 0x50675 [0260.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.346] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.347] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333\\....\\temporaryfile")) returned 0 [0260.347] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333\\temporaryfile")) returned 1 [0260.349] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.349] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.349] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.349] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.349] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.349] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.349] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.349] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333\\temporaryfile")) returned 1 [0260.349] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01d0420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01d0420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01d0420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.349] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.350] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329333" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329333")) returned 1 [0260.350] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 0 [0260.350] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.351] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1518, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1518, lpOverlapped=0x0) returned 1 [0260.352] CloseHandle (hObject=0xdc) returned 1 [0260.352] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.353] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6140 [0260.353] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6148) returned 0x2c8700 [0260.353] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6140, lpOverlapped=0x0) returned 1 [0260.354] CloseHandle (hObject=0xdc) returned 1 [0260.354] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf")) returned 1 [0260.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.355] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.355] GetTickCount () returned 0x50685 [0260.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.356] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329349\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329349\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329349\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329349\\....\\temporaryfile")) returned 0 [0260.357] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329349\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329349\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329349\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329349\\temporaryfile")) returned 1 [0260.358] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329349\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01f6580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01f6580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01f6580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.358] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01f6580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01f6580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01f6580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.358] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01f6580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01f6580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01f6580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.358] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329349\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01f6580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01f6580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01f6580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.358] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01f6580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01f6580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01f6580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.358] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01f6580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01f6580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01f6580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.358] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.359] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329349\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329349\\temporaryfile")) returned 1 [0260.359] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa01f6580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa01f6580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa01f6580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.359] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.359] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329349" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329349")) returned 1 [0260.359] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF") returned 0 [0260.360] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.360] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce858*, nNumberOfBytesToWrite=0x6148, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce858*, lpNumberOfBytesWritten=0x18fdd8*=0x6148, lpOverlapped=0x0) returned 1 [0260.361] CloseHandle (hObject=0xdc) returned 1 [0260.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.362] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x411a [0260.362] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4122) returned 0x2c8700 [0260.362] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x411a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x411a, lpOverlapped=0x0) returned 1 [0260.366] CloseHandle (hObject=0xdc) returned 1 [0260.367] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf")) returned 1 [0260.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.368] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.368] GetTickCount () returned 0x50694 [0260.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.369] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.369] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329364\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329364\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329364\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329364\\....\\temporaryfile")) returned 0 [0260.369] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329364\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329364\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329364\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329364\\temporaryfile")) returned 1 [0260.375] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329364\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa021c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa021c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa021c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.375] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa021c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa021c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa021c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.375] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa021c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa021c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa021c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.375] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329364\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa021c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa021c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa021c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.376] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa021c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa021c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa021c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.376] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa021c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa021c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa021c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.376] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.376] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329364\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329364\\temporaryfile")) returned 1 [0260.376] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa021c6e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa021c6e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa021c6e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.376] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.376] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329364" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329364")) returned 1 [0260.376] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF") returned 0 [0260.377] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.377] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc838*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc838*, lpNumberOfBytesWritten=0x18fdd8*=0x4120, lpOverlapped=0x0) returned 1 [0260.378] CloseHandle (hObject=0xdc) returned 1 [0260.379] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.380] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d5c [0260.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3d64) returned 0x2c8700 [0260.380] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3d5c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3d5c, lpOverlapped=0x0) returned 1 [0260.381] CloseHandle (hObject=0xdc) returned 1 [0260.382] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf")) returned 1 [0260.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.383] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.383] GetTickCount () returned 0x506a4 [0260.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.383] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380\\....\\temporaryfile")) returned 0 [0260.384] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380\\temporaryfile")) returned 1 [0260.385] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.385] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.385] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.385] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.385] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.386] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.386] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.386] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380\\temporaryfile")) returned 1 [0260.386] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.386] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.386] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380")) returned 1 [0260.386] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF") returned 0 [0260.387] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.387] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc478*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc478*, lpNumberOfBytesWritten=0x18fdd8*=0x3d60, lpOverlapped=0x0) returned 1 [0260.388] CloseHandle (hObject=0xdc) returned 1 [0260.389] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.389] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4040 [0260.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4048) returned 0x2c8700 [0260.389] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4040, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4040, lpOverlapped=0x0) returned 1 [0260.391] CloseHandle (hObject=0xdc) returned 1 [0260.391] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf")) returned 1 [0260.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.392] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.392] GetTickCount () returned 0x506a4 [0260.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.392] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380\\....\\temporaryfile")) returned 0 [0260.393] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380\\temporaryfile")) returned 1 [0260.395] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.395] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.395] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.395] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.395] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.395] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380\\temporaryfile")) returned 1 [0260.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0242840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0242840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0242840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.395] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.395] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329380" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329380")) returned 1 [0260.395] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF") returned 0 [0260.396] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.397] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc758*, nNumberOfBytesToWrite=0x4048, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc758*, lpNumberOfBytesWritten=0x18fdd8*=0x4048, lpOverlapped=0x0) returned 1 [0260.398] CloseHandle (hObject=0xdc) returned 1 [0260.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.398] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4d18 [0260.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4d20) returned 0x2c8700 [0260.398] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4d18, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4d18, lpOverlapped=0x0) returned 1 [0260.400] CloseHandle (hObject=0xdc) returned 1 [0260.400] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf")) returned 1 [0260.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.401] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.401] GetTickCount () returned 0x506b4 [0260.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.401] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.402] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396\\....\\temporaryfile")) returned 0 [0260.402] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396\\temporaryfile")) returned 1 [0260.404] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.404] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.404] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.404] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.404] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.404] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.404] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.404] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396\\temporaryfile")) returned 1 [0260.404] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.404] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.404] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396")) returned 1 [0260.404] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF") returned 0 [0260.405] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.406] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd430*, nNumberOfBytesToWrite=0x4d20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd430*, lpNumberOfBytesWritten=0x18fdd8*=0x4d20, lpOverlapped=0x0) returned 1 [0260.407] CloseHandle (hObject=0xdc) returned 1 [0260.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.407] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x47ec [0260.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x47f4) returned 0x2c8700 [0260.407] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x47ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x47ec, lpOverlapped=0x0) returned 1 [0260.409] CloseHandle (hObject=0xdc) returned 1 [0260.409] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf")) returned 1 [0260.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.410] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.410] GetTickCount () returned 0x506b4 [0260.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.411] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.411] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396\\....\\temporaryfile")) returned 0 [0260.411] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396\\temporaryfile")) returned 1 [0260.413] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.413] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.413] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.413] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.413] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.413] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396\\temporaryfile")) returned 1 [0260.413] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02689a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02689a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02689a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.413] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.414] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329396" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329396")) returned 1 [0260.414] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF") returned 0 [0260.414] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.415] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccf08*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccf08*, lpNumberOfBytesWritten=0x18fdd8*=0x47f0, lpOverlapped=0x0) returned 1 [0260.416] CloseHandle (hObject=0xdc) returned 1 [0260.416] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.417] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8b4 [0260.417] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8bc) returned 0x2450048 [0260.417] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x8b4, lpOverlapped=0x0) returned 1 [0260.418] CloseHandle (hObject=0xdc) returned 1 [0260.418] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf")) returned 1 [0260.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.419] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.419] GetTickCount () returned 0x506c3 [0260.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.420] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.420] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.420] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411\\....\\temporaryfile")) returned 0 [0260.420] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411\\temporaryfile")) returned 1 [0260.421] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.422] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.422] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.422] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.422] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.422] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.422] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.422] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411\\temporaryfile")) returned 1 [0260.422] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.422] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.422] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411")) returned 1 [0260.422] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF") returned 0 [0260.423] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.423] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x8b8, lpOverlapped=0x0) returned 1 [0260.424] CloseHandle (hObject=0xdc) returned 1 [0260.424] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.426] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaf4 [0260.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xafc) returned 0x2450048 [0260.426] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xaf4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xaf4, lpOverlapped=0x0) returned 1 [0260.428] CloseHandle (hObject=0xdc) returned 1 [0260.428] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf")) returned 1 [0260.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.429] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.429] GetTickCount () returned 0x506c3 [0260.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.430] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411\\....\\temporaryfile")) returned 0 [0260.430] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411\\temporaryfile")) returned 1 [0260.432] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.432] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.432] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.432] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.432] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.432] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.432] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.432] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411\\temporaryfile")) returned 1 [0260.432] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa028eb00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa028eb00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa028eb00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.432] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.432] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329411" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329411")) returned 1 [0260.433] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF") returned 0 [0260.433] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.434] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xaf8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xaf8, lpOverlapped=0x0) returned 1 [0260.435] CloseHandle (hObject=0xdc) returned 1 [0260.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.435] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5aa4 [0260.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5aac) returned 0x2c8700 [0260.435] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5aa4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5aa4, lpOverlapped=0x0) returned 1 [0260.437] CloseHandle (hObject=0xdc) returned 1 [0260.437] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf")) returned 1 [0260.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.438] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.438] GetTickCount () returned 0x506d3 [0260.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.438] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.439] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329427\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329427\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329427\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329427\\....\\temporaryfile")) returned 0 [0260.440] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329427\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329427\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329427\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329427\\temporaryfile")) returned 1 [0260.441] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329427\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02b4c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02b4c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02b4c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.441] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02b4c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02b4c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02b4c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.441] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02b4c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02b4c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02b4c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.441] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329427\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02b4c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02b4c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02b4c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.441] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02b4c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02b4c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02b4c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.441] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02b4c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02b4c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02b4c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.441] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.442] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329427\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329427\\temporaryfile")) returned 1 [0260.442] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02b4c60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02b4c60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02b4c60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.442] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.442] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329427" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329427")) returned 1 [0260.442] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF") returned 0 [0260.443] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.443] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce1c0*, nNumberOfBytesToWrite=0x5aa8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce1c0*, lpNumberOfBytesWritten=0x18fdd8*=0x5aa8, lpOverlapped=0x0) returned 1 [0260.444] CloseHandle (hObject=0xdc) returned 1 [0260.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.445] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1cf8 [0260.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d00) returned 0x2c8700 [0260.445] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1cf8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1cf8, lpOverlapped=0x0) returned 1 [0260.447] CloseHandle (hObject=0xdc) returned 1 [0260.447] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf")) returned 1 [0260.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.448] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.448] GetTickCount () returned 0x506e2 [0260.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.448] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.448] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442\\....\\temporaryfile")) returned 0 [0260.449] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442\\temporaryfile")) returned 1 [0260.450] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.450] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.450] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.450] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.450] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.450] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.450] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.450] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442\\temporaryfile")) returned 1 [0260.451] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.451] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.451] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442")) returned 1 [0260.451] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF") returned 0 [0260.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.452] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca410*, nNumberOfBytesToWrite=0x1d00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca410*, lpNumberOfBytesWritten=0x18fdd8*=0x1d00, lpOverlapped=0x0) returned 1 [0260.453] CloseHandle (hObject=0xdc) returned 1 [0260.453] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.454] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4124 [0260.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x412c) returned 0x2c8700 [0260.454] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4124, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4124, lpOverlapped=0x0) returned 1 [0260.455] CloseHandle (hObject=0xdc) returned 1 [0260.455] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf")) returned 1 [0260.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.456] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.457] GetTickCount () returned 0x506e2 [0260.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.457] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442\\....\\temporaryfile")) returned 0 [0260.458] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442\\temporaryfile")) returned 1 [0260.459] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.459] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.459] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.459] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.459] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.460] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.460] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.460] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442\\temporaryfile")) returned 1 [0260.460] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa02dadc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa02dadc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa02dadc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.460] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.460] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329442" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329442")) returned 1 [0260.460] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF") returned 0 [0260.461] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.461] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc840*, nNumberOfBytesToWrite=0x4128, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc840*, lpNumberOfBytesWritten=0x18fdd8*=0x4128, lpOverlapped=0x0) returned 1 [0260.463] CloseHandle (hObject=0xdc) returned 1 [0260.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.464] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1402c [0260.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x14034) returned 0x2c8700 [0260.464] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1402c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1402c, lpOverlapped=0x0) returned 1 [0260.466] CloseHandle (hObject=0xdc) returned 1 [0260.466] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf")) returned 1 [0260.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.468] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.468] GetTickCount () returned 0x506f2 [0260.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.468] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.468] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329458\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329458\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329458\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329458\\....\\temporaryfile")) returned 0 [0260.469] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329458\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329458\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329458\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329458\\temporaryfile")) returned 1 [0260.470] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329458\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0300f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0300f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0300f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.470] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0300f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0300f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0300f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.470] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0300f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0300f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0300f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.471] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329458\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0300f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0300f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0300f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.471] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0300f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0300f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0300f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.471] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0300f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0300f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0300f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.471] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.471] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329458\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329458\\temporaryfile")) returned 1 [0260.471] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0300f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0300f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0300f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.471] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.471] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329458" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329458")) returned 1 [0260.471] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF") returned 0 [0260.473] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.473] WriteFile (in: hFile=0xdc, lpBuffer=0x2dc748*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2dc748*, lpNumberOfBytesWritten=0x18fdd8*=0x14030, lpOverlapped=0x0) returned 1 [0260.475] CloseHandle (hObject=0xdc) returned 1 [0260.475] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.477] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ee4 [0260.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1eec) returned 0x2c8700 [0260.477] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1ee4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1ee4, lpOverlapped=0x0) returned 1 [0260.478] CloseHandle (hObject=0xdc) returned 1 [0260.478] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf")) returned 1 [0260.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.479] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.479] GetTickCount () returned 0x50702 [0260.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.480] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.480] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474\\....\\temporaryfile")) returned 0 [0260.480] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474\\temporaryfile")) returned 1 [0260.481] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.482] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.482] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.482] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.482] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.482] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.482] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.482] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474\\temporaryfile")) returned 1 [0260.482] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.482] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.482] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474")) returned 1 [0260.482] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF") returned 0 [0260.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.483] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca600*, nNumberOfBytesToWrite=0x1ee8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca600*, lpNumberOfBytesWritten=0x18fdd8*=0x1ee8, lpOverlapped=0x0) returned 1 [0260.484] CloseHandle (hObject=0xdc) returned 1 [0260.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.485] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8da8 [0260.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8db0) returned 0x2c8700 [0260.485] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8da8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8da8, lpOverlapped=0x0) returned 1 [0260.487] CloseHandle (hObject=0xdc) returned 1 [0260.487] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf")) returned 1 [0260.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.488] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.488] GetTickCount () returned 0x50702 [0260.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.489] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474\\....\\temporaryfile")) returned 0 [0260.489] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474\\temporaryfile")) returned 1 [0260.491] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.491] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.491] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.491] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.491] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.491] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.491] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.491] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474\\temporaryfile")) returned 1 [0260.491] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0327080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0327080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0327080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.491] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.491] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329474" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329474")) returned 1 [0260.492] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF") returned 0 [0260.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.493] WriteFile (in: hFile=0xdc, lpBuffer=0x2d14c0*, nNumberOfBytesToWrite=0x8db0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d14c0*, lpNumberOfBytesWritten=0x18fdd8*=0x8db0, lpOverlapped=0x0) returned 1 [0260.494] CloseHandle (hObject=0xdc) returned 1 [0260.494] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.495] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x140c [0260.495] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1414) returned 0x25b528 [0260.495] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x140c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x140c, lpOverlapped=0x0) returned 1 [0260.496] CloseHandle (hObject=0xdc) returned 1 [0260.496] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf")) returned 1 [0260.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.497] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.497] GetTickCount () returned 0x50711 [0260.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.498] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489\\....\\temporaryfile")) returned 0 [0260.499] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489\\temporaryfile")) returned 1 [0260.500] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.500] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.500] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.500] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.500] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.500] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.500] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.500] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489\\temporaryfile")) returned 1 [0260.501] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.501] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.501] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489")) returned 1 [0260.501] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF") returned 0 [0260.501] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.502] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1410, lpOverlapped=0x0) returned 1 [0260.503] CloseHandle (hObject=0xdc) returned 1 [0260.503] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.504] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x26b0 [0260.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x26b8) returned 0x2c8700 [0260.504] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x26b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x26b0, lpOverlapped=0x0) returned 1 [0260.505] CloseHandle (hObject=0xdc) returned 1 [0260.505] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf")) returned 1 [0260.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.506] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.506] GetTickCount () returned 0x50711 [0260.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.507] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489\\....\\temporaryfile")) returned 0 [0260.508] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489\\temporaryfile")) returned 1 [0260.509] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0373340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0373340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.509] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0373340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0373340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.509] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.509] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.509] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.509] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.509] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.509] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489\\temporaryfile")) returned 1 [0260.510] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa034d1e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa034d1e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa034d1e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.510] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.510] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329489" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329489")) returned 1 [0260.510] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF") returned 0 [0260.510] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.511] WriteFile (in: hFile=0xdc, lpBuffer=0x2cadc8*, nNumberOfBytesToWrite=0x26b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cadc8*, lpNumberOfBytesWritten=0x18fdd8*=0x26b8, lpOverlapped=0x0) returned 1 [0260.512] CloseHandle (hObject=0xdc) returned 1 [0260.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.513] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5670 [0260.513] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5678) returned 0x2c8700 [0260.513] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5670, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5670, lpOverlapped=0x0) returned 1 [0260.515] CloseHandle (hObject=0xdc) returned 1 [0260.515] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf")) returned 1 [0260.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.516] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.516] GetTickCount () returned 0x50721 [0260.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.521] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.521] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329505\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329505\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329505\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329505\\....\\temporaryfile")) returned 0 [0260.522] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329505\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329505\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329505\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329505\\temporaryfile")) returned 1 [0260.524] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329505\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0373340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0373340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0373340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.524] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0373340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0373340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0373340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.524] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0373340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0373340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0373340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.524] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329505\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0373340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0373340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0373340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.524] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0373340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0373340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0373340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.524] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0373340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0373340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0373340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.524] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.524] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329505\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329505\\temporaryfile")) returned 1 [0260.524] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0373340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0373340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0373340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.524] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.524] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329505" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329505")) returned 1 [0260.525] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF") returned 0 [0260.525] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.526] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdd88*, nNumberOfBytesToWrite=0x5678, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdd88*, lpNumberOfBytesWritten=0x18fdd8*=0x5678, lpOverlapped=0x0) returned 1 [0260.527] CloseHandle (hObject=0xdc) returned 1 [0260.527] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.528] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ae6 [0260.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1aee) returned 0x2c4a70 [0260.528] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1ae6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1ae6, lpOverlapped=0x0) returned 1 [0260.529] CloseHandle (hObject=0xdc) returned 1 [0260.530] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf")) returned 1 [0260.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.530] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.531] GetTickCount () returned 0x50730 [0260.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.531] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329520\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329520\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329520\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329520\\....\\temporaryfile")) returned 0 [0260.532] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329520\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329520\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329520\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329520\\temporaryfile")) returned 1 [0260.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329520\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03994a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03994a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03994a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03994a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03994a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03994a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03994a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03994a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03994a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329520\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03994a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03994a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03994a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.534] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03994a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03994a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03994a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.534] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03994a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03994a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03994a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.534] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329520\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329520\\temporaryfile")) returned 1 [0260.534] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03994a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03994a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03994a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.534] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329520" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329520")) returned 1 [0260.534] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF") returned 0 [0260.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.535] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1af0, lpOverlapped=0x0) returned 1 [0260.536] CloseHandle (hObject=0xdc) returned 1 [0260.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.538] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1928 [0260.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1930) returned 0x2c4a70 [0260.538] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1928, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1928, lpOverlapped=0x0) returned 1 [0260.539] CloseHandle (hObject=0xdc) returned 1 [0260.539] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf")) returned 1 [0260.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.540] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.540] GetTickCount () returned 0x50740 [0260.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.541] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536\\....\\temporaryfile")) returned 0 [0260.541] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536\\temporaryfile")) returned 1 [0260.543] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.543] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.543] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.543] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.543] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.543] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.543] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.543] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536\\temporaryfile")) returned 1 [0260.543] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.543] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.543] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536")) returned 1 [0260.544] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF") returned 0 [0260.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.545] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1930, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1930, lpOverlapped=0x0) returned 1 [0260.546] CloseHandle (hObject=0xdc) returned 1 [0260.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.546] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4cea [0260.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4cf2) returned 0x2c8700 [0260.546] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4cea, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4cea, lpOverlapped=0x0) returned 1 [0260.548] CloseHandle (hObject=0xdc) returned 1 [0260.548] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf")) returned 1 [0260.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.549] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.549] GetTickCount () returned 0x50740 [0260.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.549] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.549] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536\\....\\temporaryfile")) returned 0 [0260.550] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536\\temporaryfile")) returned 1 [0260.552] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.552] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.552] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.552] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.552] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.552] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536\\temporaryfile")) returned 1 [0260.552] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03bf600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03bf600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03bf600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.552] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.552] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329536" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329536")) returned 1 [0260.552] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF") returned 0 [0260.553] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.554] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd408*, nNumberOfBytesToWrite=0x4cf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd408*, lpNumberOfBytesWritten=0x18fdd8*=0x4cf0, lpOverlapped=0x0) returned 1 [0260.555] CloseHandle (hObject=0xdc) returned 1 [0260.555] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.556] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb12c [0260.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb134) returned 0x2c8700 [0260.556] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb12c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb12c, lpOverlapped=0x0) returned 1 [0260.558] CloseHandle (hObject=0xdc) returned 1 [0260.558] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf")) returned 1 [0260.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.559] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.559] GetTickCount () returned 0x50750 [0260.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.560] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.560] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552\\....\\temporaryfile")) returned 0 [0260.560] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552\\temporaryfile")) returned 1 [0260.562] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.562] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.562] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.562] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.562] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.562] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552\\temporaryfile")) returned 1 [0260.562] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.562] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.562] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552")) returned 1 [0260.562] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF") returned 0 [0260.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.564] WriteFile (in: hFile=0xdc, lpBuffer=0x2d3848*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d3848*, lpNumberOfBytesWritten=0x18fdd8*=0xb130, lpOverlapped=0x0) returned 1 [0260.565] CloseHandle (hObject=0xdc) returned 1 [0260.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.566] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6028 [0260.566] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6030) returned 0x2c8700 [0260.566] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6028, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6028, lpOverlapped=0x0) returned 1 [0260.568] CloseHandle (hObject=0xdc) returned 1 [0260.568] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf")) returned 1 [0260.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.569] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.569] GetTickCount () returned 0x50750 [0260.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.569] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.570] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552\\....\\temporaryfile")) returned 0 [0260.570] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552\\temporaryfile")) returned 1 [0260.572] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa040b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa040b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.572] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa040b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa040b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.572] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.572] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.572] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.572] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.572] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.572] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552\\temporaryfile")) returned 1 [0260.572] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa03e5760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa03e5760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa03e5760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.572] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.572] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329552" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329552")) returned 1 [0260.573] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF") returned 0 [0260.573] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.574] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce740*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce740*, lpNumberOfBytesWritten=0x18fdd8*=0x6030, lpOverlapped=0x0) returned 1 [0260.575] CloseHandle (hObject=0xdc) returned 1 [0260.575] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.576] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x108a [0260.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1092) returned 0x25b528 [0260.576] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x108a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x108a, lpOverlapped=0x0) returned 1 [0260.578] CloseHandle (hObject=0xdc) returned 1 [0260.578] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf")) returned 1 [0260.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.579] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.579] GetTickCount () returned 0x5075f [0260.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.579] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329567\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329567\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.580] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329567\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329567\\....\\temporaryfile")) returned 0 [0260.580] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329567\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329567\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329567\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329567\\temporaryfile")) returned 1 [0260.582] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329567\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa040b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa040b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa040b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.582] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa040b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa040b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa040b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.582] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa040b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa040b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa040b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.582] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329567\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa040b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa040b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa040b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.582] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa040b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa040b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa040b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.582] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa040b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa040b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa040b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.582] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.582] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329567\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329567\\temporaryfile")) returned 1 [0260.582] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa040b8c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa040b8c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa040b8c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.582] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.582] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329567" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329567")) returned 1 [0260.582] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF") returned 0 [0260.583] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.583] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1090, lpOverlapped=0x0) returned 1 [0260.584] CloseHandle (hObject=0xdc) returned 1 [0260.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.585] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x112e [0260.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1136) returned 0x25b528 [0260.585] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x112e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x112e, lpOverlapped=0x0) returned 1 [0260.587] CloseHandle (hObject=0xdc) returned 1 [0260.587] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf")) returned 1 [0260.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.588] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.588] GetTickCount () returned 0x5076f [0260.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.588] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583\\....\\temporaryfile")) returned 0 [0260.589] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583\\temporaryfile")) returned 1 [0260.590] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.590] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.590] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.590] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.591] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.591] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.591] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.591] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583\\temporaryfile")) returned 1 [0260.591] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.591] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.591] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583")) returned 1 [0260.591] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF") returned 0 [0260.591] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.592] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1138, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1138, lpOverlapped=0x0) returned 1 [0260.593] CloseHandle (hObject=0xdc) returned 1 [0260.593] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.594] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1138 [0260.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1140) returned 0x25b528 [0260.594] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1138, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1138, lpOverlapped=0x0) returned 1 [0260.595] CloseHandle (hObject=0xdc) returned 1 [0260.595] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf")) returned 1 [0260.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.596] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.596] GetTickCount () returned 0x5076f [0260.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.597] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583\\....\\temporaryfile")) returned 0 [0260.597] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583\\temporaryfile")) returned 1 [0260.599] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.599] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.599] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.599] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.599] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.599] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.599] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.599] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583\\temporaryfile")) returned 1 [0260.599] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0431a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0431a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0431a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.599] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.600] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329583" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329583")) returned 1 [0260.600] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF") returned 0 [0260.600] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.601] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1140, lpOverlapped=0x0) returned 1 [0260.602] CloseHandle (hObject=0xdc) returned 1 [0260.602] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.602] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3926 [0260.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x392e) returned 0x2c8700 [0260.602] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3926, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3926, lpOverlapped=0x0) returned 1 [0260.604] CloseHandle (hObject=0xdc) returned 1 [0260.604] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf")) returned 1 [0260.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.605] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.605] GetTickCount () returned 0x5077e [0260.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.606] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.606] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598\\....\\temporaryfile")) returned 0 [0260.606] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598\\temporaryfile")) returned 1 [0260.608] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.608] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.608] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.608] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.608] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.608] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.608] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.608] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598\\temporaryfile")) returned 1 [0260.608] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.608] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.608] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598")) returned 1 [0260.609] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF") returned 0 [0260.609] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.610] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc040*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc040*, lpNumberOfBytesWritten=0x18fdd8*=0x3930, lpOverlapped=0x0) returned 1 [0260.611] CloseHandle (hObject=0xdc) returned 1 [0260.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.612] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1afc [0260.612] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b04) returned 0x2c4a70 [0260.612] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1afc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1afc, lpOverlapped=0x0) returned 1 [0260.613] CloseHandle (hObject=0xdc) returned 1 [0260.613] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf")) returned 1 [0260.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.614] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.614] GetTickCount () returned 0x5077e [0260.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.614] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.615] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.615] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598\\....\\temporaryfile")) returned 0 [0260.616] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598\\temporaryfile")) returned 1 [0260.711] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.711] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.711] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.711] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.711] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.711] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.711] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.712] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598\\temporaryfile")) returned 1 [0260.712] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0457b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0457b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0457b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.712] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.712] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329598" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329598")) returned 1 [0260.712] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF") returned 0 [0260.712] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.714] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b00, lpOverlapped=0x0) returned 1 [0260.715] CloseHandle (hObject=0xdc) returned 1 [0260.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.716] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb1a4 [0260.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb1ac) returned 0x2c8700 [0260.716] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb1a4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb1a4, lpOverlapped=0x0) returned 1 [0260.718] CloseHandle (hObject=0xdc) returned 1 [0260.718] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf")) returned 1 [0260.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.719] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.719] GetTickCount () returned 0x507ec [0260.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.720] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329708\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329708\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329708\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329708\\....\\temporaryfile")) returned 0 [0260.720] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329708\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329708\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329708\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329708\\temporaryfile")) returned 1 [0260.722] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329708\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0562520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0562520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0562520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.722] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0562520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0562520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0562520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.722] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0562520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0562520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0562520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.722] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329708\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0562520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0562520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0562520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.722] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0562520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0562520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0562520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.722] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0562520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0562520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0562520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.722] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.722] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329708\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329708\\temporaryfile")) returned 1 [0260.722] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0562520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0562520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0562520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.723] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329708" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329708")) returned 1 [0260.723] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF") returned 0 [0260.724] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.724] WriteFile (in: hFile=0xdc, lpBuffer=0x2d38c0*, nNumberOfBytesToWrite=0xb1a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d38c0*, lpNumberOfBytesWritten=0x18fdd8*=0xb1a8, lpOverlapped=0x0) returned 1 [0260.736] CloseHandle (hObject=0xdc) returned 1 [0260.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.738] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9e2c [0260.738] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9e34) returned 0x2c8700 [0260.738] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x9e2c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x9e2c, lpOverlapped=0x0) returned 1 [0260.740] CloseHandle (hObject=0xdc) returned 1 [0260.740] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf")) returned 1 [0260.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.741] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.741] GetTickCount () returned 0x507fb [0260.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.742] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329723\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329723\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329723\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329723\\....\\temporaryfile")) returned 0 [0260.742] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329723\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329723\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329723\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329723\\temporaryfile")) returned 1 [0260.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329723\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0588680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.744] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0588680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.744] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329723\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.744] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.744] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.744] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.744] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329723\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329723\\temporaryfile")) returned 1 [0260.744] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.745] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329723" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329723")) returned 1 [0260.745] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF") returned 0 [0260.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.746] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2548*, nNumberOfBytesToWrite=0x9e30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2548*, lpNumberOfBytesWritten=0x18fdd8*=0x9e30, lpOverlapped=0x0) returned 1 [0260.748] CloseHandle (hObject=0xdc) returned 1 [0260.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.748] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ca0 [0260.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ca8) returned 0x2c8700 [0260.748] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1ca0, lpOverlapped=0x0) returned 1 [0260.750] CloseHandle (hObject=0xdc) returned 1 [0260.750] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf")) returned 1 [0260.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.751] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.751] GetTickCount () returned 0x5080b [0260.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.751] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329739\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329739\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329739\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329739\\....\\temporaryfile")) returned 0 [0260.752] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329739\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329739\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329739\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329739\\temporaryfile")) returned 1 [0260.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329739\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.756] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.756] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329739\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.757] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.757] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.757] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329739\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329739\\temporaryfile")) returned 1 [0260.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05ae7e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05ae7e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05ae7e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.757] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329739" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329739")) returned 1 [0260.757] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF") returned 0 [0260.758] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.758] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca3b8*, nNumberOfBytesToWrite=0x1ca8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca3b8*, lpNumberOfBytesWritten=0x18fdd8*=0x1ca8, lpOverlapped=0x0) returned 1 [0260.759] CloseHandle (hObject=0xdc) returned 1 [0260.760] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.761] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1908 [0260.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1910) returned 0x2c4a70 [0260.761] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1908, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1908, lpOverlapped=0x0) returned 1 [0260.762] CloseHandle (hObject=0xdc) returned 1 [0260.762] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf")) returned 1 [0260.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.768] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.768] GetTickCount () returned 0x5081a [0260.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.768] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329754\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329754\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329754\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329754\\....\\temporaryfile")) returned 0 [0260.769] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329754\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329754\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329754\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329754\\temporaryfile")) returned 1 [0260.770] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329754\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05d4940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05d4940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05d4940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.770] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05d4940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05d4940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05d4940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05d4940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05d4940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05d4940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.771] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329754\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05d4940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05d4940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05d4940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.771] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05d4940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05d4940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05d4940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.771] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05d4940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05d4940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05d4940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.771] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.771] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329754\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329754\\temporaryfile")) returned 1 [0260.771] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05d4940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05d4940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05d4940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.771] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.771] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329754" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329754")) returned 1 [0260.771] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF") returned 0 [0260.772] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.772] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1910, lpOverlapped=0x0) returned 1 [0260.773] CloseHandle (hObject=0xdc) returned 1 [0260.774] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.774] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3100 [0260.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3108) returned 0x2c8700 [0260.774] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3100, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3100, lpOverlapped=0x0) returned 1 [0260.776] CloseHandle (hObject=0xdc) returned 1 [0260.776] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf")) returned 1 [0260.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.777] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.777] GetTickCount () returned 0x5082a [0260.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.777] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770\\....\\temporaryfile")) returned 0 [0260.778] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770\\temporaryfile")) returned 1 [0260.779] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.779] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.779] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.779] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.779] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.780] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.780] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.780] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770\\temporaryfile")) returned 1 [0260.780] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.780] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.780] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770")) returned 1 [0260.780] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF") returned 0 [0260.780] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.781] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb818*, nNumberOfBytesToWrite=0x3108, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb818*, lpNumberOfBytesWritten=0x18fdd8*=0x3108, lpOverlapped=0x0) returned 1 [0260.782] CloseHandle (hObject=0xdc) returned 1 [0260.782] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.783] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2904 [0260.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x290c) returned 0x2c8700 [0260.783] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2904, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2904, lpOverlapped=0x0) returned 1 [0260.784] CloseHandle (hObject=0xdc) returned 1 [0260.784] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf")) returned 1 [0260.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.785] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.786] GetTickCount () returned 0x5082a [0260.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.786] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.787] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770\\....\\temporaryfile")) returned 0 [0260.787] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770\\temporaryfile")) returned 1 [0260.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.788] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.789] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.789] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770\\temporaryfile")) returned 1 [0260.789] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa05faaa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa05faaa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa05faaa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.789] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329770" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329770")) returned 1 [0260.789] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF") returned 0 [0260.789] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.790] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb020*, nNumberOfBytesToWrite=0x2908, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb020*, lpNumberOfBytesWritten=0x18fdd8*=0x2908, lpOverlapped=0x0) returned 1 [0260.791] CloseHandle (hObject=0xdc) returned 1 [0260.792] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.792] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x984 [0260.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x98c) returned 0x2450048 [0260.792] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x984, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x984, lpOverlapped=0x0) returned 1 [0260.794] CloseHandle (hObject=0xdc) returned 1 [0260.794] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf")) returned 1 [0260.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.795] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.795] GetTickCount () returned 0x5083a [0260.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.795] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.796] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786\\....\\temporaryfile")) returned 0 [0260.796] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786\\temporaryfile")) returned 1 [0260.797] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.797] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.797] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.797] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.797] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.798] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.798] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786\\temporaryfile")) returned 1 [0260.798] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.798] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786")) returned 1 [0260.798] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF") returned 0 [0260.798] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.799] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x988, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x988, lpOverlapped=0x0) returned 1 [0260.800] CloseHandle (hObject=0xdc) returned 1 [0260.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.800] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x59c [0260.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5a4) returned 0x259e70 [0260.801] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x59c, lpOverlapped=0x0) returned 1 [0260.802] CloseHandle (hObject=0xdc) returned 1 [0260.802] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf")) returned 1 [0260.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.803] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.803] GetTickCount () returned 0x5083a [0260.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.803] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.804] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786\\....\\temporaryfile")) returned 0 [0260.804] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786\\temporaryfile")) returned 1 [0260.806] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0646d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0646d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.806] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0646d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0646d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.806] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.806] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.806] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.806] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.806] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.806] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786\\temporaryfile")) returned 1 [0260.806] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0620c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0620c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0620c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.806] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.806] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329786" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329786")) returned 1 [0260.806] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF") returned 0 [0260.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.807] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x5a0, lpOverlapped=0x0) returned 1 [0260.808] CloseHandle (hObject=0xdc) returned 1 [0260.808] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.809] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3f9c [0260.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3fa4) returned 0x2c8700 [0260.809] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3f9c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3f9c, lpOverlapped=0x0) returned 1 [0260.811] CloseHandle (hObject=0xdc) returned 1 [0260.811] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf")) returned 1 [0260.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.812] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.812] GetTickCount () returned 0x50849 [0260.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.812] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.813] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.813] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329801\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.813] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329801\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329801\\....\\temporaryfile")) returned 0 [0260.813] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329801\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329801\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329801\\temporaryfile")) returned 1 [0260.814] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329801\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0646d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0646d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0646d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.815] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0646d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0646d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0646d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.815] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0646d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0646d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0646d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.815] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329801\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0646d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0646d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0646d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.815] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0646d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0646d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0646d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.815] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0646d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0646d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0646d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.815] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.815] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329801\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329801\\temporaryfile")) returned 1 [0260.815] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0646d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0646d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0646d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.815] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.815] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329801" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329801")) returned 1 [0260.815] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF") returned 0 [0260.816] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.816] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc6b8*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc6b8*, lpNumberOfBytesWritten=0x18fdd8*=0x3fa0, lpOverlapped=0x0) returned 1 [0260.817] CloseHandle (hObject=0xdc) returned 1 [0260.818] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.818] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1418 [0260.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1420) returned 0x25b528 [0260.818] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1418, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1418, lpOverlapped=0x0) returned 1 [0260.822] CloseHandle (hObject=0xdc) returned 1 [0260.822] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf")) returned 1 [0260.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.823] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.823] GetTickCount () returned 0x50859 [0260.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.823] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.823] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.824] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817\\....\\temporaryfile")) returned 0 [0260.824] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817\\temporaryfile")) returned 1 [0260.825] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.825] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.825] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.825] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.825] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.826] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.826] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.826] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817\\temporaryfile")) returned 1 [0260.826] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.826] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.826] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817")) returned 1 [0260.826] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF") returned 0 [0260.826] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.827] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1420, lpOverlapped=0x0) returned 1 [0260.829] CloseHandle (hObject=0xdc) returned 1 [0260.829] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.829] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdda [0260.829] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xde2) returned 0x2450048 [0260.829] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xdda, lpOverlapped=0x0) returned 1 [0260.831] CloseHandle (hObject=0xdc) returned 1 [0260.831] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf")) returned 1 [0260.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.832] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.832] GetTickCount () returned 0x50859 [0260.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.832] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.833] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817\\....\\temporaryfile")) returned 0 [0260.833] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817\\temporaryfile")) returned 1 [0260.834] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.834] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.835] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.835] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.835] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.835] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817\\temporaryfile")) returned 1 [0260.835] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa066cec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa066cec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa066cec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.835] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.835] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329817" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329817")) returned 1 [0260.835] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF") returned 0 [0260.836] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.836] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xde0, lpOverlapped=0x0) returned 1 [0260.837] CloseHandle (hObject=0xdc) returned 1 [0260.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.838] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x23d4 [0260.838] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23dc) returned 0x2c8700 [0260.838] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x23d4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x23d4, lpOverlapped=0x0) returned 1 [0260.840] CloseHandle (hObject=0xdc) returned 1 [0260.840] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf")) returned 1 [0260.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.841] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.841] GetTickCount () returned 0x50868 [0260.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.841] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.841] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832\\....\\temporaryfile")) returned 0 [0260.842] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832\\temporaryfile")) returned 1 [0260.843] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.843] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.843] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.843] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.843] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.843] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.843] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.843] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832\\temporaryfile")) returned 1 [0260.844] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.844] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.844] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832")) returned 1 [0260.844] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF") returned 0 [0260.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.845] WriteFile (in: hFile=0xdc, lpBuffer=0x2caaf0*, nNumberOfBytesToWrite=0x23d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caaf0*, lpNumberOfBytesWritten=0x18fdd8*=0x23d8, lpOverlapped=0x0) returned 1 [0260.846] CloseHandle (hObject=0xdc) returned 1 [0260.846] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.847] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1fc4 [0260.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1fcc) returned 0x2c8700 [0260.847] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1fc4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1fc4, lpOverlapped=0x0) returned 1 [0260.849] CloseHandle (hObject=0xdc) returned 1 [0260.849] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf")) returned 1 [0260.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.850] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.850] GetTickCount () returned 0x50868 [0260.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.850] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.850] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.851] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832\\....\\temporaryfile")) returned 0 [0260.851] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832\\temporaryfile")) returned 1 [0260.852] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06b9180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06b9180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.852] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06b9180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06b9180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.852] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.852] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.852] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.853] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.853] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.853] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832\\temporaryfile")) returned 1 [0260.853] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0693020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0693020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0693020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.853] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.853] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329832" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329832")) returned 1 [0260.853] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF") returned 0 [0260.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.854] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca6e0*, nNumberOfBytesToWrite=0x1fc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca6e0*, lpNumberOfBytesWritten=0x18fdd8*=0x1fc8, lpOverlapped=0x0) returned 1 [0260.855] CloseHandle (hObject=0xdc) returned 1 [0260.855] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.856] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x75e2 [0260.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x75ea) returned 0x2c8700 [0260.856] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x75e2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x75e2, lpOverlapped=0x0) returned 1 [0260.858] CloseHandle (hObject=0xdc) returned 1 [0260.858] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf")) returned 1 [0260.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.859] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.859] GetTickCount () returned 0x50878 [0260.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.859] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.859] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329848\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329848\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329848\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329848\\....\\temporaryfile")) returned 0 [0260.860] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329848\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329848\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329848\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329848\\temporaryfile")) returned 1 [0260.861] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329848\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06b9180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06b9180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06b9180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06b9180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06b9180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06b9180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06b9180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06b9180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06b9180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.862] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329848\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06b9180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06b9180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06b9180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.862] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06b9180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06b9180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06b9180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.862] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06b9180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06b9180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06b9180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.862] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329848\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329848\\temporaryfile")) returned 1 [0260.862] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06b9180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06b9180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06b9180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.862] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.862] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329848" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329848")) returned 1 [0260.862] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF") returned 0 [0260.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.864] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfd00*, nNumberOfBytesToWrite=0x75e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfd00*, lpNumberOfBytesWritten=0x18fdd8*=0x75e8, lpOverlapped=0x0) returned 1 [0260.865] CloseHandle (hObject=0xdc) returned 1 [0260.865] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.866] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x824e [0260.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8256) returned 0x2c8700 [0260.866] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x824e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x824e, lpOverlapped=0x0) returned 1 [0260.868] CloseHandle (hObject=0xdc) returned 1 [0260.868] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf")) returned 1 [0260.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.869] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.869] GetTickCount () returned 0x50888 [0260.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.869] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.869] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864\\....\\temporaryfile")) returned 0 [0260.870] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864\\temporaryfile")) returned 1 [0260.871] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.871] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.871] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.871] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.871] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.871] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.872] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.872] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864\\temporaryfile")) returned 1 [0260.872] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.872] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.872] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864")) returned 1 [0260.872] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF") returned 0 [0260.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.873] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0968*, nNumberOfBytesToWrite=0x8258, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0968*, lpNumberOfBytesWritten=0x18fdd8*=0x8258, lpOverlapped=0x0) returned 1 [0260.875] CloseHandle (hObject=0xdc) returned 1 [0260.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.875] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x62b2 [0260.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x62ba) returned 0x2c8700 [0260.875] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x62b2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x62b2, lpOverlapped=0x0) returned 1 [0260.877] CloseHandle (hObject=0xdc) returned 1 [0260.877] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf")) returned 1 [0260.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.878] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.878] GetTickCount () returned 0x50888 [0260.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.879] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.879] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864\\....\\temporaryfile")) returned 0 [0260.880] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864\\temporaryfile")) returned 1 [0260.881] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.881] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.881] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.881] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.881] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.881] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.881] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.881] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864\\temporaryfile")) returned 1 [0260.882] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa06df2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa06df2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa06df2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.882] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.882] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329864" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329864")) returned 1 [0260.882] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF") returned 0 [0260.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.883] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce9d0*, nNumberOfBytesToWrite=0x62b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce9d0*, lpNumberOfBytesWritten=0x18fdd8*=0x62b8, lpOverlapped=0x0) returned 1 [0260.884] CloseHandle (hObject=0xdc) returned 1 [0260.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.887] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x78e0 [0260.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78e8) returned 0x2c8700 [0260.887] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x78e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x78e0, lpOverlapped=0x0) returned 1 [0260.889] CloseHandle (hObject=0xdc) returned 1 [0260.889] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf")) returned 1 [0260.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.890] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.890] GetTickCount () returned 0x50897 [0260.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.890] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329879\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329879\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329879\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329879\\....\\temporaryfile")) returned 0 [0260.891] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329879\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329879\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329879\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329879\\temporaryfile")) returned 1 [0260.892] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329879\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0705440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0705440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0705440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0705440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0705440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0705440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0705440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0705440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0705440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.892] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329879\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0705440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0705440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0705440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.893] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0705440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0705440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0705440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.893] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0705440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0705440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0705440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.893] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.893] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329879\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329879\\temporaryfile")) returned 1 [0260.893] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0705440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0705440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0705440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.893] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.893] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329879" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329879")) returned 1 [0260.893] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF") returned 0 [0260.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.894] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfff8*, nNumberOfBytesToWrite=0x78e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfff8*, lpNumberOfBytesWritten=0x18fdd8*=0x78e8, lpOverlapped=0x0) returned 1 [0260.896] CloseHandle (hObject=0xdc) returned 1 [0260.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.896] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6f26 [0260.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6f2e) returned 0x2c8700 [0260.896] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6f26, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6f26, lpOverlapped=0x0) returned 1 [0260.898] CloseHandle (hObject=0xdc) returned 1 [0260.898] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf")) returned 1 [0260.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.899] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.899] GetTickCount () returned 0x508a7 [0260.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.900] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329895\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329895\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329895\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329895\\....\\temporaryfile")) returned 0 [0260.900] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329895\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329895\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329895\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329895\\temporaryfile")) returned 1 [0260.902] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329895\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa072b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa072b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa072b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.902] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa072b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa072b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa072b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.902] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa072b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa072b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa072b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.902] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329895\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa072b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa072b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa072b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.902] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa072b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa072b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa072b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.902] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa072b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa072b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa072b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.902] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.902] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329895\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329895\\temporaryfile")) returned 1 [0260.907] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa072b5a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa072b5a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa072b5a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.907] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.907] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329895" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329895")) returned 1 [0260.907] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF") returned 0 [0260.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.909] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf640*, nNumberOfBytesToWrite=0x6f30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf640*, lpNumberOfBytesWritten=0x18fdd8*=0x6f30, lpOverlapped=0x0) returned 1 [0260.910] CloseHandle (hObject=0xdc) returned 1 [0260.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.911] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb9c4 [0260.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb9cc) returned 0x2c8700 [0260.911] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xb9c4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xb9c4, lpOverlapped=0x0) returned 1 [0260.913] CloseHandle (hObject=0xdc) returned 1 [0260.913] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf")) returned 1 [0260.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.914] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.914] GetTickCount () returned 0x508b6 [0260.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.915] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.915] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910\\....\\temporaryfile")) returned 0 [0260.915] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910\\temporaryfile")) returned 1 [0260.917] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.917] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.917] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.917] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.917] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.917] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910\\temporaryfile")) returned 1 [0260.917] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.917] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.918] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910")) returned 1 [0260.918] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF") returned 0 [0260.919] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.919] WriteFile (in: hFile=0xdc, lpBuffer=0x2d40e0*, nNumberOfBytesToWrite=0xb9c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d40e0*, lpNumberOfBytesWritten=0x18fdd8*=0xb9c8, lpOverlapped=0x0) returned 1 [0260.921] CloseHandle (hObject=0xdc) returned 1 [0260.921] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.922] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6928 [0260.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6930) returned 0x2c8700 [0260.922] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6928, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6928, lpOverlapped=0x0) returned 1 [0260.923] CloseHandle (hObject=0xdc) returned 1 [0260.923] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf")) returned 1 [0260.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.924] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.924] GetTickCount () returned 0x508b6 [0260.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.924] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.925] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910\\....\\temporaryfile")) returned 0 [0260.926] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910\\temporaryfile")) returned 1 [0260.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.927] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.927] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.927] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.927] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.927] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910\\temporaryfile")) returned 1 [0260.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0751700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0751700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0751700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.927] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.928] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329910" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329910")) returned 1 [0260.928] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF") returned 0 [0260.928] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.929] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf040*, nNumberOfBytesToWrite=0x6930, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf040*, lpNumberOfBytesWritten=0x18fdd8*=0x6930, lpOverlapped=0x0) returned 1 [0260.931] CloseHandle (hObject=0xdc) returned 1 [0260.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.931] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7400 [0260.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7408) returned 0x2c8700 [0260.932] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7400, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7400, lpOverlapped=0x0) returned 1 [0260.933] CloseHandle (hObject=0xdc) returned 1 [0260.933] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf")) returned 1 [0260.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.934] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.934] GetTickCount () returned 0x508c6 [0260.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.935] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.935] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329926\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329926\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329926\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329926\\....\\temporaryfile")) returned 0 [0260.936] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329926\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329926\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329926\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329926\\temporaryfile")) returned 1 [0260.937] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329926\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0777860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0777860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0777860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.937] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0777860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0777860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0777860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.937] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0777860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0777860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0777860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.937] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329926\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0777860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0777860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0777860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.937] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0777860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0777860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0777860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.937] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0777860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0777860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0777860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.937] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.937] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329926\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329926\\temporaryfile")) returned 1 [0260.937] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0777860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0777860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0777860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.937] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.938] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329926" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329926")) returned 1 [0260.938] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF") returned 0 [0260.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.939] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfb18*, nNumberOfBytesToWrite=0x7408, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfb18*, lpNumberOfBytesWritten=0x18fdd8*=0x7408, lpOverlapped=0x0) returned 1 [0260.941] CloseHandle (hObject=0xdc) returned 1 [0260.941] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.941] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4090 [0260.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4098) returned 0x2c8700 [0260.941] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4090, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4090, lpOverlapped=0x0) returned 1 [0260.943] CloseHandle (hObject=0xdc) returned 1 [0260.943] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf")) returned 1 [0260.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.944] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.944] GetTickCount () returned 0x508d6 [0260.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.944] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.945] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.945] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942\\....\\temporaryfile")) returned 0 [0260.945] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942\\temporaryfile")) returned 1 [0260.946] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.947] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.947] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.947] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.947] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.947] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.947] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942\\temporaryfile")) returned 1 [0260.947] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.947] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.947] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942")) returned 1 [0260.947] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF") returned 0 [0260.948] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.948] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc7a8*, nNumberOfBytesToWrite=0x4098, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc7a8*, lpNumberOfBytesWritten=0x18fdd8*=0x4098, lpOverlapped=0x0) returned 1 [0260.949] CloseHandle (hObject=0xdc) returned 1 [0260.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.952] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4584 [0260.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x458c) returned 0x2c8700 [0260.952] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4584, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4584, lpOverlapped=0x0) returned 1 [0260.954] CloseHandle (hObject=0xdc) returned 1 [0260.954] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf")) returned 1 [0260.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.955] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.955] GetTickCount () returned 0x508d6 [0260.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.955] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942\\....\\temporaryfile")) returned 0 [0260.956] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942\\temporaryfile")) returned 1 [0260.957] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.958] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.958] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.958] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.958] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.958] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.958] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.958] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942\\temporaryfile")) returned 1 [0260.958] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa079d9c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa079d9c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa079d9c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.958] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.958] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329942" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329942")) returned 1 [0260.958] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF") returned 0 [0260.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.959] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccca0*, nNumberOfBytesToWrite=0x4588, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccca0*, lpNumberOfBytesWritten=0x18fdd8*=0x4588, lpOverlapped=0x0) returned 1 [0260.961] CloseHandle (hObject=0xdc) returned 1 [0260.961] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.961] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x76e0 [0260.961] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x76e8) returned 0x2c8700 [0260.962] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x76e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x76e0, lpOverlapped=0x0) returned 1 [0260.963] CloseHandle (hObject=0xdc) returned 1 [0260.963] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf")) returned 1 [0260.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.964] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.964] GetTickCount () returned 0x508e5 [0260.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.965] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957\\....\\temporaryfile")) returned 0 [0260.965] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957\\temporaryfile")) returned 1 [0260.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.967] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.967] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.967] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.967] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.967] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.967] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.967] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957\\temporaryfile")) returned 1 [0260.967] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.967] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.967] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957")) returned 1 [0260.968] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF") returned 0 [0260.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.969] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfdf8*, nNumberOfBytesToWrite=0x76e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfdf8*, lpNumberOfBytesWritten=0x18fdd8*=0x76e8, lpOverlapped=0x0) returned 1 [0260.971] CloseHandle (hObject=0xdc) returned 1 [0260.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.971] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5850 [0260.971] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5858) returned 0x2c8700 [0260.971] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5850, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5850, lpOverlapped=0x0) returned 1 [0260.973] CloseHandle (hObject=0xdc) returned 1 [0260.973] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf")) returned 1 [0260.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.974] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.974] GetTickCount () returned 0x508e5 [0260.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.975] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957\\....\\temporaryfile")) returned 0 [0260.976] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957\\temporaryfile")) returned 1 [0260.977] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07e9c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07e9c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.977] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07e9c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07e9c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.977] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.977] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.977] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.977] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.977] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.977] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957\\temporaryfile")) returned 1 [0260.977] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07c3b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07c3b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07c3b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.977] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.978] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329957" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329957")) returned 1 [0260.978] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF") returned 0 [0260.978] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.979] WriteFile (in: hFile=0xdc, lpBuffer=0x2cdf68*, nNumberOfBytesToWrite=0x5858, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cdf68*, lpNumberOfBytesWritten=0x18fdd8*=0x5858, lpOverlapped=0x0) returned 1 [0260.980] CloseHandle (hObject=0xdc) returned 1 [0260.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.981] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5328 [0260.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5330) returned 0x2c8700 [0260.981] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5328, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5328, lpOverlapped=0x0) returned 1 [0260.982] CloseHandle (hObject=0xdc) returned 1 [0260.983] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf")) returned 1 [0260.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0260.983] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.984] GetTickCount () returned 0x508f5 [0260.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.984] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329973\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329973\\...."), lpSecurityAttributes=0x256228) returned 1 [0260.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329973\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329973\\....\\temporaryfile")) returned 0 [0260.985] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329973\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329973\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329973\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329973\\temporaryfile")) returned 1 [0260.986] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329973\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07e9c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07e9c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07e9c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.986] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07e9c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07e9c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07e9c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.986] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07e9c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07e9c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07e9c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.986] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329973\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07e9c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07e9c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07e9c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.986] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07e9c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07e9c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07e9c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.986] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07e9c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07e9c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07e9c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.986] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329973\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329973\\temporaryfile")) returned 1 [0260.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa07e9c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa07e9c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa07e9c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.987] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329973" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329973")) returned 1 [0260.987] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF") returned 0 [0260.987] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.988] WriteFile (in: hFile=0xdc, lpBuffer=0x2cda40*, nNumberOfBytesToWrite=0x5330, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cda40*, lpNumberOfBytesWritten=0x18fdd8*=0x5330, lpOverlapped=0x0) returned 1 [0260.989] CloseHandle (hObject=0xdc) returned 1 [0260.989] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.990] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8c0 [0260.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8c8) returned 0x2450048 [0260.990] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x8c0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x8c0, lpOverlapped=0x0) returned 1 [0260.992] CloseHandle (hObject=0xdc) returned 1 [0260.992] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf")) returned 1 [0260.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0260.993] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0260.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0260.993] GetTickCount () returned 0x50904 [0260.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0260.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0260.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0260.993] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988\\...."), lpSecurityAttributes=0x256210) returned 1 [0260.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988\\....\\temporaryfile")) returned 0 [0260.994] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988\\temporaryfile")) returned 1 [0260.995] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0260.995] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.995] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0260.995] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0260.995] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.995] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0260.995] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0260.995] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988\\temporaryfile")) returned 1 [0260.996] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0260.996] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0260.996] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988")) returned 1 [0260.996] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF") returned 0 [0260.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.997] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x8c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x8c8, lpOverlapped=0x0) returned 1 [0260.998] CloseHandle (hObject=0xdc) returned 1 [0260.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0260.998] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x39f8 [0260.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3a00) returned 0x2c8700 [0260.998] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x39f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x39f8, lpOverlapped=0x0) returned 1 [0261.000] CloseHandle (hObject=0xdc) returned 1 [0261.000] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf")) returned 1 [0261.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.001] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.001] GetTickCount () returned 0x50904 [0261.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.002] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988\\....\\temporaryfile")) returned 0 [0261.002] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988\\temporaryfile")) returned 1 [0261.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.004] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.004] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.004] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.004] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988\\temporaryfile")) returned 1 [0261.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa080fde0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa080fde0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa080fde0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.004] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.004] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18329988" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18329988")) returned 1 [0261.004] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF") returned 0 [0261.005] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.005] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc110*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc110*, lpNumberOfBytesWritten=0x18fdd8*=0x3a00, lpOverlapped=0x0) returned 1 [0261.006] CloseHandle (hObject=0xdc) returned 1 [0261.011] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.011] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d2a [0261.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d32) returned 0x2c8700 [0261.012] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1d2a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1d2a, lpOverlapped=0x0) returned 1 [0261.013] CloseHandle (hObject=0xdc) returned 1 [0261.013] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf")) returned 1 [0261.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.014] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.014] GetTickCount () returned 0x50914 [0261.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.014] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.015] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.015] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330004\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330004\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330004\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330004\\....\\temporaryfile")) returned 0 [0261.015] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330004\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330004\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330004\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330004\\temporaryfile")) returned 1 [0261.016] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330004\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0835f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0835f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0835f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.017] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0835f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0835f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0835f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.017] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0835f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0835f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0835f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.017] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330004\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0835f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0835f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0835f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.017] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0835f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0835f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0835f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.017] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0835f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0835f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0835f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.017] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.017] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330004\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330004\\temporaryfile")) returned 1 [0261.017] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0835f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0835f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0835f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.017] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.017] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330004" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330004")) returned 1 [0261.017] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF") returned 0 [0261.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.018] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca448*, nNumberOfBytesToWrite=0x1d30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca448*, lpNumberOfBytesWritten=0x18fdd8*=0x1d30, lpOverlapped=0x0) returned 1 [0261.019] CloseHandle (hObject=0xdc) returned 1 [0261.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.020] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc70 [0261.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc78) returned 0x2450048 [0261.020] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xc70, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xc70, lpOverlapped=0x0) returned 1 [0261.022] CloseHandle (hObject=0xdc) returned 1 [0261.022] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf")) returned 1 [0261.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.023] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.023] GetTickCount () returned 0x50924 [0261.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.023] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.023] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020\\....\\temporaryfile")) returned 0 [0261.024] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020\\temporaryfile")) returned 1 [0261.025] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.025] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.025] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.025] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.025] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.025] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.025] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.026] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020\\temporaryfile")) returned 1 [0261.026] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.026] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.026] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020")) returned 1 [0261.026] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF") returned 0 [0261.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.027] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xc78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xc78, lpOverlapped=0x0) returned 1 [0261.028] CloseHandle (hObject=0xdc) returned 1 [0261.028] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.028] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x614 [0261.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x61c) returned 0x259e70 [0261.028] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x614, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x614, lpOverlapped=0x0) returned 1 [0261.030] CloseHandle (hObject=0xdc) returned 1 [0261.030] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf")) returned 1 [0261.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.031] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.031] GetTickCount () returned 0x50924 [0261.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.031] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.032] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020\\....\\temporaryfile")) returned 0 [0261.032] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020\\temporaryfile")) returned 1 [0261.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.033] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.033] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.034] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.034] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.034] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.034] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020\\temporaryfile")) returned 1 [0261.034] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa085c0a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa085c0a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa085c0a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.034] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.034] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330020" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330020")) returned 1 [0261.034] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF") returned 0 [0261.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.035] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x618, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x618, lpOverlapped=0x0) returned 1 [0261.036] CloseHandle (hObject=0xdc) returned 1 [0261.036] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.037] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8b4 [0261.037] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8bc) returned 0x2450048 [0261.037] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x8b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x8b4, lpOverlapped=0x0) returned 1 [0261.038] CloseHandle (hObject=0xdc) returned 1 [0261.038] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf")) returned 1 [0261.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.039] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.039] GetTickCount () returned 0x50933 [0261.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.040] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035\\....\\temporaryfile")) returned 0 [0261.040] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035\\temporaryfile")) returned 1 [0261.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.042] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.042] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.042] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.042] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035\\temporaryfile")) returned 1 [0261.047] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.047] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.047] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035")) returned 1 [0261.047] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF") returned 0 [0261.047] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.048] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x8b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x8b8, lpOverlapped=0x0) returned 1 [0261.049] CloseHandle (hObject=0xdc) returned 1 [0261.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.049] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3380 [0261.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3388) returned 0x2c8700 [0261.049] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3380, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3380, lpOverlapped=0x0) returned 1 [0261.051] CloseHandle (hObject=0xdc) returned 1 [0261.051] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf")) returned 1 [0261.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.052] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.052] GetTickCount () returned 0x50933 [0261.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.052] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.053] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.053] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035\\....\\temporaryfile")) returned 0 [0261.053] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035\\temporaryfile")) returned 1 [0261.055] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08a8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08a8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08a8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08a8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.055] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.055] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.055] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.055] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.055] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035\\temporaryfile")) returned 1 [0261.055] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0882200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0882200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0882200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.055] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.055] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330035" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330035")) returned 1 [0261.056] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF") returned 0 [0261.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.057] WriteFile (in: hFile=0xdc, lpBuffer=0x2cba98*, nNumberOfBytesToWrite=0x3388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cba98*, lpNumberOfBytesWritten=0x18fdd8*=0x3388, lpOverlapped=0x0) returned 1 [0261.058] CloseHandle (hObject=0xdc) returned 1 [0261.058] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.059] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x692 [0261.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x69a) returned 0x259e70 [0261.059] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x692, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x692, lpOverlapped=0x0) returned 1 [0261.060] CloseHandle (hObject=0xdc) returned 1 [0261.060] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf")) returned 1 [0261.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.061] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.061] GetTickCount () returned 0x50943 [0261.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.062] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.062] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330051\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330051\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330051\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330051\\....\\temporaryfile")) returned 0 [0261.063] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330051\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330051\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330051\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330051\\temporaryfile")) returned 1 [0261.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330051\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08a8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08a8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08a8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08a8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08a8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08a8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.064] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08a8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08a8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08a8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.064] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330051\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08a8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08a8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08a8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.064] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08a8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08a8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08a8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.064] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08a8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08a8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08a8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.064] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.064] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330051\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330051\\temporaryfile")) returned 1 [0261.065] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08a8360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08a8360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08a8360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.065] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.065] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330051" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330051")) returned 1 [0261.065] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF") returned 0 [0261.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.066] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x698, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x698, lpOverlapped=0x0) returned 1 [0261.066] CloseHandle (hObject=0xdc) returned 1 [0261.067] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.067] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x282c [0261.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2834) returned 0x2c8700 [0261.067] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x282c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x282c, lpOverlapped=0x0) returned 1 [0261.069] CloseHandle (hObject=0xdc) returned 1 [0261.069] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf")) returned 1 [0261.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.070] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.070] GetTickCount () returned 0x50952 [0261.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.070] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.071] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066\\....\\temporaryfile")) returned 0 [0261.071] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066\\temporaryfile")) returned 1 [0261.073] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.073] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.073] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.073] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.073] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.073] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.073] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.073] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066\\temporaryfile")) returned 1 [0261.073] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.073] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.073] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066")) returned 1 [0261.074] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF") returned 0 [0261.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.074] WriteFile (in: hFile=0xdc, lpBuffer=0x2caf48*, nNumberOfBytesToWrite=0x2830, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caf48*, lpNumberOfBytesWritten=0x18fdd8*=0x2830, lpOverlapped=0x0) returned 1 [0261.075] CloseHandle (hObject=0xdc) returned 1 [0261.076] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.076] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2108 [0261.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2110) returned 0x2c8700 [0261.076] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2108, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2108, lpOverlapped=0x0) returned 1 [0261.078] CloseHandle (hObject=0xdc) returned 1 [0261.078] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf")) returned 1 [0261.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.079] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.079] GetTickCount () returned 0x50952 [0261.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.081] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.081] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.082] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066\\....\\temporaryfile")) returned 0 [0261.082] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066\\temporaryfile")) returned 1 [0261.083] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.084] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.084] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.084] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.084] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.084] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.084] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.084] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066\\temporaryfile")) returned 1 [0261.084] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08ce4c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08ce4c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08ce4c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.084] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.084] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330066" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330066")) returned 1 [0261.084] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF") returned 0 [0261.085] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.085] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca820*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca820*, lpNumberOfBytesWritten=0x18fdd8*=0x2110, lpOverlapped=0x0) returned 1 [0261.087] CloseHandle (hObject=0xdc) returned 1 [0261.087] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.087] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f24 [0261.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f2c) returned 0x2c8700 [0261.087] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f24, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f24, lpOverlapped=0x0) returned 1 [0261.089] CloseHandle (hObject=0xdc) returned 1 [0261.089] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf")) returned 1 [0261.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.090] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.090] GetTickCount () returned 0x50962 [0261.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.090] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.090] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.091] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082\\....\\temporaryfile")) returned 0 [0261.091] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082\\temporaryfile")) returned 1 [0261.092] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.092] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.092] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.092] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.092] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.093] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.093] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.093] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082\\temporaryfile")) returned 1 [0261.093] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.093] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.093] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082")) returned 1 [0261.093] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF") returned 0 [0261.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.094] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca640*, nNumberOfBytesToWrite=0x1f28, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca640*, lpNumberOfBytesWritten=0x18fdd8*=0x1f28, lpOverlapped=0x0) returned 1 [0261.095] CloseHandle (hObject=0xdc) returned 1 [0261.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.096] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2178 [0261.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2180) returned 0x2c8700 [0261.096] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2178, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2178, lpOverlapped=0x0) returned 1 [0261.098] CloseHandle (hObject=0xdc) returned 1 [0261.098] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf")) returned 1 [0261.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.099] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.099] GetTickCount () returned 0x50962 [0261.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.099] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.099] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082\\....\\temporaryfile")) returned 0 [0261.100] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082\\temporaryfile")) returned 1 [0261.101] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa091a780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa091a780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.101] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa091a780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa091a780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.101] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.101] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.102] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.102] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.102] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.102] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082\\temporaryfile")) returned 1 [0261.102] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa08f4620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa08f4620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa08f4620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.102] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.102] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330082" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330082")) returned 1 [0261.102] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF") returned 0 [0261.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.103] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca890*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca890*, lpNumberOfBytesWritten=0x18fdd8*=0x2180, lpOverlapped=0x0) returned 1 [0261.104] CloseHandle (hObject=0xdc) returned 1 [0261.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.105] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1664 [0261.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x166c) returned 0x2c4a70 [0261.105] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1664, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1664, lpOverlapped=0x0) returned 1 [0261.106] CloseHandle (hObject=0xdc) returned 1 [0261.106] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf")) returned 1 [0261.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.107] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.107] GetTickCount () returned 0x50972 [0261.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.108] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330098\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330098\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330098\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330098\\....\\temporaryfile")) returned 0 [0261.108] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330098\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330098\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330098\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330098\\temporaryfile")) returned 1 [0261.110] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330098\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa091a780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa091a780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa091a780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa091a780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa091a780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa091a780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa091a780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa091a780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa091a780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.110] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330098\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa091a780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa091a780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa091a780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.110] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa091a780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa091a780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa091a780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.110] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa091a780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa091a780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa091a780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.110] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.110] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330098\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330098\\temporaryfile")) returned 1 [0261.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa091a780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa091a780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa091a780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.110] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.110] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330098" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330098")) returned 1 [0261.111] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF") returned 0 [0261.111] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.112] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1668, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1668, lpOverlapped=0x0) returned 1 [0261.112] CloseHandle (hObject=0xdc) returned 1 [0261.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.113] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x41a0 [0261.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x41a8) returned 0x2c8700 [0261.113] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x41a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x41a0, lpOverlapped=0x0) returned 1 [0261.115] CloseHandle (hObject=0xdc) returned 1 [0261.115] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf")) returned 1 [0261.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.116] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.116] GetTickCount () returned 0x50981 [0261.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.117] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113\\....\\temporaryfile")) returned 0 [0261.117] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113\\temporaryfile")) returned 1 [0261.118] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.118] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.119] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.119] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.119] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.119] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.119] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.119] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113\\temporaryfile")) returned 1 [0261.119] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.119] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.119] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113")) returned 1 [0261.119] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF") returned 0 [0261.120] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.120] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc8b8*, nNumberOfBytesToWrite=0x41a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc8b8*, lpNumberOfBytesWritten=0x18fdd8*=0x41a8, lpOverlapped=0x0) returned 1 [0261.121] CloseHandle (hObject=0xdc) returned 1 [0261.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.122] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3998 [0261.122] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x39a0) returned 0x2c8700 [0261.122] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3998, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3998, lpOverlapped=0x0) returned 1 [0261.124] CloseHandle (hObject=0xdc) returned 1 [0261.124] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf")) returned 1 [0261.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.125] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.125] GetTickCount () returned 0x50981 [0261.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.125] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113\\....\\temporaryfile")) returned 0 [0261.126] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113\\temporaryfile")) returned 1 [0261.127] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.127] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.127] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.128] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.128] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.128] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.128] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.128] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113\\temporaryfile")) returned 1 [0261.128] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09408e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09408e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09408e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.128] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.128] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330113" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330113")) returned 1 [0261.128] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF") returned 0 [0261.129] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.129] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc0b0*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc0b0*, lpNumberOfBytesWritten=0x18fdd8*=0x39a0, lpOverlapped=0x0) returned 1 [0261.130] CloseHandle (hObject=0xdc) returned 1 [0261.131] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.132] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xec4 [0261.132] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xecc) returned 0x2450048 [0261.132] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xec4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xec4, lpOverlapped=0x0) returned 1 [0261.133] CloseHandle (hObject=0xdc) returned 1 [0261.133] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf")) returned 1 [0261.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.134] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.134] GetTickCount () returned 0x50991 [0261.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.135] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.135] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129\\....\\temporaryfile")) returned 0 [0261.135] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129\\temporaryfile")) returned 1 [0261.137] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.137] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.137] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.137] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.137] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.137] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.137] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.137] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129\\temporaryfile")) returned 1 [0261.137] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.137] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.137] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129")) returned 1 [0261.137] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF") returned 0 [0261.138] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.138] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xec8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xec8, lpOverlapped=0x0) returned 1 [0261.139] CloseHandle (hObject=0xdc) returned 1 [0261.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.140] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1868 [0261.140] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1870) returned 0x2c4a70 [0261.140] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1868, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1868, lpOverlapped=0x0) returned 1 [0261.141] CloseHandle (hObject=0xdc) returned 1 [0261.142] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf")) returned 1 [0261.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.142] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.142] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.142] GetTickCount () returned 0x50991 [0261.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.143] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129\\....\\temporaryfile")) returned 0 [0261.144] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129\\temporaryfile")) returned 1 [0261.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.148] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.148] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.148] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.148] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.148] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.148] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129\\temporaryfile")) returned 1 [0261.148] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0966a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0966a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0966a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.148] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.148] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330129" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330129")) returned 1 [0261.149] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF") returned 0 [0261.149] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.150] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1870, lpOverlapped=0x0) returned 1 [0261.150] CloseHandle (hObject=0xdc) returned 1 [0261.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.151] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9fc [0261.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa04) returned 0x2450048 [0261.151] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x9fc, lpOverlapped=0x0) returned 1 [0261.153] CloseHandle (hObject=0xdc) returned 1 [0261.153] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf")) returned 1 [0261.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.154] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.154] GetTickCount () returned 0x509a0 [0261.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.155] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330144\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330144\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330144\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330144\\....\\temporaryfile")) returned 0 [0261.155] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330144\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330144\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330144\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330144\\temporaryfile")) returned 1 [0261.157] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330144\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa098cba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa098cba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa098cba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.157] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa098cba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa098cba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa098cba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.157] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa098cba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa098cba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa098cba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.157] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330144\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa098cba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa098cba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa098cba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.157] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa098cba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa098cba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa098cba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.157] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa098cba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa098cba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa098cba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.157] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.157] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330144\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330144\\temporaryfile")) returned 1 [0261.157] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa098cba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa098cba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa098cba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.157] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.157] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330144" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330144")) returned 1 [0261.157] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF") returned 0 [0261.158] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.158] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa00, lpOverlapped=0x0) returned 1 [0261.160] CloseHandle (hObject=0xdc) returned 1 [0261.160] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.160] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x78a [0261.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x792) returned 0x2450048 [0261.160] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x78a, lpOverlapped=0x0) returned 1 [0261.162] CloseHandle (hObject=0xdc) returned 1 [0261.162] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf")) returned 1 [0261.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.163] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.163] GetTickCount () returned 0x509b0 [0261.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.163] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160\\....\\temporaryfile")) returned 0 [0261.164] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160\\temporaryfile")) returned 1 [0261.165] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.165] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.165] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.165] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.165] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.165] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.165] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.165] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160\\temporaryfile")) returned 1 [0261.166] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.166] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.166] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160")) returned 1 [0261.166] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF") returned 0 [0261.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.167] WriteFile (in: hFile=0xdc, lpBuffer=0x24507f0*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x24507f0*, lpNumberOfBytesWritten=0x18fdd8*=0x790, lpOverlapped=0x0) returned 1 [0261.168] CloseHandle (hObject=0xdc) returned 1 [0261.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.168] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1020 [0261.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1028) returned 0x25b528 [0261.168] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1020, lpOverlapped=0x0) returned 1 [0261.170] CloseHandle (hObject=0xdc) returned 1 [0261.170] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf")) returned 1 [0261.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.171] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.171] GetTickCount () returned 0x509b0 [0261.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.171] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160\\....\\temporaryfile")) returned 0 [0261.172] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160\\temporaryfile")) returned 1 [0261.173] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.174] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.174] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.174] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.174] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160\\temporaryfile")) returned 1 [0261.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09b2d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09b2d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09b2d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.174] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.174] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330160" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330160")) returned 1 [0261.174] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF") returned 0 [0261.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.175] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1028, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1028, lpOverlapped=0x0) returned 1 [0261.176] CloseHandle (hObject=0xdc) returned 1 [0261.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.177] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x37f8 [0261.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3800) returned 0x2c8700 [0261.177] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x37f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x37f8, lpOverlapped=0x0) returned 1 [0261.179] CloseHandle (hObject=0xdc) returned 1 [0261.179] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf")) returned 1 [0261.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.185] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.185] GetTickCount () returned 0x509c0 [0261.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.185] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.185] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176\\....\\temporaryfile")) returned 0 [0261.186] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176\\temporaryfile")) returned 1 [0261.187] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09d8e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09d8e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09d8e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.187] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09d8e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09d8e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09d8e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.187] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09d8e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09d8e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09d8e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.187] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09d8e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09d8e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09d8e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.187] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09d8e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09d8e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09d8e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.187] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09d8e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09d8e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09d8e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.187] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.187] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176\\temporaryfile")) returned 1 [0261.188] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09d8e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09d8e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09d8e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.188] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.188] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176")) returned 1 [0261.188] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF") returned 0 [0261.188] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.189] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbf10*, nNumberOfBytesToWrite=0x3800, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbf10*, lpNumberOfBytesWritten=0x18fdd8*=0x3800, lpOverlapped=0x0) returned 1 [0261.190] CloseHandle (hObject=0xdc) returned 1 [0261.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.191] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x167c [0261.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1684) returned 0x2c4a70 [0261.191] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x167c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x167c, lpOverlapped=0x0) returned 1 [0261.192] CloseHandle (hObject=0xdc) returned 1 [0261.192] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf")) returned 1 [0261.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.193] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.193] GetTickCount () returned 0x509c0 [0261.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.194] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176\\....\\temporaryfile")) returned 0 [0261.194] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176\\temporaryfile")) returned 1 [0261.196] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09d8e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.196] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09d8e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.196] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.196] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.196] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.196] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.196] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.196] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176\\temporaryfile")) returned 1 [0261.196] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.196] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.197] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330176" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330176")) returned 1 [0261.197] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF") returned 0 [0261.197] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.198] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1680, lpOverlapped=0x0) returned 1 [0261.199] CloseHandle (hObject=0xdc) returned 1 [0261.199] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.200] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x608 [0261.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x610) returned 0x259e70 [0261.200] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x608, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x608, lpOverlapped=0x0) returned 1 [0261.201] CloseHandle (hObject=0xdc) returned 1 [0261.201] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf")) returned 1 [0261.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.202] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.202] GetTickCount () returned 0x509cf [0261.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.203] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330191\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330191\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330191\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330191\\....\\temporaryfile")) returned 0 [0261.204] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330191\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330191\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330191\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330191\\temporaryfile")) returned 1 [0261.205] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330191\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.205] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330191\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.205] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.205] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.205] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330191\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330191\\temporaryfile")) returned 1 [0261.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa09fefc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa09fefc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa09fefc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.206] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.206] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330191" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330191")) returned 1 [0261.206] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF") returned 0 [0261.206] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.207] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x610, lpOverlapped=0x0) returned 1 [0261.207] CloseHandle (hObject=0xdc) returned 1 [0261.208] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.208] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x634 [0261.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x63c) returned 0x259e70 [0261.208] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x634, lpOverlapped=0x0) returned 1 [0261.220] CloseHandle (hObject=0xdc) returned 1 [0261.220] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf")) returned 1 [0261.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.221] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.221] GetTickCount () returned 0x509df [0261.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.221] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.222] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330207\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330207\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330207\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330207\\....\\temporaryfile")) returned 0 [0261.222] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330207\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330207\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330207\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330207\\temporaryfile")) returned 1 [0261.224] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330207\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a25120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a25120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a25120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.224] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a25120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a25120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a25120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.224] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a25120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a25120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a25120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.224] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330207\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a25120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a25120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a25120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.224] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a25120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a25120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a25120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.224] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a25120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a25120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a25120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.224] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.224] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330207\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330207\\temporaryfile")) returned 1 [0261.224] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a25120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a25120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a25120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.224] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.224] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330207" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330207")) returned 1 [0261.225] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF") returned 0 [0261.225] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.226] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x638, lpOverlapped=0x0) returned 1 [0261.227] CloseHandle (hObject=0xdc) returned 1 [0261.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.228] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7fce [0261.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7fd6) returned 0x2c8700 [0261.228] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7fce, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7fce, lpOverlapped=0x0) returned 1 [0261.230] CloseHandle (hObject=0xdc) returned 1 [0261.230] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf")) returned 1 [0261.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.231] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.231] GetTickCount () returned 0x509ee [0261.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.232] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330222\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330222\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330222\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330222\\....\\temporaryfile")) returned 0 [0261.232] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330222\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330222\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330222\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330222\\temporaryfile")) returned 1 [0261.234] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330222\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a4b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a4b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a4b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.234] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a4b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a4b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a4b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.234] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a4b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a4b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a4b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.234] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330222\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a4b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a4b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a4b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.234] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a4b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a4b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a4b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.234] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a4b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a4b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a4b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.234] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.234] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330222\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330222\\temporaryfile")) returned 1 [0261.234] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a4b280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a4b280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a4b280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.234] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.234] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330222" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330222")) returned 1 [0261.235] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF") returned 0 [0261.235] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.236] WriteFile (in: hFile=0xdc, lpBuffer=0x2d06e8*, nNumberOfBytesToWrite=0x7fd8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d06e8*, lpNumberOfBytesWritten=0x18fdd8*=0x7fd8, lpOverlapped=0x0) returned 1 [0261.238] CloseHandle (hObject=0xdc) returned 1 [0261.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.238] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x121c [0261.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1224) returned 0x25b528 [0261.238] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x121c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x121c, lpOverlapped=0x0) returned 1 [0261.240] CloseHandle (hObject=0xdc) returned 1 [0261.240] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf")) returned 1 [0261.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.241] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.241] GetTickCount () returned 0x509fe [0261.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.242] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.242] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238\\....\\temporaryfile")) returned 0 [0261.242] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238\\temporaryfile")) returned 1 [0261.243] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.244] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.244] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.244] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.244] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.244] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.244] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.244] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238\\temporaryfile")) returned 1 [0261.244] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.244] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.244] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238")) returned 1 [0261.244] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF") returned 0 [0261.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.245] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1220, lpOverlapped=0x0) returned 1 [0261.246] CloseHandle (hObject=0xdc) returned 1 [0261.246] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.247] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4048 [0261.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4050) returned 0x2c8700 [0261.247] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4048, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4048, lpOverlapped=0x0) returned 1 [0261.249] CloseHandle (hObject=0xdc) returned 1 [0261.249] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf")) returned 1 [0261.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.250] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.250] GetTickCount () returned 0x509fe [0261.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.250] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238\\....\\temporaryfile")) returned 0 [0261.251] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238\\temporaryfile")) returned 1 [0261.252] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.252] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.252] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.253] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.253] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.253] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.253] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.253] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238\\temporaryfile")) returned 1 [0261.253] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a713e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a713e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a713e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.253] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.253] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330238" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330238")) returned 1 [0261.253] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF") returned 0 [0261.254] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.254] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc760*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc760*, lpNumberOfBytesWritten=0x18fdd8*=0x4050, lpOverlapped=0x0) returned 1 [0261.255] CloseHandle (hObject=0xdc) returned 1 [0261.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.256] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x629 [0261.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x631) returned 0x259e70 [0261.256] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x629, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x629, lpOverlapped=0x0) returned 1 [0261.258] CloseHandle (hObject=0xdc) returned 1 [0261.258] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif")) returned 1 [0261.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.258] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.259] GetTickCount () returned 0x50a0e [0261.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.259] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254\\....\\temporaryfile")) returned 0 [0261.260] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254\\temporaryfile")) returned 1 [0261.261] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.261] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.261] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.261] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.261] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.261] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.261] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.261] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254\\temporaryfile")) returned 1 [0261.262] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.262] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.262] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254")) returned 1 [0261.262] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF") returned 0 [0261.262] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.263] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x630, lpOverlapped=0x0) returned 1 [0261.264] CloseHandle (hObject=0xdc) returned 1 [0261.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.264] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8628 [0261.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8630) returned 0x2c8700 [0261.264] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8628, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8628, lpOverlapped=0x0) returned 1 [0261.266] CloseHandle (hObject=0xdc) returned 1 [0261.266] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp")) returned 1 [0261.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.267] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.267] GetTickCount () returned 0x50a0e [0261.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.268] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254\\....\\temporaryfile")) returned 0 [0261.268] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254\\temporaryfile")) returned 1 [0261.270] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.270] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.270] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.270] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.270] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.270] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.270] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.270] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254\\temporaryfile")) returned 1 [0261.270] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0a97540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0a97540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0a97540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.270] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.270] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330254" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330254")) returned 1 [0261.271] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP") returned 0 [0261.271] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.272] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0d40*, nNumberOfBytesToWrite=0x8630, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0d40*, lpNumberOfBytesWritten=0x18fdd8*=0x8630, lpOverlapped=0x0) returned 1 [0261.273] CloseHandle (hObject=0xdc) returned 1 [0261.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.277] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7e90 [0261.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7e98) returned 0x2c8700 [0261.277] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7e90, lpOverlapped=0x0) returned 1 [0261.279] CloseHandle (hObject=0xdc) returned 1 [0261.279] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp")) returned 1 [0261.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.280] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.280] GetTickCount () returned 0x50a1d [0261.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.281] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.281] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330269\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330269\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330269\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330269\\....\\temporaryfile")) returned 0 [0261.281] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330269\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330269\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330269\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330269\\temporaryfile")) returned 1 [0261.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330269\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0abd6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0abd6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0abd6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0abd6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0abd6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0abd6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0abd6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0abd6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0abd6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.283] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330269\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0abd6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0abd6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0abd6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0abd6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0abd6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0abd6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0abd6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0abd6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0abd6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.283] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330269\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330269\\temporaryfile")) returned 1 [0261.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0abd6a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0abd6a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0abd6a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.283] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330269" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330269")) returned 1 [0261.283] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP") returned 0 [0261.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.285] WriteFile (in: hFile=0xdc, lpBuffer=0x2d05a8*, nNumberOfBytesToWrite=0x7e98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d05a8*, lpNumberOfBytesWritten=0x18fdd8*=0x7e98, lpOverlapped=0x0) returned 1 [0261.286] CloseHandle (hObject=0xdc) returned 1 [0261.286] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.287] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x211bb [0261.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x211c3) returned 0x2c8700 [0261.287] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x211bb, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x211bb, lpOverlapped=0x0) returned 1 [0261.290] CloseHandle (hObject=0xdc) returned 1 [0261.290] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg")) returned 1 [0261.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.292] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.292] GetTickCount () returned 0x50a2d [0261.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.292] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330285\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330285\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330285\\....\\temporaryfile")) returned 0 [0261.293] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330285\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330285\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330285\\temporaryfile")) returned 1 [0261.294] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330285\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ae3800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ae3800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ae3800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.294] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ae3800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ae3800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ae3800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.294] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ae3800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ae3800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ae3800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.294] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330285\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ae3800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ae3800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ae3800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.294] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ae3800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ae3800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ae3800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.295] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ae3800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ae3800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ae3800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.295] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.295] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330285\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330285\\temporaryfile")) returned 1 [0261.295] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ae3800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ae3800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ae3800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.295] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.295] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330285" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330285")) returned 1 [0261.295] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG") returned 0 [0261.297] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.298] WriteFile (in: hFile=0xdc, lpBuffer=0x2e98d8*, nNumberOfBytesToWrite=0x211c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e98d8*, lpNumberOfBytesWritten=0x18fdd8*=0x211c0, lpOverlapped=0x0) returned 1 [0261.300] CloseHandle (hObject=0xdc) returned 1 [0261.301] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.301] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa202 [0261.301] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa20a) returned 0x2c8700 [0261.301] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa202, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa202, lpOverlapped=0x0) returned 1 [0261.303] CloseHandle (hObject=0xdc) returned 1 [0261.303] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg")) returned 1 [0261.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.304] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.304] GetTickCount () returned 0x50a3c [0261.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.305] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.305] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.305] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300\\....\\temporaryfile")) returned 0 [0261.305] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300\\temporaryfile")) returned 1 [0261.306] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.307] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.307] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.307] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.307] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.307] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.307] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.307] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300\\temporaryfile")) returned 1 [0261.307] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.307] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.307] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300")) returned 1 [0261.307] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG") returned 0 [0261.308] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.309] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2920*, nNumberOfBytesToWrite=0xa208, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2920*, lpNumberOfBytesWritten=0x18fdd8*=0xa208, lpOverlapped=0x0) returned 1 [0261.310] CloseHandle (hObject=0xdc) returned 1 [0261.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.311] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18be [0261.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18c6) returned 0x2c4a70 [0261.311] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x18be, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x18be, lpOverlapped=0x0) returned 1 [0261.313] CloseHandle (hObject=0xdc) returned 1 [0261.313] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg")) returned 1 [0261.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.314] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.314] GetTickCount () returned 0x50a3c [0261.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.314] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.314] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300\\....\\temporaryfile")) returned 0 [0261.315] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300\\temporaryfile")) returned 1 [0261.316] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.316] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.316] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.316] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.317] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.317] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.317] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.317] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300\\temporaryfile")) returned 1 [0261.317] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b09960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b09960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b09960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.317] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.317] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330300" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330300")) returned 1 [0261.317] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG") returned 0 [0261.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.318] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x18c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x18c8, lpOverlapped=0x0) returned 1 [0261.319] CloseHandle (hObject=0xdc) returned 1 [0261.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.320] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c94 [0261.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c9c) returned 0x2c8700 [0261.320] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1c94, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1c94, lpOverlapped=0x0) returned 1 [0261.322] CloseHandle (hObject=0xdc) returned 1 [0261.322] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg")) returned 1 [0261.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.322] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.323] GetTickCount () returned 0x50a4c [0261.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.323] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316\\....\\temporaryfile")) returned 0 [0261.324] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316\\temporaryfile")) returned 1 [0261.325] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.325] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.325] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316\\temporaryfile")) returned 1 [0261.326] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.326] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.326] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316")) returned 1 [0261.326] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG") returned 0 [0261.326] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.327] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca3b0*, nNumberOfBytesToWrite=0x1c98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca3b0*, lpNumberOfBytesWritten=0x18fdd8*=0x1c98, lpOverlapped=0x0) returned 1 [0261.328] CloseHandle (hObject=0xdc) returned 1 [0261.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.328] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0261.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0261.328] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0261.330] CloseHandle (hObject=0xdc) returned 1 [0261.330] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp")) returned 1 [0261.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.331] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.331] GetTickCount () returned 0x50a4c [0261.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.332] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.332] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316\\....\\temporaryfile")) returned 0 [0261.332] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316\\temporaryfile")) returned 1 [0261.339] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b55c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b55c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.339] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b55c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b55c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.339] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.339] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.339] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.339] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.339] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.339] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316\\temporaryfile")) returned 1 [0261.339] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b2fac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b2fac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b2fac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.339] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.339] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330316" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330316")) returned 1 [0261.340] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP") returned 0 [0261.340] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.342] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0261.343] CloseHandle (hObject=0xdc) returned 1 [0261.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.344] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.344] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.346] CloseHandle (hObject=0xdc) returned 1 [0261.346] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp")) returned 1 [0261.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.347] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.347] GetTickCount () returned 0x50a5c [0261.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.347] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330332\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330332\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330332\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330332\\....\\temporaryfile")) returned 0 [0261.348] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330332\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330332\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330332\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330332\\temporaryfile")) returned 1 [0261.349] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330332\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b55c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b55c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b55c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.349] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b55c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b55c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b55c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.349] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b55c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b55c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b55c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.349] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330332\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b55c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b55c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b55c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.349] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b55c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b55c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b55c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.350] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b55c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b55c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b55c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.350] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.350] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330332\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330332\\temporaryfile")) returned 1 [0261.350] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b55c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b55c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b55c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.350] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.350] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330332" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330332")) returned 1 [0261.350] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP") returned 0 [0261.351] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.351] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.353] CloseHandle (hObject=0xdc) returned 1 [0261.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.354] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1764 [0261.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x176c) returned 0x2c4a70 [0261.354] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1764, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1764, lpOverlapped=0x0) returned 1 [0261.356] CloseHandle (hObject=0xdc) returned 1 [0261.356] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg")) returned 1 [0261.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.357] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.357] GetTickCount () returned 0x50a6b [0261.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.357] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.357] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330347\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330347\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.357] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330347\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330347\\....\\temporaryfile")) returned 0 [0261.358] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330347\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330347\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330347\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330347\\temporaryfile")) returned 1 [0261.359] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330347\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b7bd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b7bd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b7bd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.359] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b7bd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b7bd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b7bd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.359] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b7bd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b7bd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b7bd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.359] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330347\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b7bd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b7bd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b7bd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.359] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b7bd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b7bd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b7bd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.359] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b7bd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b7bd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b7bd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.359] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.359] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330347\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330347\\temporaryfile")) returned 1 [0261.360] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0b7bd80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0b7bd80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0b7bd80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.360] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.360] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330347" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330347")) returned 1 [0261.360] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG") returned 0 [0261.360] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.361] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1768, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1768, lpOverlapped=0x0) returned 1 [0261.362] CloseHandle (hObject=0xdc) returned 1 [0261.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.362] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c08 [0261.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c10) returned 0x2c8700 [0261.363] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7c08, lpOverlapped=0x0) returned 1 [0261.364] CloseHandle (hObject=0xdc) returned 1 [0261.365] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp")) returned 1 [0261.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.366] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.366] GetTickCount () returned 0x50a7b [0261.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.366] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.366] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363\\....\\temporaryfile")) returned 0 [0261.367] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363\\temporaryfile")) returned 1 [0261.368] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.368] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.368] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.368] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.368] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.369] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.369] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.369] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363\\temporaryfile")) returned 1 [0261.369] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.369] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.369] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363")) returned 1 [0261.369] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP") returned 0 [0261.370] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.370] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0320*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0320*, lpNumberOfBytesWritten=0x18fdd8*=0x7c10, lpOverlapped=0x0) returned 1 [0261.372] CloseHandle (hObject=0xdc) returned 1 [0261.372] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.373] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e55 [0261.373] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e5d) returned 0x2c8700 [0261.373] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1e55, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1e55, lpOverlapped=0x0) returned 1 [0261.375] CloseHandle (hObject=0xdc) returned 1 [0261.375] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif")) returned 1 [0261.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.376] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.376] GetTickCount () returned 0x50a7b [0261.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.376] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.376] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363\\....\\temporaryfile")) returned 0 [0261.377] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363\\temporaryfile")) returned 1 [0261.378] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.379] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.379] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.379] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.379] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.379] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.379] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.379] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363\\temporaryfile")) returned 1 [0261.379] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ba1ee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ba1ee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ba1ee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.379] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.379] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330363" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330363")) returned 1 [0261.379] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF") returned 0 [0261.380] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.380] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca570*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca570*, lpNumberOfBytesWritten=0x18fdd8*=0x1e60, lpOverlapped=0x0) returned 1 [0261.382] CloseHandle (hObject=0xdc) returned 1 [0261.382] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.382] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c08 [0261.383] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c10) returned 0x2c8700 [0261.383] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7c08, lpOverlapped=0x0) returned 1 [0261.384] CloseHandle (hObject=0xdc) returned 1 [0261.384] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp")) returned 1 [0261.385] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.386] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.386] GetTickCount () returned 0x50a8a [0261.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.386] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378\\....\\temporaryfile")) returned 0 [0261.387] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378\\temporaryfile")) returned 1 [0261.388] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bc8040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bc8040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bc8040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.388] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bc8040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bc8040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bc8040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.388] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bc8040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bc8040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bc8040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.388] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bc8040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bc8040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bc8040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.388] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bc8040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bc8040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bc8040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.388] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bc8040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bc8040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bc8040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.388] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.388] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378\\temporaryfile")) returned 1 [0261.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bc8040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bc8040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bc8040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.389] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.389] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378")) returned 1 [0261.389] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP") returned 0 [0261.390] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.390] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0320*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0320*, lpNumberOfBytesWritten=0x18fdd8*=0x7c10, lpOverlapped=0x0) returned 1 [0261.391] CloseHandle (hObject=0xdc) returned 1 [0261.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.393] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0261.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0261.393] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0261.395] CloseHandle (hObject=0xdc) returned 1 [0261.395] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp")) returned 1 [0261.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.396] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.396] GetTickCount () returned 0x50a8a [0261.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.396] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378\\....\\temporaryfile")) returned 0 [0261.397] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378\\temporaryfile")) returned 1 [0261.399] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bc8040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.399] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bc8040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.399] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.399] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.399] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.399] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.399] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378\\temporaryfile")) returned 1 [0261.399] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.399] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.399] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330378" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330378")) returned 1 [0261.399] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP") returned 0 [0261.400] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.401] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0261.402] CloseHandle (hObject=0xdc) returned 1 [0261.402] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.403] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.403] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.404] CloseHandle (hObject=0xdc) returned 1 [0261.404] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp")) returned 1 [0261.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.405] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.405] GetTickCount () returned 0x50a9a [0261.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.406] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330394\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330394\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330394\\....\\temporaryfile")) returned 0 [0261.407] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330394\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330394\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330394\\temporaryfile")) returned 1 [0261.408] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330394\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.408] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.408] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.408] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330394\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.408] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.408] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.408] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.409] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330394\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330394\\temporaryfile")) returned 1 [0261.409] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0bee1a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0bee1a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0bee1a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.409] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.409] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330394" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330394")) returned 1 [0261.409] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP") returned 0 [0261.410] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.410] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.412] CloseHandle (hObject=0xdc) returned 1 [0261.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.413] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0261.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0261.413] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0261.414] CloseHandle (hObject=0xdc) returned 1 [0261.415] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp")) returned 1 [0261.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.416] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.416] GetTickCount () returned 0x50aaa [0261.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.416] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410\\....\\temporaryfile")) returned 0 [0261.417] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410\\temporaryfile")) returned 1 [0261.418] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.418] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.419] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.419] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.419] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.419] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410\\temporaryfile")) returned 1 [0261.419] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.419] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.419] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410")) returned 1 [0261.419] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP") returned 0 [0261.420] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.420] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0261.422] CloseHandle (hObject=0xdc) returned 1 [0261.422] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.422] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.423] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.424] CloseHandle (hObject=0xdc) returned 1 [0261.424] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp")) returned 1 [0261.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.425] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.425] GetTickCount () returned 0x50aaa [0261.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.426] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410\\....\\temporaryfile")) returned 0 [0261.426] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410\\temporaryfile")) returned 1 [0261.428] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.428] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.428] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.428] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.428] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.428] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.428] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.428] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410\\temporaryfile")) returned 1 [0261.429] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c14300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c14300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c14300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.429] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330410" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330410")) returned 1 [0261.429] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP") returned 0 [0261.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.430] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.431] CloseHandle (hObject=0xdc) returned 1 [0261.432] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.432] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9abe [0261.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9ac6) returned 0x2c8700 [0261.432] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x9abe, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x9abe, lpOverlapped=0x0) returned 1 [0261.434] CloseHandle (hObject=0xdc) returned 1 [0261.434] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg")) returned 1 [0261.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.435] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.435] GetTickCount () returned 0x50ab9 [0261.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.436] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330425\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330425\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330425\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330425\\....\\temporaryfile")) returned 0 [0261.436] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330425\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330425\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330425\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330425\\temporaryfile")) returned 1 [0261.438] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330425\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c3a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c3a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c3a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.438] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c3a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c3a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c3a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.438] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c3a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c3a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c3a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.438] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330425\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c3a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c3a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c3a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.438] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c3a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c3a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c3a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.438] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c3a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c3a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c3a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.438] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330425\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330425\\temporaryfile")) returned 1 [0261.438] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c3a460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c3a460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c3a460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.438] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330425" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330425")) returned 1 [0261.438] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG") returned 0 [0261.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.440] WriteFile (in: hFile=0xdc, lpBuffer=0x2d21d8*, nNumberOfBytesToWrite=0x9ac8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d21d8*, lpNumberOfBytesWritten=0x18fdd8*=0x9ac8, lpOverlapped=0x0) returned 1 [0261.441] CloseHandle (hObject=0xdc) returned 1 [0261.442] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.442] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x451e [0261.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4526) returned 0x2c8700 [0261.442] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x451e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x451e, lpOverlapped=0x0) returned 1 [0261.444] CloseHandle (hObject=0xdc) returned 1 [0261.444] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg")) returned 1 [0261.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.445] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.445] GetTickCount () returned 0x50ac9 [0261.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.446] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.446] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.446] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441\\....\\temporaryfile")) returned 0 [0261.446] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441\\temporaryfile")) returned 1 [0261.448] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.448] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.448] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.448] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.448] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.448] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.448] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.448] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441\\temporaryfile")) returned 1 [0261.448] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.448] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.449] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441")) returned 1 [0261.449] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG") returned 0 [0261.449] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.450] WriteFile (in: hFile=0xdc, lpBuffer=0x2ccc38*, nNumberOfBytesToWrite=0x4528, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ccc38*, lpNumberOfBytesWritten=0x18fdd8*=0x4528, lpOverlapped=0x0) returned 1 [0261.451] CloseHandle (hObject=0xdc) returned 1 [0261.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.452] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.452] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.453] CloseHandle (hObject=0xdc) returned 1 [0261.453] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp")) returned 1 [0261.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.454] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.454] GetTickCount () returned 0x50ac9 [0261.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.455] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441\\....\\temporaryfile")) returned 0 [0261.456] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441\\temporaryfile")) returned 1 [0261.457] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.457] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.457] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.457] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.457] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.458] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441\\temporaryfile")) returned 1 [0261.458] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c605c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c605c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c605c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.458] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.458] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330441" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330441")) returned 1 [0261.458] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP") returned 0 [0261.459] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.460] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.461] CloseHandle (hObject=0xdc) returned 1 [0261.461] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.462] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0261.462] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0261.462] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0261.463] CloseHandle (hObject=0xdc) returned 1 [0261.463] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp")) returned 1 [0261.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.465] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.465] GetTickCount () returned 0x50ad8 [0261.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.465] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330456\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330456\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330456\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330456\\....\\temporaryfile")) returned 0 [0261.466] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330456\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330456\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330456\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330456\\temporaryfile")) returned 1 [0261.467] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330456\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c86720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c86720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c86720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.467] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c86720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c86720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c86720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.467] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c86720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c86720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c86720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.467] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330456\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c86720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c86720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c86720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.467] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c86720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c86720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c86720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.467] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c86720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c86720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c86720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.467] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.467] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330456\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330456\\temporaryfile")) returned 1 [0261.468] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0c86720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0c86720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0c86720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.468] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.468] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330456" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330456")) returned 1 [0261.468] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP") returned 0 [0261.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.469] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0261.471] CloseHandle (hObject=0xdc) returned 1 [0261.471] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.475] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6afc [0261.475] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6b04) returned 0x2c8700 [0261.475] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6afc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6afc, lpOverlapped=0x0) returned 1 [0261.476] CloseHandle (hObject=0xdc) returned 1 [0261.476] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg")) returned 1 [0261.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.477] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.477] GetTickCount () returned 0x50ae8 [0261.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.477] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.478] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.478] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330472\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330472\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.478] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330472\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330472\\....\\temporaryfile")) returned 0 [0261.478] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330472\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330472\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330472\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330472\\temporaryfile")) returned 1 [0261.480] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330472\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cac880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cac880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cac880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cac880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cac880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cac880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cac880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cac880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cac880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.480] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330472\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cac880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cac880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cac880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cac880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cac880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cac880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.480] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cac880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cac880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cac880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.480] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.480] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330472\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330472\\temporaryfile")) returned 1 [0261.480] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cac880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cac880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cac880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.480] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.480] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330472" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330472")) returned 1 [0261.481] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG") returned 0 [0261.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.482] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf218*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf218*, lpNumberOfBytesWritten=0x18fdd8*=0x6b00, lpOverlapped=0x0) returned 1 [0261.483] CloseHandle (hObject=0xdc) returned 1 [0261.488] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.489] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.489] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.490] CloseHandle (hObject=0xdc) returned 1 [0261.491] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp")) returned 1 [0261.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.492] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.492] GetTickCount () returned 0x50af8 [0261.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.492] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.492] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488\\....\\temporaryfile")) returned 0 [0261.493] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488\\temporaryfile")) returned 1 [0261.494] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.494] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.494] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.494] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.494] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.494] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.494] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.494] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488\\temporaryfile")) returned 1 [0261.495] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.495] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.495] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488")) returned 1 [0261.495] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP") returned 0 [0261.496] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.496] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.497] CloseHandle (hObject=0xdc) returned 1 [0261.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.498] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.498] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.500] CloseHandle (hObject=0xdc) returned 1 [0261.500] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp")) returned 1 [0261.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.501] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.501] GetTickCount () returned 0x50af8 [0261.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.501] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488\\....\\temporaryfile")) returned 0 [0261.502] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488\\temporaryfile")) returned 1 [0261.503] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.504] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.504] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.504] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.504] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.504] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.504] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.504] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488\\temporaryfile")) returned 1 [0261.504] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cd29e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cd29e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cd29e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.504] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.504] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330488" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330488")) returned 1 [0261.504] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP") returned 0 [0261.505] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.506] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.507] CloseHandle (hObject=0xdc) returned 1 [0261.507] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.508] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7297 [0261.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x729f) returned 0x2c8700 [0261.508] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7297, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7297, lpOverlapped=0x0) returned 1 [0261.509] CloseHandle (hObject=0xdc) returned 1 [0261.510] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg")) returned 1 [0261.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.511] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.511] GetTickCount () returned 0x50b07 [0261.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.511] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.511] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503\\....\\temporaryfile")) returned 0 [0261.512] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503\\temporaryfile")) returned 1 [0261.513] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.513] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.513] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.513] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.513] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.513] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.513] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.513] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503\\temporaryfile")) returned 1 [0261.514] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.514] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.514] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503")) returned 1 [0261.514] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG") returned 0 [0261.514] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.515] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf9b0*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf9b0*, lpNumberOfBytesWritten=0x18fdd8*=0x72a0, lpOverlapped=0x0) returned 1 [0261.516] CloseHandle (hObject=0xdc) returned 1 [0261.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.517] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0261.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0261.517] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0261.519] CloseHandle (hObject=0xdc) returned 1 [0261.519] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp")) returned 1 [0261.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.520] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.520] GetTickCount () returned 0x50b07 [0261.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.520] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.520] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503\\....\\temporaryfile")) returned 0 [0261.521] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503\\temporaryfile")) returned 1 [0261.523] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d1eca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d1eca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.523] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d1eca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d1eca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.523] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.523] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.523] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.523] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.523] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.523] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503\\temporaryfile")) returned 1 [0261.523] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0cf8b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0cf8b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0cf8b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.523] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.523] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330503" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330503")) returned 1 [0261.524] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP") returned 0 [0261.524] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.525] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0261.526] CloseHandle (hObject=0xdc) returned 1 [0261.526] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.528] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.528] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.528] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.530] CloseHandle (hObject=0xdc) returned 1 [0261.530] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp")) returned 1 [0261.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.531] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.531] GetTickCount () returned 0x50b17 [0261.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.532] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330519\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330519\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330519\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330519\\....\\temporaryfile")) returned 0 [0261.532] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330519\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330519\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330519\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330519\\temporaryfile")) returned 1 [0261.534] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330519\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d1eca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d1eca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d1eca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.534] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d1eca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d1eca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d1eca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.534] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d1eca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d1eca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d1eca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.534] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330519\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d1eca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d1eca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d1eca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.534] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d1eca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d1eca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d1eca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.534] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d1eca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d1eca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d1eca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.534] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330519\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330519\\temporaryfile")) returned 1 [0261.534] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d1eca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d1eca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d1eca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.534] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.534] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330519" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330519")) returned 1 [0261.535] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP") returned 0 [0261.535] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.536] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.537] CloseHandle (hObject=0xdc) returned 1 [0261.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.540] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.540] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.542] CloseHandle (hObject=0xdc) returned 1 [0261.542] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp")) returned 1 [0261.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.543] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.543] GetTickCount () returned 0x50b26 [0261.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.543] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.544] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330534\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330534\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330534\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330534\\....\\temporaryfile")) returned 0 [0261.544] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330534\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330534\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330534\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330534\\temporaryfile")) returned 1 [0261.545] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330534\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d44e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d44e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d44e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.545] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d44e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d44e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d44e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.545] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d44e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d44e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d44e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.546] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330534\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d44e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d44e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d44e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.546] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d44e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d44e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d44e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.546] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d44e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d44e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d44e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.546] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.546] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330534\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330534\\temporaryfile")) returned 1 [0261.546] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d44e00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d44e00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d44e00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.546] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.546] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330534" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330534")) returned 1 [0261.546] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP") returned 0 [0261.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.547] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.549] CloseHandle (hObject=0xdc) returned 1 [0261.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.550] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0261.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0261.550] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0261.551] CloseHandle (hObject=0xdc) returned 1 [0261.551] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp")) returned 1 [0261.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.553] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.553] GetTickCount () returned 0x50b36 [0261.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.553] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.553] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550\\....\\temporaryfile")) returned 0 [0261.554] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550\\temporaryfile")) returned 1 [0261.555] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.555] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.555] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.555] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.555] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.555] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.555] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.555] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550\\temporaryfile")) returned 1 [0261.556] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.556] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.556] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550")) returned 1 [0261.556] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP") returned 0 [0261.557] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.557] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0261.559] CloseHandle (hObject=0xdc) returned 1 [0261.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.559] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7db8 [0261.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7dc0) returned 0x2c8700 [0261.559] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7db8, lpOverlapped=0x0) returned 1 [0261.561] CloseHandle (hObject=0xdc) returned 1 [0261.561] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp")) returned 1 [0261.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.562] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.562] GetTickCount () returned 0x50b36 [0261.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.563] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.563] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550\\....\\temporaryfile")) returned 0 [0261.563] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550\\temporaryfile")) returned 1 [0261.565] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.565] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.565] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.565] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.565] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.565] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.565] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.565] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550\\temporaryfile")) returned 1 [0261.565] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d6af60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d6af60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d6af60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.565] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.566] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330550" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330550")) returned 1 [0261.566] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP") returned 0 [0261.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.567] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04d0*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04d0*, lpNumberOfBytesWritten=0x18fdd8*=0x7dc0, lpOverlapped=0x0) returned 1 [0261.568] CloseHandle (hObject=0xdc) returned 1 [0261.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.569] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.569] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.569] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.571] CloseHandle (hObject=0xdc) returned 1 [0261.571] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp")) returned 1 [0261.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.572] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.572] GetTickCount () returned 0x50b46 [0261.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.572] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566\\....\\temporaryfile")) returned 0 [0261.573] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566\\temporaryfile")) returned 1 [0261.574] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.574] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.574] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.574] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.575] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.575] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.575] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.575] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566\\temporaryfile")) returned 1 [0261.575] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.575] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.575] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566")) returned 1 [0261.575] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP") returned 0 [0261.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.576] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.578] CloseHandle (hObject=0xdc) returned 1 [0261.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.578] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xdd5 [0261.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xddd) returned 0x2450048 [0261.578] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xdd5, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xdd5, lpOverlapped=0x0) returned 1 [0261.580] CloseHandle (hObject=0xdc) returned 1 [0261.580] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg")) returned 1 [0261.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.581] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.581] GetTickCount () returned 0x50b46 [0261.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.582] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566\\....\\temporaryfile")) returned 0 [0261.582] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566\\temporaryfile")) returned 1 [0261.583] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.584] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.584] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.584] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.584] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.584] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.584] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.584] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566\\temporaryfile")) returned 1 [0261.584] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0d910c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0d910c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0d910c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.584] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.584] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330566" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330566")) returned 1 [0261.585] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG") returned 0 [0261.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.586] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xde0, lpOverlapped=0x0) returned 1 [0261.587] CloseHandle (hObject=0xdc) returned 1 [0261.587] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.587] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.587] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.589] CloseHandle (hObject=0xdc) returned 1 [0261.589] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp")) returned 1 [0261.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.590] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.590] GetTickCount () returned 0x50b55 [0261.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.591] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330581\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330581\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330581\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330581\\....\\temporaryfile")) returned 0 [0261.591] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330581\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330581\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330581\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330581\\temporaryfile")) returned 1 [0261.592] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330581\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0db7220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0db7220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0db7220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0db7220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0db7220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0db7220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0db7220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0db7220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0db7220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.593] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330581\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0db7220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0db7220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0db7220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.593] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0db7220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0db7220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0db7220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.593] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0db7220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0db7220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0db7220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.593] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.593] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330581\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330581\\temporaryfile")) returned 1 [0261.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0db7220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0db7220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0db7220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.593] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.593] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330581" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330581")) returned 1 [0261.593] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP") returned 0 [0261.594] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.595] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.596] CloseHandle (hObject=0xdc) returned 1 [0261.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.597] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c08 [0261.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c10) returned 0x2c8700 [0261.597] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7c08, lpOverlapped=0x0) returned 1 [0261.599] CloseHandle (hObject=0xdc) returned 1 [0261.599] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp")) returned 1 [0261.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.600] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.600] GetTickCount () returned 0x50b65 [0261.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.601] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597\\....\\temporaryfile")) returned 0 [0261.601] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597\\temporaryfile")) returned 1 [0261.602] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.602] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.603] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.603] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.603] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.603] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.603] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.603] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597\\temporaryfile")) returned 1 [0261.603] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.603] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.603] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597")) returned 1 [0261.603] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP") returned 0 [0261.604] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.605] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0320*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0320*, lpNumberOfBytesWritten=0x18fdd8*=0x7c10, lpOverlapped=0x0) returned 1 [0261.606] CloseHandle (hObject=0xdc) returned 1 [0261.606] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.607] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x48fc [0261.607] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4904) returned 0x2c8700 [0261.607] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x48fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x48fc, lpOverlapped=0x0) returned 1 [0261.609] CloseHandle (hObject=0xdc) returned 1 [0261.609] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp")) returned 1 [0261.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.610] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.610] GetTickCount () returned 0x50b65 [0261.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.610] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.610] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597\\....\\temporaryfile")) returned 0 [0261.611] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597\\temporaryfile")) returned 1 [0261.612] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.612] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.612] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.612] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.613] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.613] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.613] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.613] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597\\temporaryfile")) returned 1 [0261.613] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ddd380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ddd380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ddd380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.613] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.613] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330597" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330597")) returned 1 [0261.613] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP") returned 0 [0261.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.614] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd018*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd018*, lpNumberOfBytesWritten=0x18fdd8*=0x4900, lpOverlapped=0x0) returned 1 [0261.621] CloseHandle (hObject=0xdc) returned 1 [0261.621] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.622] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.622] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.622] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.624] CloseHandle (hObject=0xdc) returned 1 [0261.624] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp")) returned 1 [0261.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.625] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.625] GetTickCount () returned 0x50b74 [0261.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.626] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330612\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330612\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330612\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330612\\....\\temporaryfile")) returned 0 [0261.626] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330612\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330612\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330612\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330612\\temporaryfile")) returned 1 [0261.627] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330612\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e034e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e034e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e034e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.628] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e034e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e034e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e034e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.628] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e034e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e034e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e034e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.628] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330612\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e034e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e034e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e034e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.628] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e034e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e034e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e034e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.628] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e034e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e034e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e034e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.628] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.628] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330612\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330612\\temporaryfile")) returned 1 [0261.628] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e034e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e034e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e034e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.628] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.628] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330612" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330612")) returned 1 [0261.628] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP") returned 0 [0261.629] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.630] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.631] CloseHandle (hObject=0xdc) returned 1 [0261.632] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.632] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8499 [0261.632] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x84a1) returned 0x2c8700 [0261.632] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8499, lpOverlapped=0x0) returned 1 [0261.634] CloseHandle (hObject=0xdc) returned 1 [0261.634] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg")) returned 1 [0261.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.640] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.640] GetTickCount () returned 0x50b84 [0261.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.641] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330628\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330628\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330628\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330628\\....\\temporaryfile")) returned 0 [0261.641] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330628\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330628\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330628\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330628\\temporaryfile")) returned 1 [0261.643] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330628\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e29640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e29640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e29640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.643] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e29640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e29640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e29640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.643] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e29640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e29640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e29640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.643] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330628\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e29640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e29640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e29640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.643] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e29640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e29640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e29640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.643] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e29640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e29640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e29640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.643] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.643] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330628\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330628\\temporaryfile")) returned 1 [0261.643] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e29640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e29640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e29640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.644] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.644] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330628" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330628")) returned 1 [0261.644] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG") returned 0 [0261.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.645] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0bb8*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0bb8*, lpNumberOfBytesWritten=0x18fdd8*=0x84a0, lpOverlapped=0x0) returned 1 [0261.647] CloseHandle (hObject=0xdc) returned 1 [0261.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.647] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x639b [0261.647] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x63a3) returned 0x2c8700 [0261.648] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x639b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x639b, lpOverlapped=0x0) returned 1 [0261.649] CloseHandle (hObject=0xdc) returned 1 [0261.649] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif")) returned 1 [0261.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.650] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.650] GetTickCount () returned 0x50b94 [0261.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.650] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.651] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644\\....\\temporaryfile")) returned 0 [0261.651] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644\\temporaryfile")) returned 1 [0261.653] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.653] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.653] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.653] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.653] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.653] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.653] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.653] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644\\temporaryfile")) returned 1 [0261.653] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.653] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.653] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644")) returned 1 [0261.653] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF") returned 0 [0261.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.655] WriteFile (in: hFile=0xdc, lpBuffer=0x2ceab8*, nNumberOfBytesToWrite=0x63a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ceab8*, lpNumberOfBytesWritten=0x18fdd8*=0x63a0, lpOverlapped=0x0) returned 1 [0261.656] CloseHandle (hObject=0xdc) returned 1 [0261.656] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.657] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7e90 [0261.657] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7e98) returned 0x2c8700 [0261.657] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7e90, lpOverlapped=0x0) returned 1 [0261.658] CloseHandle (hObject=0xdc) returned 1 [0261.658] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp")) returned 1 [0261.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.659] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.659] GetTickCount () returned 0x50b94 [0261.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.660] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644\\....\\temporaryfile")) returned 0 [0261.661] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644\\temporaryfile")) returned 1 [0261.662] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.662] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.662] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.662] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.662] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.662] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.662] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.663] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644\\temporaryfile")) returned 1 [0261.663] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e4f7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e4f7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e4f7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.663] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.663] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330644" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330644")) returned 1 [0261.663] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP") returned 0 [0261.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.664] WriteFile (in: hFile=0xdc, lpBuffer=0x2d05a8*, nNumberOfBytesToWrite=0x7e98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d05a8*, lpNumberOfBytesWritten=0x18fdd8*=0x7e98, lpOverlapped=0x0) returned 1 [0261.666] CloseHandle (hObject=0xdc) returned 1 [0261.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.666] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8118 [0261.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8120) returned 0x2c8700 [0261.666] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8118, lpOverlapped=0x0) returned 1 [0261.670] CloseHandle (hObject=0xdc) returned 1 [0261.670] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp")) returned 1 [0261.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.671] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.671] GetTickCount () returned 0x50ba3 [0261.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.671] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330659\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330659\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330659\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330659\\....\\temporaryfile")) returned 0 [0261.672] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330659\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330659\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330659\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330659\\temporaryfile")) returned 1 [0261.673] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330659\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e75900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e75900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e75900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.673] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e75900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e75900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e75900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.673] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e75900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e75900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e75900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.674] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330659\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e75900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e75900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e75900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.674] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e75900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e75900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e75900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.674] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e75900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e75900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e75900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.674] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.674] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330659\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330659\\temporaryfile")) returned 1 [0261.674] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e75900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e75900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e75900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.674] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.674] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330659" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330659")) returned 1 [0261.674] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP") returned 0 [0261.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.676] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0830*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0830*, lpNumberOfBytesWritten=0x18fdd8*=0x8120, lpOverlapped=0x0) returned 1 [0261.677] CloseHandle (hObject=0xdc) returned 1 [0261.677] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.678] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5f2b [0261.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5f33) returned 0x2c8700 [0261.678] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5f2b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5f2b, lpOverlapped=0x0) returned 1 [0261.680] CloseHandle (hObject=0xdc) returned 1 [0261.680] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif")) returned 1 [0261.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.681] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.681] GetTickCount () returned 0x50bb3 [0261.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.682] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675\\....\\temporaryfile")) returned 0 [0261.682] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675\\temporaryfile")) returned 1 [0261.684] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.684] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.684] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.684] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.684] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.684] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.684] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.684] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675\\temporaryfile")) returned 1 [0261.684] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.684] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.684] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675")) returned 1 [0261.685] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF") returned 0 [0261.685] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.686] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce648*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce648*, lpNumberOfBytesWritten=0x18fdd8*=0x5f30, lpOverlapped=0x0) returned 1 [0261.687] CloseHandle (hObject=0xdc) returned 1 [0261.687] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.688] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7f68 [0261.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7f70) returned 0x2c8700 [0261.688] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7f68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7f68, lpOverlapped=0x0) returned 1 [0261.690] CloseHandle (hObject=0xdc) returned 1 [0261.690] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp")) returned 1 [0261.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.691] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.691] GetTickCount () returned 0x50bb3 [0261.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.692] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675\\....\\temporaryfile")) returned 0 [0261.693] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675\\temporaryfile")) returned 1 [0261.694] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.694] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.694] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.694] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.694] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.694] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675\\temporaryfile")) returned 1 [0261.695] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0e9ba60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0e9ba60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0e9ba60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.695] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.695] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330675" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330675")) returned 1 [0261.695] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP") returned 0 [0261.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.696] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0680*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0680*, lpNumberOfBytesWritten=0x18fdd8*=0x7f70, lpOverlapped=0x0) returned 1 [0261.697] CloseHandle (hObject=0xdc) returned 1 [0261.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.698] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x50a5 [0261.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x50ad) returned 0x2c8700 [0261.698] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x50a5, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x50a5, lpOverlapped=0x0) returned 1 [0261.700] CloseHandle (hObject=0xdc) returned 1 [0261.700] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif")) returned 1 [0261.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.701] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.701] GetTickCount () returned 0x50bc2 [0261.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.702] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330690\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330690\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330690\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330690\\....\\temporaryfile")) returned 0 [0261.703] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330690\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330690\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330690\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330690\\temporaryfile")) returned 1 [0261.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330690\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ec1bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ec1bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ec1bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ec1bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ec1bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ec1bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ec1bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ec1bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ec1bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330690\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ec1bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ec1bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ec1bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.704] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ec1bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ec1bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ec1bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.704] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ec1bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ec1bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ec1bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.704] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330690\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330690\\temporaryfile")) returned 1 [0261.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ec1bc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ec1bc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ec1bc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.705] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.705] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330690" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330690")) returned 1 [0261.705] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF") returned 0 [0261.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.706] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd7c0*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd7c0*, lpNumberOfBytesWritten=0x18fdd8*=0x50b0, lpOverlapped=0x0) returned 1 [0261.707] CloseHandle (hObject=0xdc) returned 1 [0261.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.708] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ce0 [0261.708] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ce8) returned 0x2c8700 [0261.708] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ce0, lpOverlapped=0x0) returned 1 [0261.710] CloseHandle (hObject=0xdc) returned 1 [0261.710] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp")) returned 1 [0261.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.711] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.711] GetTickCount () returned 0x50bd2 [0261.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.711] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.712] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.712] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706\\....\\temporaryfile")) returned 0 [0261.712] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706\\temporaryfile")) returned 1 [0261.713] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.713] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.714] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.714] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.714] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.714] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.714] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706\\temporaryfile")) returned 1 [0261.714] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.714] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.714] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706")) returned 1 [0261.714] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP") returned 0 [0261.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.716] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03f8*, nNumberOfBytesToWrite=0x7ce8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03f8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ce8, lpOverlapped=0x0) returned 1 [0261.717] CloseHandle (hObject=0xdc) returned 1 [0261.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.718] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6d86 [0261.718] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6d8e) returned 0x2c8700 [0261.718] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6d86, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6d86, lpOverlapped=0x0) returned 1 [0261.719] CloseHandle (hObject=0xdc) returned 1 [0261.719] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif")) returned 1 [0261.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.720] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.720] GetTickCount () returned 0x50bd2 [0261.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.721] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706\\....\\temporaryfile")) returned 0 [0261.722] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706\\temporaryfile")) returned 1 [0261.723] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.723] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.723] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.723] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.723] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.723] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.723] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706\\temporaryfile")) returned 1 [0261.724] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ee7d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ee7d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ee7d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.724] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.724] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330706" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330706")) returned 1 [0261.724] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF") returned 0 [0261.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.726] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf4a0*, nNumberOfBytesToWrite=0x6d90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf4a0*, lpNumberOfBytesWritten=0x18fdd8*=0x6d90, lpOverlapped=0x0) returned 1 [0261.727] CloseHandle (hObject=0xdc) returned 1 [0261.727] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.728] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5e7b [0261.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5e83) returned 0x2c8700 [0261.728] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x5e7b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x5e7b, lpOverlapped=0x0) returned 1 [0261.729] CloseHandle (hObject=0xdc) returned 1 [0261.729] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif")) returned 1 [0261.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.730] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.730] GetTickCount () returned 0x50be2 [0261.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.731] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.731] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330722\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330722\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330722\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330722\\....\\temporaryfile")) returned 0 [0261.731] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330722\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330722\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330722\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330722\\temporaryfile")) returned 1 [0261.733] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330722\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f0de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f0de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f0de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f0de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f0de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f0de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f0de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f0de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f0de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.733] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330722\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f0de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f0de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f0de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.733] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f0de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f0de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f0de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.733] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f0de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f0de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f0de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.733] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.733] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330722\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330722\\temporaryfile")) returned 1 [0261.733] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f0de80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f0de80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f0de80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.733] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.733] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330722" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330722")) returned 1 [0261.734] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF") returned 0 [0261.734] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.735] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce598*, nNumberOfBytesToWrite=0x5e80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce598*, lpNumberOfBytesWritten=0x18fdd8*=0x5e80, lpOverlapped=0x0) returned 1 [0261.736] CloseHandle (hObject=0xdc) returned 1 [0261.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.737] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7d84 [0261.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7d8c) returned 0x2c8700 [0261.738] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7d84, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7d84, lpOverlapped=0x0) returned 1 [0261.739] CloseHandle (hObject=0xdc) returned 1 [0261.739] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp")) returned 1 [0261.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.740] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.740] GetTickCount () returned 0x50bf1 [0261.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.740] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.741] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.741] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737\\....\\temporaryfile")) returned 0 [0261.741] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737\\temporaryfile")) returned 1 [0261.743] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.743] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.743] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.743] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.743] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.743] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.743] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.743] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737\\temporaryfile")) returned 1 [0261.743] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.743] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.743] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737")) returned 1 [0261.744] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP") returned 0 [0261.744] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.745] WriteFile (in: hFile=0xdc, lpBuffer=0x2d04a0*, nNumberOfBytesToWrite=0x7d88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d04a0*, lpNumberOfBytesWritten=0x18fdd8*=0x7d88, lpOverlapped=0x0) returned 1 [0261.746] CloseHandle (hObject=0xdc) returned 1 [0261.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.747] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6090 [0261.747] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6098) returned 0x2c8700 [0261.747] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6090, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6090, lpOverlapped=0x0) returned 1 [0261.749] CloseHandle (hObject=0xdc) returned 1 [0261.749] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif")) returned 1 [0261.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.750] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.750] GetTickCount () returned 0x50bf1 [0261.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.750] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737\\....\\temporaryfile")) returned 0 [0261.751] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737\\temporaryfile")) returned 1 [0261.752] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.753] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.753] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.753] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.753] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.753] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.753] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.753] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737\\temporaryfile")) returned 1 [0261.753] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f33fe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f33fe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f33fe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.753] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.753] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330737" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330737")) returned 1 [0261.753] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF") returned 0 [0261.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.755] WriteFile (in: hFile=0xdc, lpBuffer=0x2ce7a8*, nNumberOfBytesToWrite=0x6098, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ce7a8*, lpNumberOfBytesWritten=0x18fdd8*=0x6098, lpOverlapped=0x0) returned 1 [0261.756] CloseHandle (hObject=0xdc) returned 1 [0261.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.757] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7e90 [0261.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7e98) returned 0x2c8700 [0261.757] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7e90, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7e90, lpOverlapped=0x0) returned 1 [0261.759] CloseHandle (hObject=0xdc) returned 1 [0261.759] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp")) returned 1 [0261.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.760] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.760] GetTickCount () returned 0x50c01 [0261.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.760] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753\\....\\temporaryfile")) returned 0 [0261.761] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753\\temporaryfile")) returned 1 [0261.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.762] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.762] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.762] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.762] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.763] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753\\temporaryfile")) returned 1 [0261.763] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.763] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.763] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753")) returned 1 [0261.763] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP") returned 0 [0261.764] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.764] WriteFile (in: hFile=0xdc, lpBuffer=0x2d05a8*, nNumberOfBytesToWrite=0x7e98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d05a8*, lpNumberOfBytesWritten=0x18fdd8*=0x7e98, lpOverlapped=0x0) returned 1 [0261.766] CloseHandle (hObject=0xdc) returned 1 [0261.766] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.766] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8795 [0261.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x879d) returned 0x2c8700 [0261.766] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8795, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8795, lpOverlapped=0x0) returned 1 [0261.768] CloseHandle (hObject=0xdc) returned 1 [0261.768] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif")) returned 1 [0261.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.769] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.769] GetTickCount () returned 0x50c01 [0261.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.769] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.770] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753\\....\\temporaryfile")) returned 0 [0261.771] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753\\temporaryfile")) returned 1 [0261.772] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.772] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.772] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.772] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.772] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.773] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.773] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753\\temporaryfile")) returned 1 [0261.773] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f5a140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f5a140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f5a140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.773] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.773] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330753" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330753")) returned 1 [0261.773] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF") returned 0 [0261.774] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.774] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0eb0*, nNumberOfBytesToWrite=0x87a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0eb0*, lpNumberOfBytesWritten=0x18fdd8*=0x87a0, lpOverlapped=0x0) returned 1 [0261.776] CloseHandle (hObject=0xdc) returned 1 [0261.776] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.777] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8118 [0261.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8120) returned 0x2c8700 [0261.777] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8118, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8118, lpOverlapped=0x0) returned 1 [0261.779] CloseHandle (hObject=0xdc) returned 1 [0261.779] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp")) returned 1 [0261.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.780] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.780] GetTickCount () returned 0x50c10 [0261.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.780] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.781] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330768\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330768\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330768\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330768\\....\\temporaryfile")) returned 0 [0261.782] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330768\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330768\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330768\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330768\\temporaryfile")) returned 1 [0261.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330768\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f802a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f802a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f802a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f802a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f802a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f802a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f802a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f802a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f802a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330768\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f802a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f802a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f802a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.788] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f802a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f802a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f802a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.788] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f802a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f802a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f802a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.789] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330768\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330768\\temporaryfile")) returned 1 [0261.789] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0f802a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0f802a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0f802a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.789] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330768" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330768")) returned 1 [0261.789] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP") returned 0 [0261.790] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.790] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0830*, nNumberOfBytesToWrite=0x8120, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0830*, lpNumberOfBytesWritten=0x18fdd8*=0x8120, lpOverlapped=0x0) returned 1 [0261.792] CloseHandle (hObject=0xdc) returned 1 [0261.792] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.793] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x64c7 [0261.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x64cf) returned 0x2c8700 [0261.793] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x64c7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x64c7, lpOverlapped=0x0) returned 1 [0261.794] CloseHandle (hObject=0xdc) returned 1 [0261.794] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif")) returned 1 [0261.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.796] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.796] GetTickCount () returned 0x50c20 [0261.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.796] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330784\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330784\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.796] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330784\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330784\\....\\temporaryfile")) returned 0 [0261.797] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330784\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330784\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330784\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330784\\temporaryfile")) returned 1 [0261.798] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330784\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fa6400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fa6400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fa6400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.798] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fa6400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fa6400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fa6400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.798] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fa6400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fa6400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fa6400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.798] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330784\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fa6400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fa6400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fa6400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.798] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fa6400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fa6400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fa6400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.798] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fa6400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fa6400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fa6400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.798] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330784\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330784\\temporaryfile")) returned 1 [0261.799] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fa6400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fa6400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fa6400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.799] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.799] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330784" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330784")) returned 1 [0261.799] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF") returned 0 [0261.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.800] WriteFile (in: hFile=0xdc, lpBuffer=0x2cebe0*, nNumberOfBytesToWrite=0x64d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cebe0*, lpNumberOfBytesWritten=0x18fdd8*=0x64d0, lpOverlapped=0x0) returned 1 [0261.801] CloseHandle (hObject=0xdc) returned 1 [0261.802] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.802] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16f40 [0261.802] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16f48) returned 0x2c8700 [0261.802] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x16f40, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x16f40, lpOverlapped=0x0) returned 1 [0261.805] CloseHandle (hObject=0xdc) returned 1 [0261.805] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp")) returned 1 [0261.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.806] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.806] GetTickCount () returned 0x50c30 [0261.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.807] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800\\....\\temporaryfile")) returned 0 [0261.807] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800\\temporaryfile")) returned 1 [0261.809] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fcc560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fcc560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fcc560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.809] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fcc560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fcc560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fcc560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.809] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fcc560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fcc560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fcc560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.809] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fcc560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fcc560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fcc560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.809] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fcc560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fcc560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fcc560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.809] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fcc560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fcc560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fcc560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.809] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.809] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800\\temporaryfile")) returned 1 [0261.809] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0fcc560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0fcc560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0fcc560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.809] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.809] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800")) returned 1 [0261.809] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP") returned 0 [0261.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.812] WriteFile (in: hFile=0xdc, lpBuffer=0x2df658*, nNumberOfBytesToWrite=0x16f48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2df658*, lpNumberOfBytesWritten=0x18fdd8*=0x16f48, lpOverlapped=0x0) returned 1 [0261.814] CloseHandle (hObject=0xdc) returned 1 [0261.814] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.814] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc382 [0261.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc38a) returned 0x2c8700 [0261.814] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xc382, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xc382, lpOverlapped=0x0) returned 1 [0261.816] CloseHandle (hObject=0xdc) returned 1 [0261.816] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif")) returned 1 [0261.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.817] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.817] GetTickCount () returned 0x50c30 [0261.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.818] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.818] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800\\....\\temporaryfile")) returned 0 [0261.819] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800\\temporaryfile")) returned 1 [0261.820] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.820] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.820] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.820] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.820] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.820] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.820] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.820] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800\\temporaryfile")) returned 1 [0261.821] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.821] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.821] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330800" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330800")) returned 1 [0261.821] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF") returned 0 [0261.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.822] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4aa0*, nNumberOfBytesToWrite=0xc388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4aa0*, lpNumberOfBytesWritten=0x18fdd8*=0xc388, lpOverlapped=0x0) returned 1 [0261.824] CloseHandle (hObject=0xdc) returned 1 [0261.824] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.825] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c08 [0261.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c10) returned 0x2c8700 [0261.825] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7c08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7c08, lpOverlapped=0x0) returned 1 [0261.827] CloseHandle (hObject=0xdc) returned 1 [0261.827] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp")) returned 1 [0261.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.828] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.828] GetTickCount () returned 0x50c3f [0261.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.828] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330815\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330815\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330815\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330815\\....\\temporaryfile")) returned 0 [0261.829] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330815\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330815\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330815\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330815\\temporaryfile")) returned 1 [0261.830] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330815\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.830] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.831] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.831] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330815\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.831] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.831] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.831] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.831] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330815\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330815\\temporaryfile")) returned 1 [0261.831] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa0ff26c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa0ff26c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa0ff26c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.831] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.831] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330815" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330815")) returned 1 [0261.831] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP") returned 0 [0261.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.833] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0320*, nNumberOfBytesToWrite=0x7c10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0320*, lpNumberOfBytesWritten=0x18fdd8*=0x7c10, lpOverlapped=0x0) returned 1 [0261.834] CloseHandle (hObject=0xdc) returned 1 [0261.834] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.836] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a6b8 [0261.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a6c0) returned 0x2c8700 [0261.836] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1a6b8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1a6b8, lpOverlapped=0x0) returned 1 [0261.838] CloseHandle (hObject=0xdc) returned 1 [0261.838] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp")) returned 1 [0261.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.840] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.840] GetTickCount () returned 0x50c4f [0261.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.840] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.840] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330831\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330831\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330831\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330831\\....\\temporaryfile")) returned 0 [0261.841] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330831\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330831\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330831\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330831\\temporaryfile")) returned 1 [0261.842] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330831\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1018820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1018820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1018820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1018820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1018820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1018820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1018820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1018820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1018820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.842] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330831\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1018820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1018820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1018820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.843] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1018820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1018820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1018820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.843] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1018820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1018820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1018820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.843] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.843] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330831\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330831\\temporaryfile")) returned 1 [0261.843] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1018820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1018820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1018820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.843] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.843] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330831" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330831")) returned 1 [0261.843] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP") returned 0 [0261.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.846] WriteFile (in: hFile=0xdc, lpBuffer=0x2e2dd0*, nNumberOfBytesToWrite=0x1a6c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e2dd0*, lpNumberOfBytesWritten=0x18fdd8*=0x1a6c0, lpOverlapped=0x0) returned 1 [0261.848] CloseHandle (hObject=0xdc) returned 1 [0261.848] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.849] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a7d8 [0261.849] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a7e0) returned 0x2c8700 [0261.849] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1a7d8, lpOverlapped=0x0) returned 1 [0261.852] CloseHandle (hObject=0xdc) returned 1 [0261.852] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp")) returned 1 [0261.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.854] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.854] GetTickCount () returned 0x50c5e [0261.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.854] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330846\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330846\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330846\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330846\\....\\temporaryfile")) returned 0 [0261.855] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330846\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330846\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330846\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330846\\temporaryfile")) returned 1 [0261.856] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330846\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa103e980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa103e980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa103e980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.856] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa103e980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa103e980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa103e980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa103e980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa103e980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa103e980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.857] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330846\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa103e980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa103e980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa103e980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.857] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa103e980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa103e980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa103e980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.857] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa103e980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa103e980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa103e980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.857] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.857] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330846\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330846\\temporaryfile")) returned 1 [0261.857] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa103e980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa103e980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa103e980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.857] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.857] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330846" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330846")) returned 1 [0261.857] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP") returned 0 [0261.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.860] WriteFile (in: hFile=0xdc, lpBuffer=0x2e2ef0*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e2ef0*, lpNumberOfBytesWritten=0x18fdd8*=0x1a7e0, lpOverlapped=0x0) returned 1 [0261.862] CloseHandle (hObject=0xdc) returned 1 [0261.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.863] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a7d8 [0261.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a7e0) returned 0x2c8700 [0261.863] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1a7d8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1a7d8, lpOverlapped=0x0) returned 1 [0261.866] CloseHandle (hObject=0xdc) returned 1 [0261.866] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp")) returned 1 [0261.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.867] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.867] GetTickCount () returned 0x50c6e [0261.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.867] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.868] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.868] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330862\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330862\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330862\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330862\\....\\temporaryfile")) returned 0 [0261.868] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330862\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330862\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330862\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330862\\temporaryfile")) returned 1 [0261.870] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330862\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1064ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1064ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1064ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1064ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1064ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1064ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.870] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1064ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1064ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1064ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.870] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330862\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1064ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1064ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1064ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.870] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1064ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1064ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1064ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.870] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1064ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1064ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1064ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.870] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.870] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330862\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330862\\temporaryfile")) returned 1 [0261.871] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1064ae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1064ae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1064ae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.871] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.871] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330862" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330862")) returned 1 [0261.871] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP") returned 0 [0261.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.873] WriteFile (in: hFile=0xdc, lpBuffer=0x2e2ef0*, nNumberOfBytesToWrite=0x1a7e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e2ef0*, lpNumberOfBytesWritten=0x18fdd8*=0x1a7e0, lpOverlapped=0x0) returned 1 [0261.876] CloseHandle (hObject=0xdc) returned 1 [0261.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.877] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30408 [0261.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30410) returned 0x2c8700 [0261.878] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x30408, lpOverlapped=0x0) returned 1 [0261.881] CloseHandle (hObject=0xdc) returned 1 [0261.881] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp")) returned 1 [0261.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.883] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.883] GetTickCount () returned 0x50c7e [0261.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.883] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.884] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330878\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330878\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330878\\....\\temporaryfile")) returned 0 [0261.884] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330878\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330878\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330878\\temporaryfile")) returned 1 [0261.886] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330878\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa108ac40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa108ac40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa108ac40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.886] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa108ac40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa108ac40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa108ac40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.886] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa108ac40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa108ac40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa108ac40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.886] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330878\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa108ac40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa108ac40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa108ac40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.886] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa108ac40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa108ac40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa108ac40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.886] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa108ac40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa108ac40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa108ac40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.886] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.886] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330878\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330878\\temporaryfile")) returned 1 [0261.886] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa108ac40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa108ac40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa108ac40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.887] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.887] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330878" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330878")) returned 1 [0261.887] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP") returned 0 [0261.890] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.891] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x30410, lpOverlapped=0x0) returned 1 [0261.894] CloseHandle (hObject=0xdc) returned 1 [0261.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.895] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30408 [0261.895] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30410) returned 0x2c8700 [0261.895] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x30408, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x30408, lpOverlapped=0x0) returned 1 [0261.898] CloseHandle (hObject=0xdc) returned 1 [0261.898] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp")) returned 1 [0261.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.900] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.900] GetTickCount () returned 0x50c8d [0261.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.901] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330893\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330893\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330893\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330893\\....\\temporaryfile")) returned 0 [0261.901] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330893\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330893\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330893\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330893\\temporaryfile")) returned 1 [0261.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330893\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10b0da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10b0da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10b0da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.903] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10b0da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10b0da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10b0da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.903] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10b0da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10b0da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10b0da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.903] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330893\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10b0da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10b0da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10b0da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.903] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10b0da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10b0da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10b0da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.903] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10b0da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10b0da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10b0da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.903] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.903] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330893\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330893\\temporaryfile")) returned 1 [0261.903] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10b0da0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10b0da0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10b0da0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.904] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330893" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330893")) returned 1 [0261.904] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP") returned 0 [0261.907] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.908] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x30410, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x30410, lpOverlapped=0x0) returned 1 [0261.911] CloseHandle (hObject=0xdc) returned 1 [0261.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.912] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x307f8 [0261.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30800) returned 0x2c8700 [0261.912] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x307f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x307f8, lpOverlapped=0x0) returned 1 [0261.915] CloseHandle (hObject=0xdc) returned 1 [0261.915] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp")) returned 1 [0261.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.917] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.917] GetTickCount () returned 0x50c9d [0261.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.917] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.918] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.918] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330909\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330909\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.918] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330909\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330909\\....\\temporaryfile")) returned 0 [0261.918] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330909\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330909\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330909\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330909\\temporaryfile")) returned 1 [0261.920] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330909\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10d6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10d6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10d6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.920] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10d6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10d6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10d6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.920] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10d6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10d6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10d6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.920] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330909\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10d6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10d6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10d6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.920] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10d6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10d6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10d6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.920] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10d6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10d6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10d6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.920] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.920] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330909\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330909\\temporaryfile")) returned 1 [0261.920] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10d6f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10d6f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10d6f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.921] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.921] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330909" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330909")) returned 1 [0261.921] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP") returned 0 [0261.924] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.925] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x30800, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x30800, lpOverlapped=0x0) returned 1 [0261.928] CloseHandle (hObject=0xdc) returned 1 [0261.928] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.929] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa0d2 [0261.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa0da) returned 0x2c8700 [0261.929] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa0d2, lpOverlapped=0x0) returned 1 [0261.931] CloseHandle (hObject=0xdc) returned 1 [0261.931] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg")) returned 1 [0261.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.932] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.932] GetTickCount () returned 0x50cac [0261.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.932] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330924\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330924\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330924\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330924\\....\\temporaryfile")) returned 0 [0261.933] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330924\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330924\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330924\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330924\\temporaryfile")) returned 1 [0261.934] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330924\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10fd060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10fd060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10fd060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.935] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10fd060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10fd060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10fd060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.935] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10fd060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10fd060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10fd060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.935] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330924\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10fd060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10fd060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10fd060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.935] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10fd060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10fd060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10fd060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.935] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10fd060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10fd060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10fd060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.935] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.935] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330924\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330924\\temporaryfile")) returned 1 [0261.935] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa10fd060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa10fd060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa10fd060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.935] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.935] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330924" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330924")) returned 1 [0261.935] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG") returned 0 [0261.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.937] WriteFile (in: hFile=0xdc, lpBuffer=0x2d27f0*, nNumberOfBytesToWrite=0xa0d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d27f0*, lpNumberOfBytesWritten=0x18fdd8*=0xa0d8, lpOverlapped=0x0) returned 1 [0261.938] CloseHandle (hObject=0xdc) returned 1 [0261.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.939] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc5d7 [0261.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc5df) returned 0x2c8700 [0261.940] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xc5d7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xc5d7, lpOverlapped=0x0) returned 1 [0261.941] CloseHandle (hObject=0xdc) returned 1 [0261.941] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg")) returned 1 [0261.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.943] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.943] GetTickCount () returned 0x50cbc [0261.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.943] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940\\....\\temporaryfile")) returned 0 [0261.944] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940\\temporaryfile")) returned 1 [0261.945] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.945] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.945] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.945] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.946] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.946] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.946] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.946] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940\\temporaryfile")) returned 1 [0261.946] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.946] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.946] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940")) returned 1 [0261.946] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG") returned 0 [0261.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.948] WriteFile (in: hFile=0xdc, lpBuffer=0x2d4cf0*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d4cf0*, lpNumberOfBytesWritten=0x18fdd8*=0xc5e0, lpOverlapped=0x0) returned 1 [0261.949] CloseHandle (hObject=0xdc) returned 1 [0261.950] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.950] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf438 [0261.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf440) returned 0x2c8700 [0261.950] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xf438, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xf438, lpOverlapped=0x0) returned 1 [0261.954] CloseHandle (hObject=0xdc) returned 1 [0261.954] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg")) returned 1 [0261.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.955] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.955] GetTickCount () returned 0x50cbc [0261.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.955] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.956] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.956] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940\\....\\temporaryfile")) returned 0 [0261.956] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940\\temporaryfile")) returned 1 [0261.958] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.958] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.958] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.958] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.958] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.958] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.959] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.959] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940\\temporaryfile")) returned 1 [0261.959] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11231c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11231c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11231c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.959] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.959] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330940" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330940")) returned 1 [0261.959] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG") returned 0 [0261.960] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.961] WriteFile (in: hFile=0xdc, lpBuffer=0x2d7b50*, nNumberOfBytesToWrite=0xf440, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d7b50*, lpNumberOfBytesWritten=0x18fdd8*=0xf440, lpOverlapped=0x0) returned 1 [0261.962] CloseHandle (hObject=0xdc) returned 1 [0261.963] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.964] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30f2 [0261.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30fa) returned 0x2c8700 [0261.964] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x30f2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x30f2, lpOverlapped=0x0) returned 1 [0261.966] CloseHandle (hObject=0xdc) returned 1 [0261.966] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif")) returned 1 [0261.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.967] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.967] GetTickCount () returned 0x50ccc [0261.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.967] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330956\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330956\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330956\\....\\temporaryfile")) returned 0 [0261.968] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330956\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330956\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330956\\temporaryfile")) returned 1 [0261.969] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330956\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1149320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1149320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1149320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.969] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1149320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1149320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1149320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.970] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1149320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1149320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1149320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.970] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330956\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1149320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1149320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1149320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.970] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1149320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1149320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1149320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.970] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1149320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1149320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1149320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.970] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.970] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330956\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330956\\temporaryfile")) returned 1 [0261.970] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1149320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1149320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1149320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.970] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.970] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330956" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330956")) returned 1 [0261.970] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF") returned 0 [0261.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.971] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb810*, nNumberOfBytesToWrite=0x30f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb810*, lpNumberOfBytesWritten=0x18fdd8*=0x30f8, lpOverlapped=0x0) returned 1 [0261.972] CloseHandle (hObject=0xdc) returned 1 [0261.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.974] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3c45 [0261.974] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3c4d) returned 0x2c8700 [0261.974] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3c45, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3c45, lpOverlapped=0x0) returned 1 [0261.976] CloseHandle (hObject=0xdc) returned 1 [0261.976] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg")) returned 1 [0261.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0261.977] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.977] GetTickCount () returned 0x50cdb [0261.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.982] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.983] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330971\\...."), lpSecurityAttributes=0x256210) returned 1 [0261.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330971\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330971\\....\\temporaryfile")) returned 0 [0261.983] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330971\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330971\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330971\\temporaryfile")) returned 1 [0261.985] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330971\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa116f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa116f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa116f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.985] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa116f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa116f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa116f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.985] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa116f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa116f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa116f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.985] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330971\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa116f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa116f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa116f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.985] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa116f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa116f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa116f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.985] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa116f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa116f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa116f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.985] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.985] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330971\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330971\\temporaryfile")) returned 1 [0261.985] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa116f480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa116f480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa116f480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.985] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.986] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330971" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330971")) returned 1 [0261.986] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG") returned 0 [0261.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.987] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc360*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc360*, lpNumberOfBytesWritten=0x18fdd8*=0x3c50, lpOverlapped=0x0) returned 1 [0261.988] CloseHandle (hObject=0xdc) returned 1 [0261.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.989] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3c76 [0261.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3c7e) returned 0x2c8700 [0261.989] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3c76, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3c76, lpOverlapped=0x0) returned 1 [0261.991] CloseHandle (hObject=0xdc) returned 1 [0261.991] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp")) returned 1 [0261.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0261.992] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0261.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0261.992] GetTickCount () returned 0x50ceb [0261.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0261.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0261.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0261.992] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987\\...."), lpSecurityAttributes=0x256228) returned 1 [0261.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987\\....\\temporaryfile")) returned 0 [0261.993] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987\\temporaryfile")) returned 1 [0261.994] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0261.995] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.995] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0261.995] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0261.995] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.995] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0261.995] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0261.995] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987\\temporaryfile")) returned 1 [0261.995] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0261.995] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0261.995] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987")) returned 1 [0261.995] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP") returned 0 [0261.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.996] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc390*, nNumberOfBytesToWrite=0x3c80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc390*, lpNumberOfBytesWritten=0x18fdd8*=0x3c80, lpOverlapped=0x0) returned 1 [0261.998] CloseHandle (hObject=0xdc) returned 1 [0261.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0261.998] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1016 [0261.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x101e) returned 0x25b528 [0261.998] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1016, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1016, lpOverlapped=0x0) returned 1 [0262.000] CloseHandle (hObject=0xdc) returned 1 [0262.000] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp")) returned 1 [0262.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.001] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.001] GetTickCount () returned 0x50ceb [0262.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.001] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987\\....\\temporaryfile")) returned 0 [0262.002] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987\\temporaryfile")) returned 1 [0262.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.004] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.004] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.004] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.004] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987\\temporaryfile")) returned 1 [0262.005] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11955e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11955e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11955e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.005] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.005] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18330987" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18330987")) returned 1 [0262.005] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP") returned 0 [0262.006] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.006] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1020, lpOverlapped=0x0) returned 1 [0262.007] CloseHandle (hObject=0xdc) returned 1 [0262.007] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.008] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x49d2 [0262.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x49da) returned 0x2c8700 [0262.008] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x49d2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x49d2, lpOverlapped=0x0) returned 1 [0262.020] CloseHandle (hObject=0xdc) returned 1 [0262.020] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif")) returned 1 [0262.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.028] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.028] GetTickCount () returned 0x50d0a [0262.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.029] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.029] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331018\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331018\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331018\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331018\\....\\temporaryfile")) returned 0 [0262.030] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331018\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331018\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331018\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331018\\temporaryfile")) returned 1 [0262.032] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331018\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11e18a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11e18a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11e18a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.032] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11e18a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11e18a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11e18a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.032] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11e18a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11e18a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11e18a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.032] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331018\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11e18a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11e18a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11e18a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.032] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11e18a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11e18a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11e18a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.032] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11e18a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11e18a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11e18a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.032] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.032] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331018\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331018\\temporaryfile")) returned 1 [0262.032] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa11e18a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa11e18a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa11e18a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.032] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.032] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331018" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331018")) returned 1 [0262.033] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF") returned 0 [0262.033] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.034] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd0f0*, nNumberOfBytesToWrite=0x49d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd0f0*, lpNumberOfBytesWritten=0x18fdd8*=0x49d8, lpOverlapped=0x0) returned 1 [0262.035] CloseHandle (hObject=0xdc) returned 1 [0262.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.036] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x78af [0262.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x78b7) returned 0x2c8700 [0262.036] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x78af, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x78af, lpOverlapped=0x0) returned 1 [0262.038] CloseHandle (hObject=0xdc) returned 1 [0262.038] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg")) returned 1 [0262.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.039] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.039] GetTickCount () returned 0x50d1a [0262.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.040] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.040] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034\\....\\temporaryfile")) returned 0 [0262.041] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034\\temporaryfile")) returned 1 [0262.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.042] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.043] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.043] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.043] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.043] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034\\temporaryfile")) returned 1 [0262.043] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.043] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.043] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034")) returned 1 [0262.043] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG") returned 0 [0262.044] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.045] WriteFile (in: hFile=0xdc, lpBuffer=0x2cffc8*, nNumberOfBytesToWrite=0x78b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cffc8*, lpNumberOfBytesWritten=0x18fdd8*=0x78b8, lpOverlapped=0x0) returned 1 [0262.046] CloseHandle (hObject=0xdc) returned 1 [0262.046] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.046] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7450 [0262.047] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7458) returned 0x2c8700 [0262.047] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7450, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7450, lpOverlapped=0x0) returned 1 [0262.048] CloseHandle (hObject=0xdc) returned 1 [0262.048] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg")) returned 1 [0262.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.049] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.049] GetTickCount () returned 0x50d1a [0262.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.050] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.050] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034\\....\\temporaryfile")) returned 0 [0262.051] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034\\temporaryfile")) returned 1 [0262.053] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa122db60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa122db60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.054] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa122db60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa122db60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.054] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.054] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.054] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.054] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.054] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.054] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034\\temporaryfile")) returned 1 [0262.054] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1207a00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1207a00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1207a00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.054] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.054] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331034" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331034")) returned 1 [0262.055] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG") returned 0 [0262.055] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.056] WriteFile (in: hFile=0xdc, lpBuffer=0x2cfb68*, nNumberOfBytesToWrite=0x7458, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cfb68*, lpNumberOfBytesWritten=0x18fdd8*=0x7458, lpOverlapped=0x0) returned 1 [0262.058] CloseHandle (hObject=0xdc) returned 1 [0262.058] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.060] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa343 [0262.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa34b) returned 0x2c8700 [0262.060] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa343, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa343, lpOverlapped=0x0) returned 1 [0262.063] CloseHandle (hObject=0xdc) returned 1 [0262.063] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg")) returned 1 [0262.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.064] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.064] GetTickCount () returned 0x50d29 [0262.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.065] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.065] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331049\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331049\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331049\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331049\\....\\temporaryfile")) returned 0 [0262.065] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331049\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331049\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331049\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331049\\temporaryfile")) returned 1 [0262.067] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331049\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa122db60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa122db60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa122db60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.067] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa122db60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa122db60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa122db60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.067] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa122db60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa122db60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa122db60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.067] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331049\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa122db60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa122db60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa122db60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.067] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa122db60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa122db60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa122db60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.067] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa122db60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa122db60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa122db60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.067] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.067] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331049\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331049\\temporaryfile")) returned 1 [0262.068] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa122db60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa122db60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa122db60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.068] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.068] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331049" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331049")) returned 1 [0262.068] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG") returned 0 [0262.069] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.069] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2a60*, nNumberOfBytesToWrite=0xa348, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2a60*, lpNumberOfBytesWritten=0x18fdd8*=0xa348, lpOverlapped=0x0) returned 1 [0262.071] CloseHandle (hObject=0xdc) returned 1 [0262.071] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.071] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa445 [0262.071] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa44d) returned 0x2c8700 [0262.072] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xa445, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xa445, lpOverlapped=0x0) returned 1 [0262.073] CloseHandle (hObject=0xdc) returned 1 [0262.074] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg")) returned 1 [0262.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.075] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.075] GetTickCount () returned 0x50d39 [0262.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.075] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331065\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331065\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331065\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331065\\....\\temporaryfile")) returned 0 [0262.076] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331065\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331065\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331065\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331065\\temporaryfile")) returned 1 [0262.077] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331065\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1253cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1253cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1253cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.077] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1253cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1253cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1253cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.077] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1253cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1253cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1253cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.077] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331065\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1253cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1253cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1253cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.078] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1253cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1253cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1253cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.078] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1253cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1253cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1253cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.078] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.078] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331065\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331065\\temporaryfile")) returned 1 [0262.078] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1253cc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1253cc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1253cc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.078] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.078] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331065" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331065")) returned 1 [0262.078] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG") returned 0 [0262.079] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.081] WriteFile (in: hFile=0xdc, lpBuffer=0x2d2b60*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d2b60*, lpNumberOfBytesWritten=0x18fdd8*=0xa450, lpOverlapped=0x0) returned 1 [0262.082] CloseHandle (hObject=0xdc) returned 1 [0262.082] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.084] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2ba2 [0262.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2baa) returned 0x2c8700 [0262.084] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2ba2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2ba2, lpOverlapped=0x0) returned 1 [0262.085] CloseHandle (hObject=0xdc) returned 1 [0262.085] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg")) returned 1 [0262.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.086] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.086] GetTickCount () returned 0x50d48 [0262.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.087] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080\\....\\temporaryfile")) returned 0 [0262.087] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080\\temporaryfile")) returned 1 [0262.089] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.089] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.089] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.089] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.089] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.089] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.089] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.089] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080\\temporaryfile")) returned 1 [0262.089] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.090] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080")) returned 1 [0262.090] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG") returned 0 [0262.090] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.091] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb2c0*, nNumberOfBytesToWrite=0x2ba8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb2c0*, lpNumberOfBytesWritten=0x18fdd8*=0x2ba8, lpOverlapped=0x0) returned 1 [0262.092] CloseHandle (hObject=0xdc) returned 1 [0262.092] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.093] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x321f [0262.093] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3227) returned 0x2c8700 [0262.093] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x321f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x321f, lpOverlapped=0x0) returned 1 [0262.094] CloseHandle (hObject=0xdc) returned 1 [0262.094] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg")) returned 1 [0262.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.095] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.095] GetTickCount () returned 0x50d48 [0262.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.096] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080\\....\\temporaryfile")) returned 0 [0262.097] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080\\temporaryfile")) returned 1 [0262.098] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.098] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.098] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.098] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.098] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.098] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.099] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.099] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080\\temporaryfile")) returned 1 [0262.099] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1279e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1279e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1279e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.099] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.099] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331080" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331080")) returned 1 [0262.099] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG") returned 0 [0262.099] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.100] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb938*, nNumberOfBytesToWrite=0x3228, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb938*, lpNumberOfBytesWritten=0x18fdd8*=0x3228, lpOverlapped=0x0) returned 1 [0262.101] CloseHandle (hObject=0xdc) returned 1 [0262.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.102] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbdae [0262.102] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbdb6) returned 0x2c8700 [0262.102] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xbdae, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xbdae, lpOverlapped=0x0) returned 1 [0262.104] CloseHandle (hObject=0xdc) returned 1 [0262.104] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg")) returned 1 [0262.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.105] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.105] GetTickCount () returned 0x50d58 [0262.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.105] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331096\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331096\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331096\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331096\\....\\temporaryfile")) returned 0 [0262.106] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331096\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331096\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331096\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331096\\temporaryfile")) returned 1 [0262.107] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331096\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa129ff80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa129ff80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa129ff80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.107] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa129ff80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa129ff80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa129ff80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.108] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa129ff80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa129ff80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa129ff80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.108] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331096\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa129ff80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa129ff80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa129ff80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.108] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa129ff80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa129ff80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa129ff80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.108] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa129ff80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa129ff80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa129ff80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.108] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.108] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331096\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331096\\temporaryfile")) returned 1 [0262.108] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa129ff80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa129ff80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa129ff80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.108] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.108] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331096" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331096")) returned 1 [0262.108] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG") returned 0 [0262.109] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.110] WriteFile (in: hFile=0xdc, lpBuffer=0x2d44c8*, nNumberOfBytesToWrite=0xbdb8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d44c8*, lpNumberOfBytesWritten=0x18fdd8*=0xbdb8, lpOverlapped=0x0) returned 1 [0262.111] CloseHandle (hObject=0xdc) returned 1 [0262.111] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.113] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xef6 [0262.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xefe) returned 0x2450048 [0262.113] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xef6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xef6, lpOverlapped=0x0) returned 1 [0262.114] CloseHandle (hObject=0xdc) returned 1 [0262.114] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf")) returned 1 [0262.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.115] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.115] GetTickCount () returned 0x50d68 [0262.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.116] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112\\....\\temporaryfile")) returned 0 [0262.116] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112\\temporaryfile")) returned 1 [0262.118] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.118] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.118] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.118] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.118] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.118] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.118] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.118] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112\\temporaryfile")) returned 1 [0262.118] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.118] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.119] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112")) returned 1 [0262.119] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF") returned 0 [0262.119] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.120] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xf00, lpOverlapped=0x0) returned 1 [0262.121] CloseHandle (hObject=0xdc) returned 1 [0262.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.121] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7aac [0262.121] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7ab4) returned 0x2c8700 [0262.121] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7aac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7aac, lpOverlapped=0x0) returned 1 [0262.125] CloseHandle (hObject=0xdc) returned 1 [0262.125] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf")) returned 1 [0262.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.126] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.126] GetTickCount () returned 0x50d68 [0262.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.127] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.127] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112\\....\\temporaryfile")) returned 0 [0262.129] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112\\temporaryfile")) returned 1 [0262.130] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.130] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.130] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.131] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.131] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.131] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.131] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.131] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112\\temporaryfile")) returned 1 [0262.131] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12c60e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12c60e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12c60e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.131] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.131] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331112" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331112")) returned 1 [0262.132] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF") returned 0 [0262.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.133] WriteFile (in: hFile=0xdc, lpBuffer=0x2d01c8*, nNumberOfBytesToWrite=0x7ab0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d01c8*, lpNumberOfBytesWritten=0x18fdd8*=0x7ab0, lpOverlapped=0x0) returned 1 [0262.135] CloseHandle (hObject=0xdc) returned 1 [0262.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.136] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3d6 [0262.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3de) returned 0x259e70 [0262.136] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x3d6, lpOverlapped=0x0) returned 1 [0262.138] CloseHandle (hObject=0xdc) returned 1 [0262.138] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf")) returned 1 [0262.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.139] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.139] GetTickCount () returned 0x50d77 [0262.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.139] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.139] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331127\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331127\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.140] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331127\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331127\\....\\temporaryfile")) returned 0 [0262.140] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331127\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331127\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331127\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331127\\temporaryfile")) returned 1 [0262.141] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331127\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12ec240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12ec240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12ec240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.142] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12ec240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12ec240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12ec240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.142] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12ec240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12ec240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12ec240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.142] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331127\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12ec240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12ec240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12ec240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.142] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12ec240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12ec240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12ec240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.142] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12ec240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12ec240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12ec240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.142] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.142] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331127\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331127\\temporaryfile")) returned 1 [0262.142] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa12ec240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa12ec240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa12ec240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.142] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.142] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331127" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331127")) returned 1 [0262.142] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF") returned 0 [0262.143] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.143] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x3e0, lpOverlapped=0x0) returned 1 [0262.144] CloseHandle (hObject=0xdc) returned 1 [0262.144] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.146] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe0a [0262.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe12) returned 0x2450048 [0262.146] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xe0a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xe0a, lpOverlapped=0x0) returned 1 [0262.147] CloseHandle (hObject=0xdc) returned 1 [0262.147] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf")) returned 1 [0262.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.148] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.148] GetTickCount () returned 0x50d87 [0262.148] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.149] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331143\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331143\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331143\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331143\\....\\temporaryfile")) returned 0 [0262.150] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331143\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331143\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331143\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331143\\temporaryfile")) returned 1 [0262.156] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331143\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13123a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13123a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13123a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.156] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13123a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13123a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13123a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.156] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13123a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13123a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13123a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.156] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331143\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13123a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13123a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13123a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.156] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13123a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13123a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13123a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.156] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13123a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13123a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13123a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.156] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.157] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331143\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331143\\temporaryfile")) returned 1 [0262.157] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13123a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13123a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13123a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.157] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.157] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331143" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331143")) returned 1 [0262.157] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF") returned 0 [0262.157] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.158] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xe10, lpOverlapped=0x0) returned 1 [0262.159] CloseHandle (hObject=0xdc) returned 1 [0262.159] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.160] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x776 [0262.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x77e) returned 0x2450048 [0262.160] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x776, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x776, lpOverlapped=0x0) returned 1 [0262.162] CloseHandle (hObject=0xdc) returned 1 [0262.162] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf")) returned 1 [0262.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.163] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.163] GetTickCount () returned 0x50d96 [0262.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.163] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158\\....\\temporaryfile")) returned 0 [0262.164] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158\\temporaryfile")) returned 1 [0262.165] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.165] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.165] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.166] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.166] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.166] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.166] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.166] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158\\temporaryfile")) returned 1 [0262.166] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.166] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.166] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158")) returned 1 [0262.166] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF") returned 0 [0262.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.167] WriteFile (in: hFile=0xdc, lpBuffer=0x24507d8*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x24507d8*, lpNumberOfBytesWritten=0x18fdd8*=0x780, lpOverlapped=0x0) returned 1 [0262.168] CloseHandle (hObject=0xdc) returned 1 [0262.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.169] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb12 [0262.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb1a) returned 0x2450048 [0262.169] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xb12, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xb12, lpOverlapped=0x0) returned 1 [0262.170] CloseHandle (hObject=0xdc) returned 1 [0262.170] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf")) returned 1 [0262.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.171] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.171] GetTickCount () returned 0x50d96 [0262.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.171] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.172] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158\\....\\temporaryfile")) returned 0 [0262.172] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158\\temporaryfile")) returned 1 [0262.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.174] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.174] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.174] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.174] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158\\temporaryfile")) returned 1 [0262.174] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1338500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1338500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1338500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.175] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.175] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331158" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331158")) returned 1 [0262.175] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF") returned 0 [0262.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.176] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xb18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xb18, lpOverlapped=0x0) returned 1 [0262.177] CloseHandle (hObject=0xdc) returned 1 [0262.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.178] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6ec [0262.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6f4) returned 0x2450048 [0262.178] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x6ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x6ec, lpOverlapped=0x0) returned 1 [0262.179] CloseHandle (hObject=0xdc) returned 1 [0262.180] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf")) returned 1 [0262.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.180] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.180] GetTickCount () returned 0x50da6 [0262.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.181] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174\\....\\temporaryfile")) returned 0 [0262.182] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174\\temporaryfile")) returned 1 [0262.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.183] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.183] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.183] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.183] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174\\temporaryfile")) returned 1 [0262.184] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.184] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174")) returned 1 [0262.184] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF") returned 0 [0262.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.185] WriteFile (in: hFile=0xdc, lpBuffer=0x2450750*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450750*, lpNumberOfBytesWritten=0x18fdd8*=0x6f0, lpOverlapped=0x0) returned 1 [0262.186] CloseHandle (hObject=0xdc) returned 1 [0262.186] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.186] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd16 [0262.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd1e) returned 0x2450048 [0262.186] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xd16, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xd16, lpOverlapped=0x0) returned 1 [0262.190] CloseHandle (hObject=0xdc) returned 1 [0262.190] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf")) returned 1 [0262.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.191] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.191] GetTickCount () returned 0x50da6 [0262.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.192] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174\\....\\temporaryfile")) returned 0 [0262.192] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174\\temporaryfile")) returned 1 [0262.194] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13847c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13847c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.194] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13847c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13847c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.194] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.194] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.194] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.194] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.194] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174\\temporaryfile")) returned 1 [0262.194] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa135e660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa135e660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa135e660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.194] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331174" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331174")) returned 1 [0262.195] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF") returned 0 [0262.195] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.196] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xd20, lpOverlapped=0x0) returned 1 [0262.197] CloseHandle (hObject=0xdc) returned 1 [0262.197] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.197] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x175f [0262.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1767) returned 0x2c4a70 [0262.197] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x175f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x175f, lpOverlapped=0x0) returned 1 [0262.199] CloseHandle (hObject=0xdc) returned 1 [0262.199] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 1 [0262.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.200] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.200] GetTickCount () returned 0x50db6 [0262.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.201] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331190\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331190\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.202] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331190\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331190\\....\\temporaryfile")) returned 0 [0262.202] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331190\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331190\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331190\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331190\\temporaryfile")) returned 1 [0262.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331190\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13847c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13847c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13847c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.204] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13847c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13847c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13847c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.204] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13847c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13847c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13847c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331190\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13847c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13847c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13847c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.204] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13847c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13847c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13847c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.204] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13847c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13847c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13847c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.204] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.204] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331190\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331190\\temporaryfile")) returned 1 [0262.205] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13847c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13847c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13847c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.205] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331190" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331190")) returned 1 [0262.205] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 0 [0262.206] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.206] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1768, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1768, lpOverlapped=0x0) returned 1 [0262.208] CloseHandle (hObject=0xdc) returned 1 [0262.208] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.209] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x278a [0262.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2792) returned 0x2c8700 [0262.209] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x278a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x278a, lpOverlapped=0x0) returned 1 [0262.211] CloseHandle (hObject=0xdc) returned 1 [0262.211] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0262.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.212] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.212] GetTickCount () returned 0x50dc5 [0262.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.213] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.213] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331205\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331205\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331205\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331205\\....\\temporaryfile")) returned 0 [0262.213] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331205\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331205\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331205\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331205\\temporaryfile")) returned 1 [0262.215] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331205\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13aa920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13aa920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13aa920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.215] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13aa920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13aa920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13aa920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.215] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13aa920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13aa920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13aa920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.215] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331205\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13aa920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13aa920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13aa920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.215] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13aa920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13aa920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13aa920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.215] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13aa920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13aa920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13aa920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.215] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.215] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331205\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331205\\temporaryfile")) returned 1 [0262.215] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13aa920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13aa920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13aa920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.216] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.216] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331205" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331205")) returned 1 [0262.216] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 0 [0262.216] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.217] WriteFile (in: hFile=0xdc, lpBuffer=0x2caea8*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caea8*, lpNumberOfBytesWritten=0x18fdd8*=0x2790, lpOverlapped=0x0) returned 1 [0262.218] CloseHandle (hObject=0xdc) returned 1 [0262.226] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.228] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13c2 [0262.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13ca) returned 0x25b528 [0262.228] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13c2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13c2, lpOverlapped=0x0) returned 1 [0262.229] CloseHandle (hObject=0xdc) returned 1 [0262.229] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0262.230] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.230] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.231] GetTickCount () returned 0x50dd5 [0262.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.231] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.231] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331221\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331221\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331221\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331221\\....\\temporaryfile")) returned 0 [0262.232] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331221\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331221\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331221\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331221\\temporaryfile")) returned 1 [0262.233] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331221\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d0a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13d0a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13d0a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.234] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d0a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13d0a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13d0a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.234] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d0a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13d0a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13d0a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.234] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331221\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d0a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13d0a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13d0a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.234] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d0a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13d0a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13d0a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.234] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d0a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13d0a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13d0a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.234] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.234] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331221\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331221\\temporaryfile")) returned 1 [0262.234] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d0a80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13d0a80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13d0a80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.234] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.234] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331221" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331221")) returned 1 [0262.234] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 0 [0262.235] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.236] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x13c8, lpOverlapped=0x0) returned 1 [0262.237] CloseHandle (hObject=0xdc) returned 1 [0262.237] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.238] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x18f8 [0262.238] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1900) returned 0x2c4a70 [0262.238] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x18f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x18f8, lpOverlapped=0x0) returned 1 [0262.239] CloseHandle (hObject=0xdc) returned 1 [0262.239] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 1 [0262.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.240] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.240] GetTickCount () returned 0x50de4 [0262.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.240] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.241] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.242] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236\\....\\temporaryfile")) returned 0 [0262.242] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236\\temporaryfile")) returned 1 [0262.244] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.244] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.244] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.245] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.245] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.245] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.245] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.245] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236\\temporaryfile")) returned 1 [0262.245] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.245] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.245] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236")) returned 1 [0262.246] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 0 [0262.246] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.247] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1900, lpOverlapped=0x0) returned 1 [0262.248] CloseHandle (hObject=0xdc) returned 1 [0262.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.249] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a0a [0262.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a12) returned 0x2c8700 [0262.249] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2a0a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2a0a, lpOverlapped=0x0) returned 1 [0262.250] CloseHandle (hObject=0xdc) returned 1 [0262.250] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf")) returned 1 [0262.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.251] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.251] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.251] GetTickCount () returned 0x50de4 [0262.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.252] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.252] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.253] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236\\....\\temporaryfile")) returned 0 [0262.253] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236\\temporaryfile")) returned 1 [0262.254] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.254] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.254] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.254] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.255] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.255] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.255] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.255] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236\\temporaryfile")) returned 1 [0262.255] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13f6be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa13f6be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa13f6be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.255] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.255] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331236" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331236")) returned 1 [0262.255] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF") returned 0 [0262.256] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.256] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb128*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb128*, lpNumberOfBytesWritten=0x18fdd8*=0x2a10, lpOverlapped=0x0) returned 1 [0262.257] CloseHandle (hObject=0xdc) returned 1 [0262.257] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.258] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7ca4 [0262.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7cac) returned 0x2c8700 [0262.258] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7ca4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7ca4, lpOverlapped=0x0) returned 1 [0262.260] CloseHandle (hObject=0xdc) returned 1 [0262.260] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf")) returned 1 [0262.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.261] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.261] GetTickCount () returned 0x50df4 [0262.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.261] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252\\....\\temporaryfile")) returned 0 [0262.262] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252\\temporaryfile")) returned 1 [0262.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa141cd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa141cd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa141cd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa141cd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa141cd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa141cd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.263] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa141cd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa141cd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa141cd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.263] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa141cd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa141cd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa141cd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.263] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa141cd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa141cd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa141cd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.264] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa141cd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa141cd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa141cd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.264] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.264] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252\\temporaryfile")) returned 1 [0262.264] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa141cd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa141cd40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa141cd40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.264] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.264] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252")) returned 1 [0262.264] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF") returned 0 [0262.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.265] WriteFile (in: hFile=0xdc, lpBuffer=0x2d03c0*, nNumberOfBytesToWrite=0x7ca8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d03c0*, lpNumberOfBytesWritten=0x18fdd8*=0x7ca8, lpOverlapped=0x0) returned 1 [0262.267] CloseHandle (hObject=0xdc) returned 1 [0262.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.267] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf5c [0262.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf64) returned 0x2450048 [0262.267] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xf5c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xf5c, lpOverlapped=0x0) returned 1 [0262.269] CloseHandle (hObject=0xdc) returned 1 [0262.269] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf")) returned 1 [0262.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.270] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.270] GetTickCount () returned 0x50df4 [0262.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.270] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.271] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252\\....\\temporaryfile")) returned 0 [0262.271] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252\\temporaryfile")) returned 1 [0262.273] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa141cd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.273] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa141cd40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.273] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.273] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.273] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.273] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.273] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.273] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252\\temporaryfile")) returned 1 [0262.273] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.273] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.273] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331252" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331252")) returned 1 [0262.274] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF") returned 0 [0262.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.274] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xf60, lpOverlapped=0x0) returned 1 [0262.275] CloseHandle (hObject=0xdc) returned 1 [0262.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.277] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1dac [0262.277] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1db4) returned 0x2c8700 [0262.277] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1dac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1dac, lpOverlapped=0x0) returned 1 [0262.279] CloseHandle (hObject=0xdc) returned 1 [0262.279] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf")) returned 1 [0262.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.280] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.280] GetTickCount () returned 0x50e04 [0262.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.280] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.280] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331268\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331268\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331268\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331268\\....\\temporaryfile")) returned 0 [0262.281] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331268\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331268\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331268\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331268\\temporaryfile")) returned 1 [0262.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331268\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.283] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331268\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.283] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.283] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331268\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331268\\temporaryfile")) returned 1 [0262.283] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1442ea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1442ea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1442ea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.283] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331268" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331268")) returned 1 [0262.283] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF") returned 0 [0262.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.284] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca4c8*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca4c8*, lpNumberOfBytesWritten=0x18fdd8*=0x1db0, lpOverlapped=0x0) returned 1 [0262.285] CloseHandle (hObject=0xdc) returned 1 [0262.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.287] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1268 [0262.287] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1270) returned 0x25b528 [0262.287] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1268, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1268, lpOverlapped=0x0) returned 1 [0262.288] CloseHandle (hObject=0xdc) returned 1 [0262.289] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf")) returned 1 [0262.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.289] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.290] GetTickCount () returned 0x50e13 [0262.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.290] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.290] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.290] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283\\....\\temporaryfile")) returned 0 [0262.291] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283\\temporaryfile")) returned 1 [0262.292] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.292] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.292] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.292] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.292] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.292] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.292] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.292] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283\\temporaryfile")) returned 1 [0262.293] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.293] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.293] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283")) returned 1 [0262.293] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF") returned 0 [0262.293] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.294] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1270, lpOverlapped=0x0) returned 1 [0262.295] CloseHandle (hObject=0xdc) returned 1 [0262.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.295] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x20e0 [0262.295] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20e8) returned 0x2c8700 [0262.295] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x20e0, lpOverlapped=0x0) returned 1 [0262.297] CloseHandle (hObject=0xdc) returned 1 [0262.297] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf")) returned 1 [0262.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.298] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.298] GetTickCount () returned 0x50e13 [0262.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.298] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283\\....\\temporaryfile")) returned 0 [0262.299] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283\\temporaryfile")) returned 1 [0262.300] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.300] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.300] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.301] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283\\temporaryfile")) returned 1 [0262.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1469000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1469000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1469000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.301] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331283" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331283")) returned 1 [0262.301] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF") returned 0 [0262.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.302] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca7f8*, nNumberOfBytesToWrite=0x20e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca7f8*, lpNumberOfBytesWritten=0x18fdd8*=0x20e8, lpOverlapped=0x0) returned 1 [0262.303] CloseHandle (hObject=0xdc) returned 1 [0262.309] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.309] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xae4 [0262.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaec) returned 0x2450048 [0262.309] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xae4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xae4, lpOverlapped=0x0) returned 1 [0262.311] CloseHandle (hObject=0xdc) returned 1 [0262.311] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf")) returned 1 [0262.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.312] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.312] GetTickCount () returned 0x50e23 [0262.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.312] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.313] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.313] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331299\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331299\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331299\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331299\\....\\temporaryfile")) returned 0 [0262.314] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331299\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331299\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331299\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331299\\temporaryfile")) returned 1 [0262.316] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331299\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa148f160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa148f160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa148f160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.316] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa148f160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa148f160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa148f160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.316] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa148f160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa148f160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa148f160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.316] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331299\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa148f160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa148f160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa148f160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.316] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa148f160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa148f160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa148f160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.316] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa148f160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa148f160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa148f160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.316] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.316] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331299\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331299\\temporaryfile")) returned 1 [0262.316] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa148f160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa148f160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa148f160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.316] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.317] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331299" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331299")) returned 1 [0262.317] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF") returned 0 [0262.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.318] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xae8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xae8, lpOverlapped=0x0) returned 1 [0262.319] CloseHandle (hObject=0xdc) returned 1 [0262.319] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.320] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x540 [0262.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x548) returned 0x259e70 [0262.320] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x540, lpOverlapped=0x0) returned 1 [0262.321] CloseHandle (hObject=0xdc) returned 1 [0262.321] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf")) returned 1 [0262.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.322] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.322] GetTickCount () returned 0x50e32 [0262.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.323] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.323] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314\\....\\temporaryfile")) returned 0 [0262.323] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314\\temporaryfile")) returned 1 [0262.325] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.325] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.325] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314\\temporaryfile")) returned 1 [0262.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.325] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314")) returned 1 [0262.325] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF") returned 0 [0262.326] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.326] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x548, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x548, lpOverlapped=0x0) returned 1 [0262.327] CloseHandle (hObject=0xdc) returned 1 [0262.327] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.328] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1db8 [0262.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1dc0) returned 0x2c8700 [0262.328] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1db8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1db8, lpOverlapped=0x0) returned 1 [0262.330] CloseHandle (hObject=0xdc) returned 1 [0262.330] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf")) returned 1 [0262.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.331] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.331] GetTickCount () returned 0x50e32 [0262.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.331] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.331] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314\\....\\temporaryfile")) returned 0 [0262.332] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314\\temporaryfile")) returned 1 [0262.333] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.333] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.333] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.334] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.334] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.334] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.334] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.334] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314\\temporaryfile")) returned 1 [0262.334] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14b52c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14b52c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14b52c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.334] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.334] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331314" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331314")) returned 1 [0262.334] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF") returned 0 [0262.335] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.335] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca4d0*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca4d0*, lpNumberOfBytesWritten=0x18fdd8*=0x1dc0, lpOverlapped=0x0) returned 1 [0262.336] CloseHandle (hObject=0xdc) returned 1 [0262.336] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.337] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xcdc [0262.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xce4) returned 0x2450048 [0262.337] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xcdc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xcdc, lpOverlapped=0x0) returned 1 [0262.338] CloseHandle (hObject=0xdc) returned 1 [0262.338] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf")) returned 1 [0262.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.339] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.339] GetTickCount () returned 0x50e42 [0262.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.339] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.340] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330\\....\\temporaryfile")) returned 0 [0262.340] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330\\temporaryfile")) returned 1 [0262.342] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14db420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14db420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14db420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.342] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14db420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14db420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14db420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.342] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14db420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14db420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14db420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.342] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14db420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14db420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14db420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.342] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14db420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14db420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14db420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.342] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14db420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14db420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14db420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.342] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.342] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330\\temporaryfile")) returned 1 [0262.342] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14db420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa14db420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa14db420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.342] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.342] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330")) returned 1 [0262.342] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF") returned 0 [0262.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.343] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xce0, lpOverlapped=0x0) returned 1 [0262.344] CloseHandle (hObject=0xdc) returned 1 [0262.344] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.345] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x60c [0262.345] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x614) returned 0x259e70 [0262.345] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x60c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x60c, lpOverlapped=0x0) returned 1 [0262.346] CloseHandle (hObject=0xdc) returned 1 [0262.346] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf")) returned 1 [0262.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.347] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.347] GetTickCount () returned 0x50e42 [0262.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.348] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.349] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330\\....\\temporaryfile")) returned 0 [0262.350] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330\\temporaryfile")) returned 1 [0262.351] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14db420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.351] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa14db420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.351] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.351] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.352] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.352] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.352] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.352] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330\\temporaryfile")) returned 1 [0262.352] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.352] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.352] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331330" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331330")) returned 1 [0262.353] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF") returned 0 [0262.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.354] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x610, lpOverlapped=0x0) returned 1 [0262.355] CloseHandle (hObject=0xdc) returned 1 [0262.355] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.356] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b04 [0262.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b0c) returned 0x2c4a70 [0262.356] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b04, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b04, lpOverlapped=0x0) returned 1 [0262.358] CloseHandle (hObject=0xdc) returned 1 [0262.358] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf")) returned 1 [0262.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.359] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.359] GetTickCount () returned 0x50e52 [0262.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.360] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331346\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331346\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331346\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331346\\....\\temporaryfile")) returned 0 [0262.360] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331346\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331346\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331346\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331346\\temporaryfile")) returned 1 [0262.362] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331346\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.362] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331346\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.362] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.362] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.362] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331346\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331346\\temporaryfile")) returned 1 [0262.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1501580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1501580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1501580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.362] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331346" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331346")) returned 1 [0262.363] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF") returned 0 [0262.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.363] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1b08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b08, lpOverlapped=0x0) returned 1 [0262.364] CloseHandle (hObject=0xdc) returned 1 [0262.365] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.365] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x138c [0262.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1394) returned 0x25b528 [0262.365] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x138c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x138c, lpOverlapped=0x0) returned 1 [0262.367] CloseHandle (hObject=0xdc) returned 1 [0262.367] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf")) returned 1 [0262.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.368] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.368] GetTickCount () returned 0x50e61 [0262.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.368] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361\\....\\temporaryfile")) returned 0 [0262.369] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361\\temporaryfile")) returned 1 [0262.370] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.370] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.370] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.370] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.370] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.370] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.370] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.370] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361\\temporaryfile")) returned 1 [0262.371] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.371] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.371] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361")) returned 1 [0262.371] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF") returned 0 [0262.371] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.372] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1390, lpOverlapped=0x0) returned 1 [0262.373] CloseHandle (hObject=0xdc) returned 1 [0262.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.374] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6cc4 [0262.374] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6ccc) returned 0x2c8700 [0262.374] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x6cc4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x6cc4, lpOverlapped=0x0) returned 1 [0262.376] CloseHandle (hObject=0xdc) returned 1 [0262.376] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf")) returned 1 [0262.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.377] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.377] GetTickCount () returned 0x50e61 [0262.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.377] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361\\....\\temporaryfile")) returned 0 [0262.378] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361\\temporaryfile")) returned 1 [0262.379] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.379] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.379] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.379] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.380] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361\\temporaryfile")) returned 1 [0262.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15276e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15276e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15276e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.380] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331361" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331361")) returned 1 [0262.380] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF") returned 0 [0262.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.382] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf3e0*, nNumberOfBytesToWrite=0x6cc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf3e0*, lpNumberOfBytesWritten=0x18fdd8*=0x6cc8, lpOverlapped=0x0) returned 1 [0262.383] CloseHandle (hObject=0xdc) returned 1 [0262.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.386] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x36aa [0262.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36b2) returned 0x2c8700 [0262.386] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x36aa, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x36aa, lpOverlapped=0x0) returned 1 [0262.387] CloseHandle (hObject=0xdc) returned 1 [0262.387] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf")) returned 1 [0262.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.388] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.388] GetTickCount () returned 0x50e71 [0262.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.388] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.389] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.389] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331377\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331377\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331377\\....\\temporaryfile")) returned 0 [0262.389] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331377\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331377\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331377\\temporaryfile")) returned 1 [0262.391] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331377\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa154d840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa154d840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa154d840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.391] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa154d840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa154d840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa154d840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.391] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa154d840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa154d840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa154d840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.391] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331377\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa154d840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa154d840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa154d840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.391] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa154d840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa154d840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa154d840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.391] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa154d840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa154d840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa154d840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.391] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.391] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331377\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331377\\temporaryfile")) returned 1 [0262.391] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa154d840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa154d840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa154d840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.391] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.391] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331377" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331377")) returned 1 [0262.392] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF") returned 0 [0262.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.393] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbdc8*, nNumberOfBytesToWrite=0x36b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbdc8*, lpNumberOfBytesWritten=0x18fdd8*=0x36b0, lpOverlapped=0x0) returned 1 [0262.394] CloseHandle (hObject=0xdc) returned 1 [0262.394] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.394] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x32f6 [0262.394] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32fe) returned 0x2c8700 [0262.394] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x32f6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x32f6, lpOverlapped=0x0) returned 1 [0262.396] CloseHandle (hObject=0xdc) returned 1 [0262.396] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf")) returned 1 [0262.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.397] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.397] GetTickCount () returned 0x50e80 [0262.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.397] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.398] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392\\....\\temporaryfile")) returned 0 [0262.398] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392\\temporaryfile")) returned 1 [0262.400] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.400] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.400] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.400] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.400] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.400] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.400] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.400] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392\\temporaryfile")) returned 1 [0262.400] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.400] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.400] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392")) returned 1 [0262.400] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF") returned 0 [0262.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.401] WriteFile (in: hFile=0xdc, lpBuffer=0x2cba10*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cba10*, lpNumberOfBytesWritten=0x18fdd8*=0x3300, lpOverlapped=0x0) returned 1 [0262.402] CloseHandle (hObject=0xdc) returned 1 [0262.403] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.403] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7a80 [0262.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7a88) returned 0x2c8700 [0262.403] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7a80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7a80, lpOverlapped=0x0) returned 1 [0262.405] CloseHandle (hObject=0xdc) returned 1 [0262.405] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf")) returned 1 [0262.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.406] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.406] GetTickCount () returned 0x50e80 [0262.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.407] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.407] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392\\....\\temporaryfile")) returned 0 [0262.407] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392\\temporaryfile")) returned 1 [0262.409] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.409] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.409] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.409] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.409] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.409] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.409] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.409] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392\\temporaryfile")) returned 1 [0262.409] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15739a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15739a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15739a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.409] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.409] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331392" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331392")) returned 1 [0262.409] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF") returned 0 [0262.410] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.411] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0198*, nNumberOfBytesToWrite=0x7a88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0198*, lpNumberOfBytesWritten=0x18fdd8*=0x7a88, lpOverlapped=0x0) returned 1 [0262.412] CloseHandle (hObject=0xdc) returned 1 [0262.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.413] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4754 [0262.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x475c) returned 0x2c8700 [0262.413] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4754, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4754, lpOverlapped=0x0) returned 1 [0262.415] CloseHandle (hObject=0xdc) returned 1 [0262.415] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf")) returned 1 [0262.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.416] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.416] GetTickCount () returned 0x50e90 [0262.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.417] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408\\....\\temporaryfile")) returned 0 [0262.417] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408\\temporaryfile")) returned 1 [0262.418] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1599b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1599b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1599b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1599b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1599b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1599b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.419] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1599b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1599b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1599b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.419] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1599b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1599b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1599b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.419] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1599b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1599b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1599b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.419] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1599b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1599b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1599b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.419] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.419] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408\\temporaryfile")) returned 1 [0262.419] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1599b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1599b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1599b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.419] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.419] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408")) returned 1 [0262.419] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF") returned 0 [0262.420] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.420] WriteFile (in: hFile=0xdc, lpBuffer=0x2cce70*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cce70*, lpNumberOfBytesWritten=0x18fdd8*=0x4758, lpOverlapped=0x0) returned 1 [0262.421] CloseHandle (hObject=0xdc) returned 1 [0262.422] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.423] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2026 [0262.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x202e) returned 0x2c8700 [0262.423] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2026, lpOverlapped=0x0) returned 1 [0262.424] CloseHandle (hObject=0xdc) returned 1 [0262.424] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf")) returned 1 [0262.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.425] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.425] GetTickCount () returned 0x50e90 [0262.425] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.426] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.426] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408\\....\\temporaryfile")) returned 0 [0262.427] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408\\temporaryfile")) returned 1 [0262.428] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1599b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.428] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1599b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.428] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.428] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.428] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.428] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.429] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408\\temporaryfile")) returned 1 [0262.429] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.429] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331408" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331408")) returned 1 [0262.429] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF") returned 0 [0262.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.430] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca740*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca740*, lpNumberOfBytesWritten=0x18fdd8*=0x2030, lpOverlapped=0x0) returned 1 [0262.431] CloseHandle (hObject=0xdc) returned 1 [0262.431] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.432] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x35b2 [0262.432] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x35ba) returned 0x2c8700 [0262.432] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x35b2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x35b2, lpOverlapped=0x0) returned 1 [0262.433] CloseHandle (hObject=0xdc) returned 1 [0262.433] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf")) returned 1 [0262.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.435] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.435] GetTickCount () returned 0x50ea0 [0262.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.435] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.435] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331424\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331424\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331424\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331424\\....\\temporaryfile")) returned 0 [0262.436] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331424\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331424\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331424\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331424\\temporaryfile")) returned 1 [0262.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331424\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.437] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.437] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.437] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331424\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.437] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.437] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.438] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331424\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331424\\temporaryfile")) returned 1 [0262.438] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15bfc60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15bfc60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15bfc60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.438] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.438] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331424" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331424")) returned 1 [0262.438] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF") returned 0 [0262.438] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.439] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbcd0*, nNumberOfBytesToWrite=0x35b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbcd0*, lpNumberOfBytesWritten=0x18fdd8*=0x35b8, lpOverlapped=0x0) returned 1 [0262.440] CloseHandle (hObject=0xdc) returned 1 [0262.440] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.441] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3b2e [0262.441] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3b36) returned 0x2c8700 [0262.441] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3b2e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3b2e, lpOverlapped=0x0) returned 1 [0262.443] CloseHandle (hObject=0xdc) returned 1 [0262.443] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf")) returned 1 [0262.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.444] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.444] GetTickCount () returned 0x50eaf [0262.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.444] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331439\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331439\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331439\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331439\\....\\temporaryfile")) returned 0 [0262.450] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331439\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331439\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331439\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331439\\temporaryfile")) returned 1 [0262.451] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331439\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15e5dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15e5dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15e5dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.451] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15e5dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15e5dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15e5dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.451] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15e5dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15e5dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15e5dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.451] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331439\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15e5dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15e5dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15e5dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.451] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15e5dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15e5dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15e5dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.451] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15e5dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15e5dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15e5dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.451] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.451] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331439\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331439\\temporaryfile")) returned 1 [0262.452] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa15e5dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa15e5dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa15e5dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.452] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.452] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331439" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331439")) returned 1 [0262.452] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF") returned 0 [0262.452] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.453] WriteFile (in: hFile=0xdc, lpBuffer=0x2cc248*, nNumberOfBytesToWrite=0x3b38, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cc248*, lpNumberOfBytesWritten=0x18fdd8*=0x3b38, lpOverlapped=0x0) returned 1 [0262.454] CloseHandle (hObject=0xdc) returned 1 [0262.454] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.455] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2242 [0262.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x224a) returned 0x2c8700 [0262.456] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2242, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2242, lpOverlapped=0x0) returned 1 [0262.457] CloseHandle (hObject=0xdc) returned 1 [0262.457] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf")) returned 1 [0262.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.458] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.458] GetTickCount () returned 0x50ebf [0262.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.458] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.459] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.459] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455\\....\\temporaryfile")) returned 0 [0262.460] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455\\temporaryfile")) returned 1 [0262.462] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.462] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.462] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.462] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.462] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.462] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.462] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.462] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455\\temporaryfile")) returned 1 [0262.463] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.463] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.463] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455")) returned 1 [0262.463] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF") returned 0 [0262.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.464] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca960*, nNumberOfBytesToWrite=0x2248, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca960*, lpNumberOfBytesWritten=0x18fdd8*=0x2248, lpOverlapped=0x0) returned 1 [0262.465] CloseHandle (hObject=0xdc) returned 1 [0262.466] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.467] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8f0e [0262.467] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8f16) returned 0x2c8700 [0262.467] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8f0e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8f0e, lpOverlapped=0x0) returned 1 [0262.468] CloseHandle (hObject=0xdc) returned 1 [0262.469] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf")) returned 1 [0262.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.470] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.470] GetTickCount () returned 0x50ebf [0262.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.470] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.470] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455\\....\\temporaryfile")) returned 0 [0262.471] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455\\temporaryfile")) returned 1 [0262.472] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.472] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.472] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.472] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.472] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.473] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.473] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.473] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455\\temporaryfile")) returned 1 [0262.473] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa160bf20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa160bf20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa160bf20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.473] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.473] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331455" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331455")) returned 1 [0262.473] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF") returned 0 [0262.474] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.474] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1628*, nNumberOfBytesToWrite=0x8f18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1628*, lpNumberOfBytesWritten=0x18fdd8*=0x8f18, lpOverlapped=0x0) returned 1 [0262.476] CloseHandle (hObject=0xdc) returned 1 [0262.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.476] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x283c [0262.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2844) returned 0x2c8700 [0262.476] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x283c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x283c, lpOverlapped=0x0) returned 1 [0262.478] CloseHandle (hObject=0xdc) returned 1 [0262.478] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf")) returned 1 [0262.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.479] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.479] GetTickCount () returned 0x50ece [0262.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.479] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470\\....\\temporaryfile")) returned 0 [0262.480] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470\\temporaryfile")) returned 1 [0262.481] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.481] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.481] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.481] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.481] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.482] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.482] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.482] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470\\temporaryfile")) returned 1 [0262.482] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.482] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.482] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470")) returned 1 [0262.482] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF") returned 0 [0262.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.483] WriteFile (in: hFile=0xdc, lpBuffer=0x2caf58*, nNumberOfBytesToWrite=0x2840, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caf58*, lpNumberOfBytesWritten=0x18fdd8*=0x2840, lpOverlapped=0x0) returned 1 [0262.484] CloseHandle (hObject=0xdc) returned 1 [0262.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.485] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x514c [0262.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5154) returned 0x2c8700 [0262.485] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x514c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x514c, lpOverlapped=0x0) returned 1 [0262.486] CloseHandle (hObject=0xdc) returned 1 [0262.486] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf")) returned 1 [0262.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.487] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.487] GetTickCount () returned 0x50ece [0262.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.487] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.488] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.488] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470\\....\\temporaryfile")) returned 0 [0262.489] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470\\temporaryfile")) returned 1 [0262.490] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16581e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16581e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.490] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16581e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16581e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.490] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.490] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.490] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.490] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.490] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.491] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470\\temporaryfile")) returned 1 [0262.491] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1632080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1632080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1632080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.491] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.491] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331470" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331470")) returned 1 [0262.491] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF") returned 0 [0262.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.492] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd868*, nNumberOfBytesToWrite=0x5150, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd868*, lpNumberOfBytesWritten=0x18fdd8*=0x5150, lpOverlapped=0x0) returned 1 [0262.494] CloseHandle (hObject=0xdc) returned 1 [0262.494] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.494] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2090 [0262.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2098) returned 0x2c8700 [0262.494] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2090, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2090, lpOverlapped=0x0) returned 1 [0262.496] CloseHandle (hObject=0xdc) returned 1 [0262.496] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf")) returned 1 [0262.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.497] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.497] GetTickCount () returned 0x50ede [0262.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.497] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.498] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.498] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331486\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331486\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331486\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331486\\....\\temporaryfile")) returned 0 [0262.499] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331486\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331486\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331486\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331486\\temporaryfile")) returned 1 [0262.501] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331486\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16581e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16581e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16581e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.501] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16581e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16581e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16581e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.501] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16581e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16581e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16581e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.501] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331486\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16581e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16581e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16581e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.501] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16581e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16581e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16581e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.501] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16581e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16581e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16581e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.501] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.501] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331486\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331486\\temporaryfile")) returned 1 [0262.501] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16581e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16581e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16581e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.502] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.502] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331486" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331486")) returned 1 [0262.502] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF") returned 0 [0262.502] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.503] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca7a8*, nNumberOfBytesToWrite=0x2098, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca7a8*, lpNumberOfBytesWritten=0x18fdd8*=0x2098, lpOverlapped=0x0) returned 1 [0262.510] CloseHandle (hObject=0xdc) returned 1 [0262.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.525] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x280c [0262.525] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2814) returned 0x2c8700 [0262.525] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x280c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x280c, lpOverlapped=0x0) returned 1 [0262.529] CloseHandle (hObject=0xdc) returned 1 [0262.529] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf")) returned 1 [0262.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.530] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.530] GetTickCount () returned 0x50efd [0262.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.530] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.531] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.531] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331517\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331517\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331517\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331517\\....\\temporaryfile")) returned 0 [0262.531] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331517\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331517\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331517\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331517\\temporaryfile")) returned 1 [0262.532] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331517\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16a44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16a44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16a44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16a44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16a44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16a44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16a44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16a44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16a44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.533] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331517\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16a44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16a44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16a44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16a44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16a44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16a44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.533] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16a44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16a44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16a44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.533] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331517\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331517\\temporaryfile")) returned 1 [0262.533] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16a44a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16a44a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16a44a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.533] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.533] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331517" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331517")) returned 1 [0262.533] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF") returned 0 [0262.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.534] WriteFile (in: hFile=0xdc, lpBuffer=0x2caf28*, nNumberOfBytesToWrite=0x2810, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caf28*, lpNumberOfBytesWritten=0x18fdd8*=0x2810, lpOverlapped=0x0) returned 1 [0262.535] CloseHandle (hObject=0xdc) returned 1 [0262.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.536] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x27c0 [0262.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x27c8) returned 0x2c8700 [0262.536] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x27c0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x27c0, lpOverlapped=0x0) returned 1 [0262.538] CloseHandle (hObject=0xdc) returned 1 [0262.538] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf")) returned 1 [0262.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.539] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.539] GetTickCount () returned 0x50f0d [0262.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.539] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.539] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533\\....\\temporaryfile")) returned 0 [0262.540] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533\\temporaryfile")) returned 1 [0262.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.541] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.541] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.541] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.541] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.541] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.541] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533\\temporaryfile")) returned 1 [0262.542] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.542] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.542] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533")) returned 1 [0262.542] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF") returned 0 [0262.542] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.543] WriteFile (in: hFile=0xdc, lpBuffer=0x2caed8*, nNumberOfBytesToWrite=0x27c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caed8*, lpNumberOfBytesWritten=0x18fdd8*=0x27c8, lpOverlapped=0x0) returned 1 [0262.544] CloseHandle (hObject=0xdc) returned 1 [0262.544] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.545] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x238c [0262.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2394) returned 0x2c8700 [0262.545] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x238c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x238c, lpOverlapped=0x0) returned 1 [0262.546] CloseHandle (hObject=0xdc) returned 1 [0262.546] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf")) returned 1 [0262.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.547] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.547] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.547] GetTickCount () returned 0x50f0d [0262.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.548] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533\\....\\temporaryfile")) returned 0 [0262.553] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533\\temporaryfile")) returned 1 [0262.555] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16f0760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16f0760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.555] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16f0760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16f0760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.555] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.555] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.555] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.555] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.555] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.555] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533\\temporaryfile")) returned 1 [0262.555] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16ca600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16ca600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16ca600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.555] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.555] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331533" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331533")) returned 1 [0262.556] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF") returned 0 [0262.556] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.557] WriteFile (in: hFile=0xdc, lpBuffer=0x2caaa8*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caaa8*, lpNumberOfBytesWritten=0x18fdd8*=0x2390, lpOverlapped=0x0) returned 1 [0262.558] CloseHandle (hObject=0xdc) returned 1 [0262.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.559] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15fe [0262.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1606) returned 0x2c4a70 [0262.559] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x15fe, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x15fe, lpOverlapped=0x0) returned 1 [0262.560] CloseHandle (hObject=0xdc) returned 1 [0262.560] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf")) returned 1 [0262.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.561] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.561] GetTickCount () returned 0x50f1c [0262.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.561] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.562] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331548\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331548\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.562] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331548\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331548\\....\\temporaryfile")) returned 0 [0262.563] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331548\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331548\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331548\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331548\\temporaryfile")) returned 1 [0262.564] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331548\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16f0760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16f0760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16f0760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.564] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16f0760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16f0760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16f0760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.564] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16f0760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16f0760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16f0760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.564] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331548\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16f0760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16f0760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16f0760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.564] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16f0760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16f0760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16f0760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.564] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16f0760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16f0760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16f0760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.564] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.564] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331548\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331548\\temporaryfile")) returned 1 [0262.565] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa16f0760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa16f0760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa16f0760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.565] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.565] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331548" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331548")) returned 1 [0262.565] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF") returned 0 [0262.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.566] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1608, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1608, lpOverlapped=0x0) returned 1 [0262.567] CloseHandle (hObject=0xdc) returned 1 [0262.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.568] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2926 [0262.568] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x292e) returned 0x2c8700 [0262.568] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2926, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2926, lpOverlapped=0x0) returned 1 [0262.570] CloseHandle (hObject=0xdc) returned 1 [0262.570] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf")) returned 1 [0262.570] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.570] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.571] GetTickCount () returned 0x50f2c [0262.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.571] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564\\....\\temporaryfile")) returned 0 [0262.572] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564\\temporaryfile")) returned 1 [0262.573] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.573] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.573] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.573] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.573] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.573] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.573] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.573] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564\\temporaryfile")) returned 1 [0262.574] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.574] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.574] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564")) returned 1 [0262.574] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF") returned 0 [0262.574] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.575] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb040*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb040*, lpNumberOfBytesWritten=0x18fdd8*=0x2930, lpOverlapped=0x0) returned 1 [0262.576] CloseHandle (hObject=0xdc) returned 1 [0262.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.576] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2ea0 [0262.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ea8) returned 0x2c8700 [0262.576] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x2ea0, lpOverlapped=0x0) returned 1 [0262.578] CloseHandle (hObject=0xdc) returned 1 [0262.578] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf")) returned 1 [0262.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.579] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.579] GetTickCount () returned 0x50f2c [0262.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.579] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.579] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.580] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564\\....\\temporaryfile")) returned 0 [0262.580] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564\\temporaryfile")) returned 1 [0262.581] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.582] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.582] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.582] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.582] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.582] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.582] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.582] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564\\temporaryfile")) returned 1 [0262.582] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17168c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17168c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17168c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.582] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.582] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331564" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331564")) returned 1 [0262.583] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF") returned 0 [0262.583] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.584] WriteFile (in: hFile=0xdc, lpBuffer=0x2cb5b8*, nNumberOfBytesToWrite=0x2ea8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cb5b8*, lpNumberOfBytesWritten=0x18fdd8*=0x2ea8, lpOverlapped=0x0) returned 1 [0262.584] CloseHandle (hObject=0xdc) returned 1 [0262.586] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.586] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4f72 [0262.587] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f7a) returned 0x2c8700 [0262.587] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x4f72, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x4f72, lpOverlapped=0x0) returned 1 [0262.588] CloseHandle (hObject=0xdc) returned 1 [0262.588] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf")) returned 1 [0262.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.589] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.589] GetTickCount () returned 0x50f3c [0262.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.590] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331580\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331580\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331580\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331580\\....\\temporaryfile")) returned 0 [0262.591] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331580\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331580\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331580\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331580\\temporaryfile")) returned 1 [0262.592] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331580\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa173ca20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa173ca20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa173ca20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa173ca20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa173ca20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa173ca20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa173ca20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa173ca20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa173ca20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.593] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331580\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa173ca20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa173ca20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa173ca20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.593] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa173ca20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa173ca20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa173ca20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.593] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa173ca20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa173ca20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa173ca20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.593] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.593] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331580\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331580\\temporaryfile")) returned 1 [0262.593] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa173ca20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa173ca20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa173ca20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.593] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.593] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331580" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331580")) returned 1 [0262.593] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF") returned 0 [0262.594] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.594] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd690*, nNumberOfBytesToWrite=0x4f78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd690*, lpNumberOfBytesWritten=0x18fdd8*=0x4f78, lpOverlapped=0x0) returned 1 [0262.596] CloseHandle (hObject=0xdc) returned 1 [0262.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.596] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f74 [0262.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f7c) returned 0x2c8700 [0262.596] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1f74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f74, lpOverlapped=0x0) returned 1 [0262.598] CloseHandle (hObject=0xdc) returned 1 [0262.598] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf")) returned 1 [0262.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.599] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.599] GetTickCount () returned 0x50f4b [0262.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.600] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.600] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595\\....\\temporaryfile")) returned 0 [0262.600] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595\\temporaryfile")) returned 1 [0262.601] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.602] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.602] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.602] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.602] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.602] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.602] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.602] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595\\temporaryfile")) returned 1 [0262.602] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.602] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.602] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595")) returned 1 [0262.602] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF") returned 0 [0262.603] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.603] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca690*, nNumberOfBytesToWrite=0x1f78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca690*, lpNumberOfBytesWritten=0x18fdd8*=0x1f78, lpOverlapped=0x0) returned 1 [0262.604] CloseHandle (hObject=0xdc) returned 1 [0262.604] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.605] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e5c [0262.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e64) returned 0x2c8700 [0262.605] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x1e5c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x1e5c, lpOverlapped=0x0) returned 1 [0262.607] CloseHandle (hObject=0xdc) returned 1 [0262.607] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf")) returned 1 [0262.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.608] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.608] GetTickCount () returned 0x50f4b [0262.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.608] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.608] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.609] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595\\....\\temporaryfile")) returned 0 [0262.609] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595\\temporaryfile")) returned 1 [0262.610] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.610] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.610] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.610] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.611] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.611] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.611] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.611] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595\\temporaryfile")) returned 1 [0262.611] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1762b80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1762b80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1762b80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.611] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.611] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331595" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331595")) returned 1 [0262.611] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF") returned 0 [0262.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.612] WriteFile (in: hFile=0xdc, lpBuffer=0x2ca578*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ca578*, lpNumberOfBytesWritten=0x18fdd8*=0x1e60, lpOverlapped=0x0) returned 1 [0262.623] CloseHandle (hObject=0xdc) returned 1 [0262.623] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.624] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3642 [0262.624] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x364a) returned 0x2c8700 [0262.624] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3642, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3642, lpOverlapped=0x0) returned 1 [0262.626] CloseHandle (hObject=0xdc) returned 1 [0262.626] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf")) returned 1 [0262.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.627] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.627] GetTickCount () returned 0x50f5b [0262.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.628] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331611\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331611\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331611\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331611\\....\\temporaryfile")) returned 0 [0262.628] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331611\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331611\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331611\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331611\\temporaryfile")) returned 1 [0262.630] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331611\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1788ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1788ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1788ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.630] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1788ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1788ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1788ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.630] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1788ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1788ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1788ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.630] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331611\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1788ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1788ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1788ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.630] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1788ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1788ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1788ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.630] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1788ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1788ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1788ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.630] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.630] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331611\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331611\\temporaryfile")) returned 1 [0262.630] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1788ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1788ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1788ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.630] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.631] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331611" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331611")) returned 1 [0262.631] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF") returned 0 [0262.631] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.632] WriteFile (in: hFile=0xdc, lpBuffer=0x2cbd60*, nNumberOfBytesToWrite=0x3648, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cbd60*, lpNumberOfBytesWritten=0x18fdd8*=0x3648, lpOverlapped=0x0) returned 1 [0262.633] CloseHandle (hObject=0xdc) returned 1 [0262.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.634] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x476e [0262.634] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4776) returned 0x2c8700 [0262.634] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x476e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x476e, lpOverlapped=0x0) returned 1 [0262.636] CloseHandle (hObject=0xdc) returned 1 [0262.636] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf")) returned 1 [0262.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.637] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.637] GetTickCount () returned 0x50f6a [0262.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.637] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331626\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331626\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331626\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331626\\....\\temporaryfile")) returned 0 [0262.638] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331626\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331626\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331626\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331626\\temporaryfile")) returned 1 [0262.639] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331626\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17aee40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17aee40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17aee40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.640] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17aee40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17aee40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17aee40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.640] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17aee40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17aee40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17aee40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.640] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331626\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17aee40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17aee40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17aee40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.640] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17aee40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17aee40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17aee40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.640] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17aee40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17aee40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17aee40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.640] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.640] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331626\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331626\\temporaryfile")) returned 1 [0262.640] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17aee40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17aee40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17aee40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.640] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.640] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331626" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331626")) returned 1 [0262.640] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF") returned 0 [0262.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.641] WriteFile (in: hFile=0xdc, lpBuffer=0x2cce88*, nNumberOfBytesToWrite=0x4778, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cce88*, lpNumberOfBytesWritten=0x18fdd8*=0x4778, lpOverlapped=0x0) returned 1 [0262.643] CloseHandle (hObject=0xdc) returned 1 [0262.643] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.643] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xd8e0 [0262.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd8e8) returned 0x2c8700 [0262.643] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xd8e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xd8e0, lpOverlapped=0x0) returned 1 [0262.647] CloseHandle (hObject=0xdc) returned 1 [0262.647] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf")) returned 1 [0262.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.648] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.648] GetTickCount () returned 0x50f7a [0262.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.649] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642\\....\\temporaryfile")) returned 0 [0262.649] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642\\temporaryfile")) returned 1 [0262.651] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.651] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.651] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.651] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.651] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.651] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.651] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.651] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642\\temporaryfile")) returned 1 [0262.651] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.651] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.652] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642")) returned 1 [0262.652] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF") returned 0 [0262.653] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.653] WriteFile (in: hFile=0xdc, lpBuffer=0x2d5ff8*, nNumberOfBytesToWrite=0xd8e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d5ff8*, lpNumberOfBytesWritten=0x18fdd8*=0xd8e8, lpOverlapped=0x0) returned 1 [0262.655] CloseHandle (hObject=0xdc) returned 1 [0262.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.656] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x10cb8 [0262.656] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10cc0) returned 0x2c8700 [0262.656] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x10cb8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x10cb8, lpOverlapped=0x0) returned 1 [0262.658] CloseHandle (hObject=0xdc) returned 1 [0262.658] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf")) returned 1 [0262.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.659] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.659] GetTickCount () returned 0x50f7a [0262.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.659] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.660] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642\\....\\temporaryfile")) returned 0 [0262.660] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642\\temporaryfile")) returned 1 [0262.662] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17fb100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17fb100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.662] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17fb100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17fb100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.662] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.662] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.662] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.662] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.662] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.662] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642\\temporaryfile")) returned 1 [0262.662] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17d4fa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17d4fa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17d4fa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.662] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.662] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331642" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331642")) returned 1 [0262.662] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF") returned 0 [0262.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.664] WriteFile (in: hFile=0xdc, lpBuffer=0x2d93d0*, nNumberOfBytesToWrite=0x10cc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d93d0*, lpNumberOfBytesWritten=0x18fdd8*=0x10cc0, lpOverlapped=0x0) returned 1 [0262.666] CloseHandle (hObject=0xdc) returned 1 [0262.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.667] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7a04 [0262.667] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7a0c) returned 0x2c8700 [0262.667] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x7a04, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x7a04, lpOverlapped=0x0) returned 1 [0262.669] CloseHandle (hObject=0xdc) returned 1 [0262.669] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf")) returned 1 [0262.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.670] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.670] GetTickCount () returned 0x50f8a [0262.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.670] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.671] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331658\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331658\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331658\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331658\\....\\temporaryfile")) returned 0 [0262.671] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331658\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331658\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331658\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331658\\temporaryfile")) returned 1 [0262.673] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331658\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17fb100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17fb100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17fb100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.673] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17fb100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17fb100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17fb100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.673] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17fb100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17fb100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17fb100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.673] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331658\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17fb100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17fb100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17fb100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.673] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17fb100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17fb100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17fb100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.673] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17fb100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17fb100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17fb100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.673] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.673] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331658\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331658\\temporaryfile")) returned 1 [0262.673] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa17fb100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa17fb100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa17fb100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.673] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.673] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331658" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331658")) returned 1 [0262.674] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF") returned 0 [0262.674] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.675] WriteFile (in: hFile=0xdc, lpBuffer=0x2d0120*, nNumberOfBytesToWrite=0x7a08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d0120*, lpNumberOfBytesWritten=0x18fdd8*=0x7a08, lpOverlapped=0x0) returned 1 [0262.676] CloseHandle (hObject=0xdc) returned 1 [0262.676] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.677] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xee4a [0262.677] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xee52) returned 0x2c8700 [0262.677] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xee4a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xee4a, lpOverlapped=0x0) returned 1 [0262.679] CloseHandle (hObject=0xdc) returned 1 [0262.679] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf")) returned 1 [0262.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.680] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.680] GetTickCount () returned 0x50f99 [0262.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.681] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331673\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331673\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331673\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331673\\....\\temporaryfile")) returned 0 [0262.681] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331673\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331673\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331673\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331673\\temporaryfile")) returned 1 [0262.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331673\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1821260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1821260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1821260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1821260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1821260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1821260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1821260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1821260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1821260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.683] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331673\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1821260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1821260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1821260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.683] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1821260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1821260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1821260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.683] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1821260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1821260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1821260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.683] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.683] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331673\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331673\\temporaryfile")) returned 1 [0262.683] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1821260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1821260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1821260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.683] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.683] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331673" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331673")) returned 1 [0262.684] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF") returned 0 [0262.685] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.685] WriteFile (in: hFile=0xdc, lpBuffer=0x2d7568*, nNumberOfBytesToWrite=0xee50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d7568*, lpNumberOfBytesWritten=0x18fdd8*=0xee50, lpOverlapped=0x0) returned 1 [0262.688] CloseHandle (hObject=0xdc) returned 1 [0262.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.688] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8b96 [0262.688] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8b9e) returned 0x2c8700 [0262.688] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x8b96, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x8b96, lpOverlapped=0x0) returned 1 [0262.690] CloseHandle (hObject=0xdc) returned 1 [0262.690] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf")) returned 1 [0262.691] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.691] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.692] GetTickCount () returned 0x50fa9 [0262.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.692] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.692] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689\\....\\temporaryfile")) returned 0 [0262.693] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689\\temporaryfile")) returned 1 [0262.694] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.694] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.694] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.694] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.694] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.694] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689\\temporaryfile")) returned 1 [0262.694] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.695] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.695] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689")) returned 1 [0262.695] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF") returned 0 [0262.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.696] WriteFile (in: hFile=0xdc, lpBuffer=0x2d12b0*, nNumberOfBytesToWrite=0x8ba0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d12b0*, lpNumberOfBytesWritten=0x18fdd8*=0x8ba0, lpOverlapped=0x0) returned 1 [0262.697] CloseHandle (hObject=0xdc) returned 1 [0262.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.698] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbbe0 [0262.698] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbbe8) returned 0x2c8700 [0262.698] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0xbbe0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0xbbe0, lpOverlapped=0x0) returned 1 [0262.700] CloseHandle (hObject=0xdc) returned 1 [0262.700] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf")) returned 1 [0262.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.701] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.701] GetTickCount () returned 0x50fa9 [0262.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.702] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689\\....\\temporaryfile")) returned 0 [0262.702] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689\\temporaryfile")) returned 1 [0262.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.704] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.704] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.704] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.704] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689\\temporaryfile")) returned 1 [0262.704] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18473c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18473c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18473c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.704] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.704] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331689" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331689")) returned 1 [0262.705] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF") returned 0 [0262.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.706] WriteFile (in: hFile=0xdc, lpBuffer=0x2d42f8*, nNumberOfBytesToWrite=0xbbe8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d42f8*, lpNumberOfBytesWritten=0x18fdd8*=0xbbe8, lpOverlapped=0x0) returned 1 [0262.708] CloseHandle (hObject=0xdc) returned 1 [0262.708] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.712] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x934c [0262.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9354) returned 0x2c8700 [0262.712] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x934c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x934c, lpOverlapped=0x0) returned 1 [0262.714] CloseHandle (hObject=0xdc) returned 1 [0262.714] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf")) returned 1 [0262.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.715] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.715] GetTickCount () returned 0x50fb8 [0262.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.715] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.716] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.716] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331704\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331704\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.716] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331704\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331704\\....\\temporaryfile")) returned 0 [0262.716] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331704\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331704\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331704\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331704\\temporaryfile")) returned 1 [0262.717] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331704\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa186d520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa186d520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa186d520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.717] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa186d520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa186d520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa186d520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.718] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa186d520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa186d520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa186d520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.718] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331704\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa186d520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa186d520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa186d520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.718] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa186d520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa186d520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa186d520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.718] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa186d520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa186d520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa186d520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.718] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.718] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331704\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331704\\temporaryfile")) returned 1 [0262.718] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa186d520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa186d520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa186d520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.718] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.718] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331704" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331704")) returned 1 [0262.718] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF") returned 0 [0262.719] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.720] WriteFile (in: hFile=0xdc, lpBuffer=0x2d1a68*, nNumberOfBytesToWrite=0x9350, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d1a68*, lpNumberOfBytesWritten=0x18fdd8*=0x9350, lpOverlapped=0x0) returned 1 [0262.721] CloseHandle (hObject=0xdc) returned 1 [0262.721] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.722] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1948 [0262.722] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1950) returned 0x2c4a70 [0262.722] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1948, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1948, lpOverlapped=0x0) returned 1 [0262.723] CloseHandle (hObject=0xdc) returned 1 [0262.723] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf")) returned 1 [0262.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.724] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.724] GetTickCount () returned 0x50fc8 [0262.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.724] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.725] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.725] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720\\....\\temporaryfile")) returned 0 [0262.725] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720\\temporaryfile")) returned 1 [0262.727] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.727] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.727] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.727] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.727] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.727] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.727] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.727] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720\\temporaryfile")) returned 1 [0262.727] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.727] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.727] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720")) returned 1 [0262.728] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF") returned 0 [0262.728] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.728] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8708*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1950, lpOverlapped=0x0) returned 1 [0262.729] CloseHandle (hObject=0xdc) returned 1 [0262.729] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.730] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x51ea [0262.730] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x51f2) returned 0x2c8700 [0262.730] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x51ea, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x51ea, lpOverlapped=0x0) returned 1 [0262.732] CloseHandle (hObject=0xdc) returned 1 [0262.732] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf")) returned 1 [0262.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.733] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.733] GetTickCount () returned 0x50fc8 [0262.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.733] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.734] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720\\....\\temporaryfile")) returned 0 [0262.734] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720\\temporaryfile")) returned 1 [0262.735] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.735] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.735] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.735] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.735] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.736] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.736] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.736] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720\\temporaryfile")) returned 1 [0262.736] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1893680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1893680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1893680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.736] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.736] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331720" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331720")) returned 1 [0262.736] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF") returned 0 [0262.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.737] WriteFile (in: hFile=0xdc, lpBuffer=0x2cd908*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cd908*, lpNumberOfBytesWritten=0x18fdd8*=0x51f0, lpOverlapped=0x0) returned 1 [0262.739] CloseHandle (hObject=0xdc) returned 1 [0262.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.739] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3308 [0262.739] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3310) returned 0x2c8700 [0262.739] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x3308, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x3308, lpOverlapped=0x0) returned 1 [0262.741] CloseHandle (hObject=0xdc) returned 1 [0262.741] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf")) returned 1 [0262.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.742] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.742] GetTickCount () returned 0x50fd8 [0262.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.742] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736\\....\\temporaryfile")) returned 0 [0262.743] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736\\temporaryfile")) returned 1 [0262.744] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.744] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.745] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.745] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.745] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.745] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.745] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736\\temporaryfile")) returned 1 [0262.745] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.745] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.745] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736")) returned 1 [0262.745] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF") returned 0 [0262.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.746] WriteFile (in: hFile=0xdc, lpBuffer=0x2cba20*, nNumberOfBytesToWrite=0x3310, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cba20*, lpNumberOfBytesWritten=0x18fdd8*=0x3310, lpOverlapped=0x0) returned 1 [0262.747] CloseHandle (hObject=0xdc) returned 1 [0262.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.748] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x27f4 [0262.748] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x27fc) returned 0x2c8700 [0262.748] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x27f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x27f4, lpOverlapped=0x0) returned 1 [0262.749] CloseHandle (hObject=0xdc) returned 1 [0262.750] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf")) returned 1 [0262.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.750] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.750] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.750] GetTickCount () returned 0x50fd8 [0262.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.751] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736\\....\\temporaryfile")) returned 0 [0262.752] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736\\temporaryfile")) returned 1 [0262.753] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.753] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.753] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.753] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.753] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.753] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.753] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.753] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736\\temporaryfile")) returned 1 [0262.754] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18b97e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18b97e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18b97e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.754] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.754] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331736" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331736")) returned 1 [0262.754] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF") returned 0 [0262.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.755] WriteFile (in: hFile=0xdc, lpBuffer=0x2caf10*, nNumberOfBytesToWrite=0x27f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2caf10*, lpNumberOfBytesWritten=0x18fdd8*=0x27f8, lpOverlapped=0x0) returned 1 [0262.756] CloseHandle (hObject=0xdc) returned 1 [0262.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.757] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb7c [0262.757] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb84) returned 0x2450048 [0262.757] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xb7c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xb7c, lpOverlapped=0x0) returned 1 [0262.758] CloseHandle (hObject=0xdc) returned 1 [0262.758] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf")) returned 1 [0262.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.759] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.759] GetTickCount () returned 0x50fe7 [0262.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.759] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.760] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751\\....\\temporaryfile")) returned 0 [0262.760] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751\\temporaryfile")) returned 1 [0262.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18df940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18df940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18df940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.762] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18df940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18df940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18df940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.762] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18df940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18df940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18df940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.762] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18df940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18df940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18df940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.762] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18df940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18df940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18df940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.762] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18df940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18df940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18df940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.762] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.762] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751\\temporaryfile")) returned 1 [0262.762] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18df940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa18df940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa18df940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.762] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.762] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751")) returned 1 [0262.762] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF") returned 0 [0262.763] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.763] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xb80, lpOverlapped=0x0) returned 1 [0262.764] CloseHandle (hObject=0xdc) returned 1 [0262.765] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.766] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x828 [0262.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x830) returned 0x2450048 [0262.766] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x828, lpOverlapped=0x0) returned 1 [0262.767] CloseHandle (hObject=0xdc) returned 1 [0262.767] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf")) returned 1 [0262.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.768] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.768] GetTickCount () returned 0x50fe7 [0262.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.768] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.774] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751\\....\\temporaryfile")) returned 0 [0262.775] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751\\temporaryfile")) returned 1 [0262.776] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18df940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.776] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa18df940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.776] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.776] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.776] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.776] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.776] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.776] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751\\temporaryfile")) returned 1 [0262.777] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.777] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.777] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331751" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331751")) returned 1 [0262.777] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF") returned 0 [0262.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.778] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x830, lpOverlapped=0x0) returned 1 [0262.779] CloseHandle (hObject=0xdc) returned 1 [0262.779] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.779] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x704e [0262.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7056) returned 0x2c8700 [0262.779] ReadFile (in: hFile=0xdc, lpBuffer=0x2c8708, nNumberOfBytesToRead=0x704e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c8708*, lpNumberOfBytesRead=0x18fdf0*=0x704e, lpOverlapped=0x0) returned 1 [0262.781] CloseHandle (hObject=0xdc) returned 1 [0262.781] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf")) returned 1 [0262.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.783] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.783] GetTickCount () returned 0x50ff7 [0262.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.783] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331767\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331767\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.784] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331767\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331767\\....\\temporaryfile")) returned 0 [0262.784] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331767\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331767\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331767\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331767\\temporaryfile")) returned 1 [0262.785] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331767\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.785] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.786] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.786] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331767\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.786] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.786] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.786] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.786] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331767\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331767\\temporaryfile")) returned 1 [0262.786] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1905aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1905aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1905aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.786] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.786] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331767" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331767")) returned 1 [0262.786] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF") returned 0 [0262.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.787] WriteFile (in: hFile=0xdc, lpBuffer=0x2cf768*, nNumberOfBytesToWrite=0x7058, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2cf768*, lpNumberOfBytesWritten=0x18fdd8*=0x7058, lpOverlapped=0x0) returned 1 [0262.789] CloseHandle (hObject=0xdc) returned 1 [0262.789] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.790] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x143c [0262.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1444) returned 0x25b528 [0262.790] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x143c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x143c, lpOverlapped=0x0) returned 1 [0262.791] CloseHandle (hObject=0xdc) returned 1 [0262.791] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf")) returned 1 [0262.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.792] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.792] GetTickCount () returned 0x51006 [0262.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.793] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.793] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.793] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782\\....\\temporaryfile")) returned 0 [0262.793] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782\\temporaryfile")) returned 1 [0262.794] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa192bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa192bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa192bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.794] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa192bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa192bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa192bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.795] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa192bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa192bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa192bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.795] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa192bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa192bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa192bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.795] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa192bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa192bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa192bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.795] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa192bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa192bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa192bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.795] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.795] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782\\temporaryfile")) returned 1 [0262.795] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa192bc00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa192bc00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa192bc00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.795] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.795] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782")) returned 1 [0262.795] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF") returned 0 [0262.796] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.796] WriteFile (in: hFile=0xdc, lpBuffer=0x2c8720*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c8720*, lpNumberOfBytesWritten=0x18fdd8*=0x1440, lpOverlapped=0x0) returned 1 [0262.797] CloseHandle (hObject=0xdc) returned 1 [0262.797] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.798] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1544 [0262.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x154c) returned 0x29b460 [0262.798] ReadFile (in: hFile=0xdc, lpBuffer=0x29b468, nNumberOfBytesToRead=0x1544, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesRead=0x18fdf0*=0x1544, lpOverlapped=0x0) returned 1 [0262.799] CloseHandle (hObject=0xdc) returned 1 [0262.799] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf")) returned 1 [0262.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.800] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.800] GetTickCount () returned 0x51006 [0262.800] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.801] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.801] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782\\....\\temporaryfile")) returned 0 [0262.802] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782\\temporaryfile")) returned 1 [0262.803] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.803] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.803] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.803] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.803] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.803] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.803] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.803] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782\\temporaryfile")) returned 1 [0262.803] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.803] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.804] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331782" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331782")) returned 1 [0262.804] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF") returned 0 [0262.804] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.805] WriteFile (in: hFile=0xdc, lpBuffer=0x2c4a78*, nNumberOfBytesToWrite=0x1548, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesWritten=0x18fdd8*=0x1548, lpOverlapped=0x0) returned 1 [0262.805] CloseHandle (hObject=0xdc) returned 1 [0262.806] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.807] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x878 [0262.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x880) returned 0x2450048 [0262.807] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x878, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x878, lpOverlapped=0x0) returned 1 [0262.808] CloseHandle (hObject=0xdc) returned 1 [0262.808] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf")) returned 1 [0262.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.809] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.809] GetTickCount () returned 0x51016 [0262.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.809] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.810] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.810] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331798\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331798\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.810] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331798\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331798\\....\\temporaryfile")) returned 0 [0262.811] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331798\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331798\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331798\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331798\\temporaryfile")) returned 1 [0262.812] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331798\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.812] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.812] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.812] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331798\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.812] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.812] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.812] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.812] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331798\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331798\\temporaryfile")) returned 1 [0262.812] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1951d60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1951d60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1951d60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.812] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.813] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331798" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331798")) returned 1 [0262.813] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF") returned 0 [0262.813] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.814] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x880, lpOverlapped=0x0) returned 1 [0262.814] CloseHandle (hObject=0xdc) returned 1 [0262.815] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.815] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x59ec [0262.815] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x59f4) returned 0x2e8700 [0262.815] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x59ec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x59ec, lpOverlapped=0x0) returned 1 [0262.817] CloseHandle (hObject=0xdc) returned 1 [0262.817] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf")) returned 1 [0262.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.818] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.818] GetTickCount () returned 0x51026 [0262.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.818] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814\\....\\temporaryfile")) returned 0 [0262.819] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814\\temporaryfile")) returned 1 [0262.820] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.820] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.820] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.820] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.821] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.821] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.821] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.821] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814\\temporaryfile")) returned 1 [0262.821] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.821] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.821] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814")) returned 1 [0262.821] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF") returned 0 [0262.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.822] WriteFile (in: hFile=0xdc, lpBuffer=0x2ee108*, nNumberOfBytesToWrite=0x59f0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ee108*, lpNumberOfBytesWritten=0x18fdd8*=0x59f0, lpOverlapped=0x0) returned 1 [0262.823] CloseHandle (hObject=0xdc) returned 1 [0262.824] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.825] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb6c [0262.825] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb74) returned 0x2450048 [0262.825] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xb6c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xb6c, lpOverlapped=0x0) returned 1 [0262.827] CloseHandle (hObject=0xdc) returned 1 [0262.827] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf")) returned 1 [0262.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.828] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.828] GetTickCount () returned 0x51026 [0262.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.828] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814\\....\\temporaryfile")) returned 0 [0262.829] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814\\temporaryfile")) returned 1 [0262.830] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.830] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.830] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.830] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.831] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.831] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.831] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.831] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814\\temporaryfile")) returned 1 [0262.831] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1977ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1977ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1977ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.831] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.831] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331814" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331814")) returned 1 [0262.831] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF") returned 0 [0262.831] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.832] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xb70, lpOverlapped=0x0) returned 1 [0262.833] CloseHandle (hObject=0xdc) returned 1 [0262.833] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.834] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xac8 [0262.834] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xad0) returned 0x2450048 [0262.834] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xac8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xac8, lpOverlapped=0x0) returned 1 [0262.835] CloseHandle (hObject=0xdc) returned 1 [0262.835] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf")) returned 1 [0262.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.836] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.836] GetTickCount () returned 0x51035 [0262.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.837] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.837] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829\\....\\temporaryfile")) returned 0 [0262.837] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829\\temporaryfile")) returned 1 [0262.839] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.839] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.839] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.839] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.839] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.839] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.839] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.839] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829\\temporaryfile")) returned 1 [0262.839] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.839] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.839] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829")) returned 1 [0262.840] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF") returned 0 [0262.840] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.840] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xad0, lpOverlapped=0x0) returned 1 [0262.841] CloseHandle (hObject=0xdc) returned 1 [0262.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.842] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xfc0 [0262.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfc8) returned 0x25f580 [0262.842] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xfc0, lpOverlapped=0x0) returned 1 [0262.843] CloseHandle (hObject=0xdc) returned 1 [0262.844] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf")) returned 1 [0262.844] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.844] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.844] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.844] GetTickCount () returned 0x51035 [0262.844] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.845] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829\\....\\temporaryfile")) returned 0 [0262.846] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829\\temporaryfile")) returned 1 [0262.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.847] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.847] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.847] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.847] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.848] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.848] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829\\temporaryfile")) returned 1 [0262.848] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa199e020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa199e020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa199e020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.848] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.848] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331829" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331829")) returned 1 [0262.848] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF") returned 0 [0262.848] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.849] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xfc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xfc8, lpOverlapped=0x0) returned 1 [0262.850] CloseHandle (hObject=0xdc) returned 1 [0262.850] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.851] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5b08 [0262.851] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b10) returned 0x2e8700 [0262.851] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x5b08, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x5b08, lpOverlapped=0x0) returned 1 [0262.852] CloseHandle (hObject=0xdc) returned 1 [0262.852] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf")) returned 1 [0262.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.853] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.854] GetTickCount () returned 0x51045 [0262.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.854] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.854] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845\\....\\temporaryfile")) returned 0 [0262.855] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845\\temporaryfile")) returned 1 [0262.856] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19c4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19c4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19c4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.856] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19c4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19c4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19c4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.856] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19c4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19c4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19c4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.856] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19c4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19c4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19c4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.856] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19c4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19c4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19c4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.856] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19c4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19c4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19c4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.856] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.856] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845\\temporaryfile")) returned 1 [0262.856] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19c4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19c4180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19c4180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.857] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.857] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845")) returned 1 [0262.857] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF") returned 0 [0262.857] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.858] WriteFile (in: hFile=0xdc, lpBuffer=0x2ee220*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ee220*, lpNumberOfBytesWritten=0x18fdd8*=0x5b10, lpOverlapped=0x0) returned 1 [0262.859] CloseHandle (hObject=0xdc) returned 1 [0262.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.860] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2bb8 [0262.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2bc0) returned 0x2e8700 [0262.860] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2bb8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2bb8, lpOverlapped=0x0) returned 1 [0262.861] CloseHandle (hObject=0xdc) returned 1 [0262.861] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf")) returned 1 [0262.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.862] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.862] GetTickCount () returned 0x51045 [0262.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.863] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845\\....\\temporaryfile")) returned 0 [0262.864] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845\\temporaryfile")) returned 1 [0262.865] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19c4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.866] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19c4180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.866] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.866] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.866] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.866] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.866] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845\\temporaryfile")) returned 1 [0262.866] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.866] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.866] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331845" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331845")) returned 1 [0262.866] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF") returned 0 [0262.867] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.867] WriteFile (in: hFile=0xdc, lpBuffer=0x2eb2d0*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eb2d0*, lpNumberOfBytesWritten=0x18fdd8*=0x2bc0, lpOverlapped=0x0) returned 1 [0262.868] CloseHandle (hObject=0xdc) returned 1 [0262.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.870] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1e58 [0262.870] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e60) returned 0x2e8700 [0262.870] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x1e58, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x1e58, lpOverlapped=0x0) returned 1 [0262.871] CloseHandle (hObject=0xdc) returned 1 [0262.871] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf")) returned 1 [0262.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.872] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.872] GetTickCount () returned 0x51054 [0262.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.873] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.873] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331860\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331860\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331860\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331860\\....\\temporaryfile")) returned 0 [0262.873] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331860\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331860\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331860\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331860\\temporaryfile")) returned 1 [0262.875] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331860\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.875] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.875] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.875] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331860\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.875] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.875] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.875] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.875] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331860\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331860\\temporaryfile")) returned 1 [0262.875] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa19ea2e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa19ea2e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa19ea2e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.875] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.875] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331860" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331860")) returned 1 [0262.876] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF") returned 0 [0262.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.876] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea570*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea570*, lpNumberOfBytesWritten=0x18fdd8*=0x1e60, lpOverlapped=0x0) returned 1 [0262.877] CloseHandle (hObject=0xdc) returned 1 [0262.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.878] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaa4 [0262.878] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaac) returned 0x2450048 [0262.878] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xaa4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xaa4, lpOverlapped=0x0) returned 1 [0262.880] CloseHandle (hObject=0xdc) returned 1 [0262.880] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf")) returned 1 [0262.880] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.881] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.881] GetTickCount () returned 0x51064 [0262.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.881] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876\\....\\temporaryfile")) returned 0 [0262.882] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876\\temporaryfile")) returned 1 [0262.883] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.883] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.883] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.883] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.883] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.883] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.883] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.883] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876\\temporaryfile")) returned 1 [0262.883] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.884] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.884] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876")) returned 1 [0262.884] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF") returned 0 [0262.884] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.885] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xaa8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xaa8, lpOverlapped=0x0) returned 1 [0262.886] CloseHandle (hObject=0xdc) returned 1 [0262.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.886] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1724 [0262.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x172c) returned 0x2c4a70 [0262.886] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1724, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1724, lpOverlapped=0x0) returned 1 [0262.888] CloseHandle (hObject=0xdc) returned 1 [0262.888] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf")) returned 1 [0262.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.889] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.889] GetTickCount () returned 0x51064 [0262.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.889] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.889] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876\\....\\temporaryfile")) returned 0 [0262.890] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876\\temporaryfile")) returned 1 [0262.891] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.891] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.892] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.892] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.892] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.892] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.892] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876\\temporaryfile")) returned 1 [0262.892] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a10440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a10440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a10440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.892] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.892] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331876" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331876")) returned 1 [0262.892] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF") returned 0 [0262.893] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.893] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1728, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1728, lpOverlapped=0x0) returned 1 [0262.894] CloseHandle (hObject=0xdc) returned 1 [0262.895] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.896] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2602 [0262.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x260a) returned 0x2e8700 [0262.896] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2602, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2602, lpOverlapped=0x0) returned 1 [0262.897] CloseHandle (hObject=0xdc) returned 1 [0262.897] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf")) returned 1 [0262.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.898] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.898] GetTickCount () returned 0x51074 [0262.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.899] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.899] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331892\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331892\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331892\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331892\\....\\temporaryfile")) returned 0 [0262.899] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331892\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331892\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331892\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331892\\temporaryfile")) returned 1 [0262.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331892\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a365a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a365a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a365a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.905] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a365a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a365a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a365a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.905] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a365a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a365a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a365a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.905] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331892\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a365a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a365a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a365a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.906] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a365a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a365a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a365a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.906] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a365a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a365a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a365a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.906] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331892\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331892\\temporaryfile")) returned 1 [0262.906] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a365a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a365a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a365a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.906] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.906] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331892" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331892")) returned 1 [0262.906] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF") returned 0 [0262.907] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.907] WriteFile (in: hFile=0xdc, lpBuffer=0x2ead20*, nNumberOfBytesToWrite=0x2608, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ead20*, lpNumberOfBytesWritten=0x18fdd8*=0x2608, lpOverlapped=0x0) returned 1 [0262.908] CloseHandle (hObject=0xdc) returned 1 [0262.909] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.909] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6260 [0262.909] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6268) returned 0x2e8700 [0262.909] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x6260, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x6260, lpOverlapped=0x0) returned 1 [0262.911] CloseHandle (hObject=0xdc) returned 1 [0262.911] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf")) returned 1 [0262.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.912] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.912] GetTickCount () returned 0x51083 [0262.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.912] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.913] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907\\....\\temporaryfile")) returned 0 [0262.913] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907\\temporaryfile")) returned 1 [0262.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.915] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.915] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.915] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.915] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.915] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.915] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.915] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907\\temporaryfile")) returned 1 [0262.915] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.915] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.915] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907")) returned 1 [0262.915] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF") returned 0 [0262.916] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.917] WriteFile (in: hFile=0xdc, lpBuffer=0x2ee978*, nNumberOfBytesToWrite=0x6268, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ee978*, lpNumberOfBytesWritten=0x18fdd8*=0x6268, lpOverlapped=0x0) returned 1 [0262.918] CloseHandle (hObject=0xdc) returned 1 [0262.918] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.919] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9c80 [0262.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9c88) returned 0x2e8700 [0262.919] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x9c80, lpOverlapped=0x0) returned 1 [0262.921] CloseHandle (hObject=0xdc) returned 1 [0262.921] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf")) returned 1 [0262.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.922] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.922] GetTickCount () returned 0x51083 [0262.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.922] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907\\....\\temporaryfile")) returned 0 [0262.923] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907\\temporaryfile")) returned 1 [0262.924] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.925] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.925] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.925] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.925] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.925] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.925] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.925] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907\\temporaryfile")) returned 1 [0262.925] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a5c700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a5c700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a5c700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.925] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.925] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331907" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331907")) returned 1 [0262.926] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF") returned 0 [0262.926] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.927] WriteFile (in: hFile=0xdc, lpBuffer=0x2f2398*, nNumberOfBytesToWrite=0x9c88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2f2398*, lpNumberOfBytesWritten=0x18fdd8*=0x9c88, lpOverlapped=0x0) returned 1 [0262.929] CloseHandle (hObject=0xdc) returned 1 [0262.929] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.930] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xfe6 [0262.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfee) returned 0x25f580 [0262.930] ReadFile (in: hFile=0xdc, lpBuffer=0x25f588, nNumberOfBytesToRead=0xfe6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesRead=0x18fdf0*=0xfe6, lpOverlapped=0x0) returned 1 [0262.931] CloseHandle (hObject=0xdc) returned 1 [0262.931] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf")) returned 1 [0262.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.932] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.932] GetTickCount () returned 0x51093 [0262.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.933] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331923\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331923\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331923\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331923\\....\\temporaryfile")) returned 0 [0262.933] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331923\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331923\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331923\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331923\\temporaryfile")) returned 1 [0262.935] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331923\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a82860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a82860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a82860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.935] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a82860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a82860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a82860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.935] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a82860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a82860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a82860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.935] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331923\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a82860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a82860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a82860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.935] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a82860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a82860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a82860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.935] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a82860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a82860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a82860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.935] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.935] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331923\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331923\\temporaryfile")) returned 1 [0262.935] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1a82860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1a82860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1a82860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.935] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.936] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331923" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331923")) returned 1 [0262.936] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF") returned 0 [0262.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.937] WriteFile (in: hFile=0xdc, lpBuffer=0x25b530*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesWritten=0x18fdd8*=0xff0, lpOverlapped=0x0) returned 1 [0262.938] CloseHandle (hObject=0xdc) returned 1 [0262.938] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.938] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5006 [0262.938] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x500e) returned 0x2e8700 [0262.938] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x5006, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x5006, lpOverlapped=0x0) returned 1 [0262.940] CloseHandle (hObject=0xdc) returned 1 [0262.940] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf")) returned 1 [0262.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.941] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.941] GetTickCount () returned 0x510a2 [0262.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.942] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938\\....\\temporaryfile")) returned 0 [0262.942] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938\\temporaryfile")) returned 1 [0262.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.943] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.944] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.944] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.944] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.944] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.944] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938\\temporaryfile")) returned 1 [0262.944] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.944] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938")) returned 1 [0262.944] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF") returned 0 [0262.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.945] WriteFile (in: hFile=0xdc, lpBuffer=0x2ed720*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ed720*, lpNumberOfBytesWritten=0x18fdd8*=0x5010, lpOverlapped=0x0) returned 1 [0262.946] CloseHandle (hObject=0xdc) returned 1 [0262.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.948] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1aba [0262.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1ac2) returned 0x2c4a70 [0262.948] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1aba, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1aba, lpOverlapped=0x0) returned 1 [0262.949] CloseHandle (hObject=0xdc) returned 1 [0262.949] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf")) returned 1 [0262.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.950] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.950] GetTickCount () returned 0x510a2 [0262.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.951] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938\\....\\temporaryfile")) returned 0 [0262.952] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938\\temporaryfile")) returned 1 [0262.953] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.953] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.953] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.953] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.953] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.953] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.953] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.953] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938\\temporaryfile")) returned 1 [0262.953] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aa89c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aa89c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aa89c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.954] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.954] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331938" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331938")) returned 1 [0262.954] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF") returned 0 [0262.954] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.955] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1ac0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1ac0, lpOverlapped=0x0) returned 1 [0262.956] CloseHandle (hObject=0xdc) returned 1 [0262.956] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.957] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x584 [0262.957] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x58c) returned 0x259e70 [0262.957] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x584, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x584, lpOverlapped=0x0) returned 1 [0262.958] CloseHandle (hObject=0xdc) returned 1 [0262.958] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf")) returned 1 [0262.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.959] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.959] GetTickCount () returned 0x510b2 [0262.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.959] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.960] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.960] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954\\....\\temporaryfile")) returned 0 [0262.960] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954\\temporaryfile")) returned 1 [0262.962] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.962] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.962] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.962] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.962] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.962] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.962] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.962] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954\\temporaryfile")) returned 1 [0262.962] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.962] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.962] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954")) returned 1 [0262.962] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF") returned 0 [0262.963] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.963] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x588, lpOverlapped=0x0) returned 1 [0262.965] CloseHandle (hObject=0xdc) returned 1 [0262.965] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.966] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1652 [0262.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x165a) returned 0x2c4a70 [0262.966] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1652, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1652, lpOverlapped=0x0) returned 1 [0262.967] CloseHandle (hObject=0xdc) returned 1 [0262.967] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf")) returned 1 [0262.968] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.968] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.969] GetTickCount () returned 0x510b2 [0262.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.969] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.970] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954\\....\\temporaryfile")) returned 0 [0262.971] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954\\temporaryfile")) returned 1 [0262.973] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.973] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.973] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.973] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.973] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.973] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954\\temporaryfile")) returned 1 [0262.973] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1aceb20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1aceb20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1aceb20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.974] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.974] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331954" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331954")) returned 1 [0262.974] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF") returned 0 [0262.974] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.975] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1658, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1658, lpOverlapped=0x0) returned 1 [0262.976] CloseHandle (hObject=0xdc) returned 1 [0262.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.977] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16c0 [0262.977] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16c8) returned 0x2c4a70 [0262.977] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16c0, lpOverlapped=0x0) returned 1 [0262.979] CloseHandle (hObject=0xdc) returned 1 [0262.979] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf")) returned 1 [0262.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.980] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.980] GetTickCount () returned 0x510c2 [0262.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.980] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.981] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331970\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331970\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331970\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331970\\....\\temporaryfile")) returned 0 [0262.981] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331970\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331970\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331970\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331970\\temporaryfile")) returned 1 [0262.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331970\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1af4c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1af4c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1af4c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1af4c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1af4c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1af4c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1af4c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1af4c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1af4c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.983] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331970\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1af4c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1af4c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1af4c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.983] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1af4c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1af4c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1af4c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.983] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1af4c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1af4c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1af4c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.983] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331970\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331970\\temporaryfile")) returned 1 [0262.983] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1af4c80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1af4c80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1af4c80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.983] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.983] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331970" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331970")) returned 1 [0262.983] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF") returned 0 [0262.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.985] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x16c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x16c8, lpOverlapped=0x0) returned 1 [0262.985] CloseHandle (hObject=0xdc) returned 1 [0262.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.986] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5d0 [0262.986] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5d8) returned 0x259e70 [0262.986] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5d0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5d0, lpOverlapped=0x0) returned 1 [0262.988] CloseHandle (hObject=0xdc) returned 1 [0262.988] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf")) returned 1 [0262.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0262.989] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.989] GetTickCount () returned 0x510d1 [0262.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.989] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.989] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985\\...."), lpSecurityAttributes=0x256228) returned 1 [0262.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985\\....\\temporaryfile")) returned 0 [0262.990] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985\\temporaryfile")) returned 1 [0262.991] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0262.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.991] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0262.991] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0262.991] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.992] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0262.992] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0262.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985\\temporaryfile")) returned 1 [0262.992] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0262.992] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0262.992] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985")) returned 1 [0262.992] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF") returned 0 [0262.992] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.993] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x5d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x5d8, lpOverlapped=0x0) returned 1 [0262.994] CloseHandle (hObject=0xdc) returned 1 [0262.994] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0262.995] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x62b6 [0262.995] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x62be) returned 0x2e8700 [0262.995] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x62b6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x62b6, lpOverlapped=0x0) returned 1 [0262.997] CloseHandle (hObject=0xdc) returned 1 [0262.997] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf")) returned 1 [0262.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0262.998] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0262.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0262.998] GetTickCount () returned 0x510d1 [0262.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0262.998] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0262.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0262.999] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985\\...."), lpSecurityAttributes=0x256210) returned 1 [0262.999] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985\\....\\temporaryfile")) returned 0 [0263.000] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985\\temporaryfile")) returned 1 [0263.001] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.001] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.001] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.001] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.001] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.001] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.001] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.002] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985\\temporaryfile")) returned 1 [0263.002] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b1ade0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b1ade0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b1ade0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.002] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.002] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18331985" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18331985")) returned 1 [0263.002] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF") returned 0 [0263.003] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.004] WriteFile (in: hFile=0xdc, lpBuffer=0x2ee9d0*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ee9d0*, lpNumberOfBytesWritten=0x18fdd8*=0x62c0, lpOverlapped=0x0) returned 1 [0263.005] CloseHandle (hObject=0xdc) returned 1 [0263.006] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.007] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6302 [0263.007] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x630a) returned 0x2e8700 [0263.007] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x6302, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x6302, lpOverlapped=0x0) returned 1 [0263.009] CloseHandle (hObject=0xdc) returned 1 [0263.009] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf")) returned 1 [0263.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.010] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.010] GetTickCount () returned 0x510e1 [0263.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.010] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.010] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332001\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332001\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.011] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332001\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332001\\....\\temporaryfile")) returned 0 [0263.011] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332001\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332001\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332001\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332001\\temporaryfile")) returned 1 [0263.012] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332001\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b40f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b40f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b40f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.012] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b40f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b40f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b40f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.012] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b40f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b40f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b40f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.012] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332001\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b40f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b40f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b40f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.013] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b40f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b40f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b40f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.013] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b40f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b40f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b40f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.013] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.013] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332001\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332001\\temporaryfile")) returned 1 [0263.013] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b40f40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b40f40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b40f40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.013] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.013] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332001" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332001")) returned 1 [0263.013] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF") returned 0 [0263.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.015] WriteFile (in: hFile=0xdc, lpBuffer=0x2eea20*, nNumberOfBytesToWrite=0x6308, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eea20*, lpNumberOfBytesWritten=0x18fdd8*=0x6308, lpOverlapped=0x0) returned 1 [0263.016] CloseHandle (hObject=0xdc) returned 1 [0263.016] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.017] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3636 [0263.017] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x363e) returned 0x2e8700 [0263.017] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x3636, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x3636, lpOverlapped=0x0) returned 1 [0263.018] CloseHandle (hObject=0xdc) returned 1 [0263.018] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf")) returned 1 [0263.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.020] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.020] GetTickCount () returned 0x510f0 [0263.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.020] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.020] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016\\....\\temporaryfile")) returned 0 [0263.021] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016\\temporaryfile")) returned 1 [0263.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.022] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.022] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.022] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.023] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.023] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.023] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016\\temporaryfile")) returned 1 [0263.023] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.023] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.023] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016")) returned 1 [0263.023] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF") returned 0 [0263.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.024] WriteFile (in: hFile=0xdc, lpBuffer=0x2ebd50*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ebd50*, lpNumberOfBytesWritten=0x18fdd8*=0x3640, lpOverlapped=0x0) returned 1 [0263.025] CloseHandle (hObject=0xdc) returned 1 [0263.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.026] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16478 [0263.026] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16480) returned 0x2e8700 [0263.026] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x16478, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x16478, lpOverlapped=0x0) returned 1 [0263.028] CloseHandle (hObject=0xdc) returned 1 [0263.028] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf")) returned 1 [0263.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.030] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.030] GetTickCount () returned 0x510f0 [0263.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.030] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016\\....\\temporaryfile")) returned 0 [0263.031] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016\\temporaryfile")) returned 1 [0263.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.033] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.033] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.033] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.033] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.033] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.033] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016\\temporaryfile")) returned 1 [0263.033] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b670a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b670a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b670a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.033] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.033] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332016" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332016")) returned 1 [0263.033] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF") returned 0 [0263.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.036] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x16480, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x16480, lpOverlapped=0x0) returned 1 [0263.038] CloseHandle (hObject=0xdc) returned 1 [0263.038] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.038] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1758 [0263.038] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1760) returned 0x2c4a70 [0263.039] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1758, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1758, lpOverlapped=0x0) returned 1 [0263.040] CloseHandle (hObject=0xdc) returned 1 [0263.040] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf")) returned 1 [0263.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.041] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.041] GetTickCount () returned 0x51100 [0263.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.041] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.042] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.042] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332032\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332032\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332032\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332032\\....\\temporaryfile")) returned 0 [0263.043] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332032\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332032\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332032\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332032\\temporaryfile")) returned 1 [0263.045] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332032\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b8d200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b8d200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b8d200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.045] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b8d200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b8d200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b8d200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.045] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b8d200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b8d200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b8d200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.045] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332032\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b8d200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b8d200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b8d200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.045] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b8d200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b8d200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b8d200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.045] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b8d200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b8d200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b8d200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.045] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.045] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332032\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332032\\temporaryfile")) returned 1 [0263.045] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1b8d200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1b8d200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1b8d200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.046] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.046] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332032" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332032")) returned 1 [0263.046] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF") returned 0 [0263.046] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.052] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1760, lpOverlapped=0x0) returned 1 [0263.054] CloseHandle (hObject=0xdc) returned 1 [0263.054] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.054] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13fc [0263.055] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1404) returned 0x25b528 [0263.055] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13fc, lpOverlapped=0x0) returned 1 [0263.056] CloseHandle (hObject=0xdc) returned 1 [0263.056] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf")) returned 1 [0263.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.057] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.057] GetTickCount () returned 0x51110 [0263.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.058] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332048\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332048\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.058] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332048\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332048\\....\\temporaryfile")) returned 0 [0263.058] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332048\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332048\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332048\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332048\\temporaryfile")) returned 1 [0263.059] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332048\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bb3360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bb3360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bb3360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.059] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bb3360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bb3360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bb3360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.060] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bb3360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bb3360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bb3360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.060] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332048\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bb3360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bb3360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bb3360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.060] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bb3360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bb3360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bb3360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.060] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bb3360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bb3360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bb3360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.060] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.060] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332048\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332048\\temporaryfile")) returned 1 [0263.060] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bb3360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bb3360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bb3360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.060] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.060] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332048" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332048")) returned 1 [0263.060] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF") returned 0 [0263.061] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.062] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1400, lpOverlapped=0x0) returned 1 [0263.063] CloseHandle (hObject=0xdc) returned 1 [0263.063] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.064] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x660 [0263.064] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x668) returned 0x259e70 [0263.064] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x660, lpOverlapped=0x0) returned 1 [0263.065] CloseHandle (hObject=0xdc) returned 1 [0263.065] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf")) returned 1 [0263.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.066] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.067] GetTickCount () returned 0x5111f [0263.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.067] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.067] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.067] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063\\....\\temporaryfile")) returned 0 [0263.068] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063\\temporaryfile")) returned 1 [0263.069] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.069] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.069] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.069] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.069] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.069] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.069] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.069] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063\\temporaryfile")) returned 1 [0263.070] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.070] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.070] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063")) returned 1 [0263.070] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF") returned 0 [0263.070] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.071] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x668, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x668, lpOverlapped=0x0) returned 1 [0263.072] CloseHandle (hObject=0xdc) returned 1 [0263.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.073] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5cc [0263.073] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5d4) returned 0x259e70 [0263.073] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5cc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5cc, lpOverlapped=0x0) returned 1 [0263.075] CloseHandle (hObject=0xdc) returned 1 [0263.075] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf")) returned 1 [0263.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.076] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.076] GetTickCount () returned 0x5111f [0263.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.076] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.077] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063\\....\\temporaryfile")) returned 0 [0263.078] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063\\temporaryfile")) returned 1 [0263.080] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.080] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.080] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.080] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.080] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.080] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063\\temporaryfile")) returned 1 [0263.081] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bd94c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bd94c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bd94c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.081] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.081] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332063" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332063")) returned 1 [0263.081] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF") returned 0 [0263.082] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.082] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x5d0, lpOverlapped=0x0) returned 1 [0263.084] CloseHandle (hObject=0xdc) returned 1 [0263.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.085] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x184c [0263.085] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1854) returned 0x2c4a70 [0263.085] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x184c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x184c, lpOverlapped=0x0) returned 1 [0263.087] CloseHandle (hObject=0xdc) returned 1 [0263.087] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf")) returned 1 [0263.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.088] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.088] GetTickCount () returned 0x5112f [0263.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.088] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079\\....\\temporaryfile")) returned 0 [0263.089] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079\\temporaryfile")) returned 1 [0263.090] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bff620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bff620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bff620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.090] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bff620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bff620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bff620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.090] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bff620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bff620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bff620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.090] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bff620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bff620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bff620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bff620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bff620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bff620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bff620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bff620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bff620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.090] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079\\temporaryfile")) returned 1 [0263.091] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bff620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1bff620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1bff620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.091] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.091] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079")) returned 1 [0263.091] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF") returned 0 [0263.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.092] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1850, lpOverlapped=0x0) returned 1 [0263.093] CloseHandle (hObject=0xdc) returned 1 [0263.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.094] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x543a [0263.094] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5442) returned 0x2e8700 [0263.094] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x543a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x543a, lpOverlapped=0x0) returned 1 [0263.095] CloseHandle (hObject=0xdc) returned 1 [0263.095] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf")) returned 1 [0263.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.096] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.096] GetTickCount () returned 0x5112f [0263.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.097] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.097] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079\\....\\temporaryfile")) returned 0 [0263.098] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079\\temporaryfile")) returned 1 [0263.099] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bff620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.099] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1bff620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.099] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.099] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.099] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.099] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.100] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.100] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079\\temporaryfile")) returned 1 [0263.100] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.100] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.100] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332079" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332079")) returned 1 [0263.101] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF") returned 0 [0263.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.103] WriteFile (in: hFile=0xdc, lpBuffer=0x2edb58*, nNumberOfBytesToWrite=0x5440, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2edb58*, lpNumberOfBytesWritten=0x18fdd8*=0x5440, lpOverlapped=0x0) returned 1 [0263.104] CloseHandle (hObject=0xdc) returned 1 [0263.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.105] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16ee [0263.105] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16f6) returned 0x2c4a70 [0263.105] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x16ee, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x16ee, lpOverlapped=0x0) returned 1 [0263.106] CloseHandle (hObject=0xdc) returned 1 [0263.106] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf")) returned 1 [0263.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.107] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.107] GetTickCount () returned 0x5113e [0263.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.108] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.108] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332094\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332094\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332094\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332094\\....\\temporaryfile")) returned 0 [0263.108] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332094\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332094\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332094\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332094\\temporaryfile")) returned 1 [0263.110] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332094\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.110] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332094\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.110] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.110] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.110] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.110] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332094\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332094\\temporaryfile")) returned 1 [0263.110] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c25780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c25780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c25780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.110] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.110] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332094" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332094")) returned 1 [0263.111] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF") returned 0 [0263.111] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.112] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x16f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x16f8, lpOverlapped=0x0) returned 1 [0263.113] CloseHandle (hObject=0xdc) returned 1 [0263.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.114] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x41c2 [0263.114] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x41ca) returned 0x2e8700 [0263.114] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x41c2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x41c2, lpOverlapped=0x0) returned 1 [0263.115] CloseHandle (hObject=0xdc) returned 1 [0263.115] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf")) returned 1 [0263.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.116] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.116] GetTickCount () returned 0x5114e [0263.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.117] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110\\....\\temporaryfile")) returned 0 [0263.118] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110\\temporaryfile")) returned 1 [0263.119] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.119] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.119] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.119] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.119] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.119] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.119] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.119] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110\\temporaryfile")) returned 1 [0263.120] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.120] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.120] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110")) returned 1 [0263.120] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF") returned 0 [0263.120] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.121] WriteFile (in: hFile=0xdc, lpBuffer=0x2ec8e0*, nNumberOfBytesToWrite=0x41c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ec8e0*, lpNumberOfBytesWritten=0x18fdd8*=0x41c8, lpOverlapped=0x0) returned 1 [0263.122] CloseHandle (hObject=0xdc) returned 1 [0263.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.123] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x28ae [0263.123] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28b6) returned 0x2e8700 [0263.123] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x28ae, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x28ae, lpOverlapped=0x0) returned 1 [0263.124] CloseHandle (hObject=0xdc) returned 1 [0263.125] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf")) returned 1 [0263.125] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.125] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.126] GetTickCount () returned 0x5114e [0263.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.126] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110\\....\\temporaryfile")) returned 0 [0263.127] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110\\temporaryfile")) returned 1 [0263.129] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.129] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.129] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.129] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.129] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.129] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.129] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.129] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110\\temporaryfile")) returned 1 [0263.129] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c4b8e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c4b8e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c4b8e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.129] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.129] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332110" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332110")) returned 1 [0263.129] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF") returned 0 [0263.130] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.131] WriteFile (in: hFile=0xdc, lpBuffer=0x2eafc8*, nNumberOfBytesToWrite=0x28b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eafc8*, lpNumberOfBytesWritten=0x18fdd8*=0x28b8, lpOverlapped=0x0) returned 1 [0263.132] CloseHandle (hObject=0xdc) returned 1 [0263.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.132] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x36da [0263.133] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36e2) returned 0x2e8700 [0263.133] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x36da, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x36da, lpOverlapped=0x0) returned 1 [0263.134] CloseHandle (hObject=0xdc) returned 1 [0263.134] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf")) returned 1 [0263.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.135] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.135] GetTickCount () returned 0x5115e [0263.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.136] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332126\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332126\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332126\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332126\\....\\temporaryfile")) returned 0 [0263.137] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332126\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332126\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332126\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332126\\temporaryfile")) returned 1 [0263.138] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332126\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c71a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c71a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c71a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.138] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c71a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c71a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c71a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.138] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c71a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c71a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c71a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.138] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332126\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c71a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c71a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c71a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.138] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c71a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c71a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c71a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.138] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c71a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c71a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c71a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.138] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.138] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332126\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332126\\temporaryfile")) returned 1 [0263.139] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c71a40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c71a40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c71a40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.139] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.139] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332126" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332126")) returned 1 [0263.139] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF") returned 0 [0263.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.140] WriteFile (in: hFile=0xdc, lpBuffer=0x2ebdf8*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ebdf8*, lpNumberOfBytesWritten=0x18fdd8*=0x36e0, lpOverlapped=0x0) returned 1 [0263.141] CloseHandle (hObject=0xdc) returned 1 [0263.141] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.142] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3fe8 [0263.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3ff0) returned 0x2e8700 [0263.143] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x3fe8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x3fe8, lpOverlapped=0x0) returned 1 [0263.144] CloseHandle (hObject=0xdc) returned 1 [0263.144] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf")) returned 1 [0263.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.145] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.145] GetTickCount () returned 0x5116d [0263.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.146] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141\\....\\temporaryfile")) returned 0 [0263.146] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141\\temporaryfile")) returned 1 [0263.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.148] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.148] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.148] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.148] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.148] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.148] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141\\temporaryfile")) returned 1 [0263.148] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.148] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.148] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141")) returned 1 [0263.149] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF") returned 0 [0263.149] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.150] WriteFile (in: hFile=0xdc, lpBuffer=0x2ec700*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ec700*, lpNumberOfBytesWritten=0x18fdd8*=0x3ff0, lpOverlapped=0x0) returned 1 [0263.151] CloseHandle (hObject=0xdc) returned 1 [0263.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.151] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1898 [0263.152] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18a0) returned 0x2c4a70 [0263.152] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1898, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1898, lpOverlapped=0x0) returned 1 [0263.153] CloseHandle (hObject=0xdc) returned 1 [0263.153] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf")) returned 1 [0263.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.154] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.154] GetTickCount () returned 0x5116d [0263.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.156] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141\\....\\temporaryfile")) returned 0 [0263.157] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141\\temporaryfile")) returned 1 [0263.158] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.158] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.158] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.159] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.159] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.159] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.159] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.159] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141\\temporaryfile")) returned 1 [0263.159] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1c97ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1c97ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1c97ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.159] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.159] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332141" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332141")) returned 1 [0263.160] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF") returned 0 [0263.160] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.161] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x18a0, lpOverlapped=0x0) returned 1 [0263.162] CloseHandle (hObject=0xdc) returned 1 [0263.163] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.163] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x29f8 [0263.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2a00) returned 0x2e8700 [0263.163] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x29f8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x29f8, lpOverlapped=0x0) returned 1 [0263.167] CloseHandle (hObject=0xdc) returned 1 [0263.167] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf")) returned 1 [0263.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.168] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.168] GetTickCount () returned 0x5117d [0263.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.168] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.169] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332157\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332157\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332157\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332157\\....\\temporaryfile")) returned 0 [0263.169] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332157\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332157\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332157\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332157\\temporaryfile")) returned 1 [0263.170] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332157\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1cbdd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1cbdd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1cbdd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.170] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1cbdd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1cbdd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1cbdd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.171] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1cbdd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1cbdd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1cbdd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.171] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332157\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1cbdd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1cbdd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1cbdd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.171] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1cbdd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1cbdd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1cbdd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.171] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1cbdd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1cbdd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1cbdd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.171] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.171] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332157\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332157\\temporaryfile")) returned 1 [0263.171] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1cbdd00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1cbdd00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1cbdd00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.171] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.171] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332157" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332157")) returned 1 [0263.171] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF") returned 0 [0263.172] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.172] WriteFile (in: hFile=0xdc, lpBuffer=0x2eb110*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eb110*, lpNumberOfBytesWritten=0x18fdd8*=0x2a00, lpOverlapped=0x0) returned 1 [0263.173] CloseHandle (hObject=0xdc) returned 1 [0263.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.175] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x28b4 [0263.175] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28bc) returned 0x2e8700 [0263.175] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x28b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x28b4, lpOverlapped=0x0) returned 1 [0263.177] CloseHandle (hObject=0xdc) returned 1 [0263.177] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf")) returned 1 [0263.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.178] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.178] GetTickCount () returned 0x5118c [0263.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.178] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172\\....\\temporaryfile")) returned 0 [0263.179] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172\\temporaryfile")) returned 1 [0263.180] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.180] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.180] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.180] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.180] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.180] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.180] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.180] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172\\temporaryfile")) returned 1 [0263.181] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.181] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.181] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172")) returned 1 [0263.181] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF") returned 0 [0263.181] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.182] WriteFile (in: hFile=0xdc, lpBuffer=0x2eafd0*, nNumberOfBytesToWrite=0x28b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eafd0*, lpNumberOfBytesWritten=0x18fdd8*=0x28b8, lpOverlapped=0x0) returned 1 [0263.183] CloseHandle (hObject=0xdc) returned 1 [0263.183] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.184] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b0c [0263.184] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b14) returned 0x2c4a70 [0263.184] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b0c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b0c, lpOverlapped=0x0) returned 1 [0263.185] CloseHandle (hObject=0xdc) returned 1 [0263.185] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf")) returned 1 [0263.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.186] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.186] GetTickCount () returned 0x5118c [0263.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.187] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.187] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172\\....\\temporaryfile")) returned 0 [0263.187] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172\\temporaryfile")) returned 1 [0263.189] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.189] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.189] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.189] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.189] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.189] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.189] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.189] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172\\temporaryfile")) returned 1 [0263.190] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ce3e60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ce3e60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ce3e60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.190] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.190] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332172" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332172")) returned 1 [0263.190] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF") returned 0 [0263.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.196] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b10, lpOverlapped=0x0) returned 1 [0263.198] CloseHandle (hObject=0xdc) returned 1 [0263.198] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.199] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1bf8 [0263.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c00) returned 0x2c4a70 [0263.199] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1bf8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1bf8, lpOverlapped=0x0) returned 1 [0263.200] CloseHandle (hObject=0xdc) returned 1 [0263.200] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf")) returned 1 [0263.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.201] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.201] GetTickCount () returned 0x5119c [0263.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.201] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.202] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.202] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332188\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.202] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332188\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332188\\....\\temporaryfile")) returned 0 [0263.202] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332188\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332188\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332188\\temporaryfile")) returned 1 [0263.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332188\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d09fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d09fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d09fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.204] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d09fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d09fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d09fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.204] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d09fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d09fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d09fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.204] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332188\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d09fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d09fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d09fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.204] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d09fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d09fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d09fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.204] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d09fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d09fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d09fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.204] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.204] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332188\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332188\\temporaryfile")) returned 1 [0263.204] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d09fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d09fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d09fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.204] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.205] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332188" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332188")) returned 1 [0263.205] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF") returned 0 [0263.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.206] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1c00, lpOverlapped=0x0) returned 1 [0263.207] CloseHandle (hObject=0xdc) returned 1 [0263.207] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.208] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1270 [0263.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1278) returned 0x25b528 [0263.208] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1270, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1270, lpOverlapped=0x0) returned 1 [0263.209] CloseHandle (hObject=0xdc) returned 1 [0263.209] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf")) returned 1 [0263.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.210] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.210] GetTickCount () returned 0x511ac [0263.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.210] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.211] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.211] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332204\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332204\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332204\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332204\\....\\temporaryfile")) returned 0 [0263.211] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332204\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332204\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332204\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332204\\temporaryfile")) returned 1 [0263.213] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332204\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d30120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d30120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d30120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.213] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d30120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d30120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d30120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.213] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d30120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d30120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d30120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.213] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332204\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d30120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d30120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d30120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.213] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d30120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d30120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d30120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.213] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d30120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d30120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d30120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.213] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.213] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332204\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332204\\temporaryfile")) returned 1 [0263.214] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d30120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d30120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d30120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.214] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.214] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332204" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332204")) returned 1 [0263.214] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF") returned 0 [0263.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.215] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1278, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1278, lpOverlapped=0x0) returned 1 [0263.216] CloseHandle (hObject=0xdc) returned 1 [0263.216] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.217] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x25ac [0263.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25b4) returned 0x2e8700 [0263.217] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x25ac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x25ac, lpOverlapped=0x0) returned 1 [0263.227] CloseHandle (hObject=0xdc) returned 1 [0263.227] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf")) returned 1 [0263.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.228] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.228] GetTickCount () returned 0x511bb [0263.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.228] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.229] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.229] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332219\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332219\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332219\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332219\\....\\temporaryfile")) returned 0 [0263.229] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332219\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332219\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332219\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332219\\temporaryfile")) returned 1 [0263.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332219\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d56280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d56280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d56280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d56280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d56280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d56280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.231] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d56280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d56280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d56280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.231] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332219\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d56280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d56280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d56280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.231] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d56280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d56280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d56280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.231] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d56280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d56280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d56280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.231] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.231] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332219\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332219\\temporaryfile")) returned 1 [0263.232] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d56280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d56280, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d56280, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.232] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.232] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332219" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332219")) returned 1 [0263.232] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF") returned 0 [0263.232] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.233] WriteFile (in: hFile=0xdc, lpBuffer=0x2eacc8*, nNumberOfBytesToWrite=0x25b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eacc8*, lpNumberOfBytesWritten=0x18fdd8*=0x25b0, lpOverlapped=0x0) returned 1 [0263.234] CloseHandle (hObject=0xdc) returned 1 [0263.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.236] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1f5c [0263.236] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f64) returned 0x2e8700 [0263.236] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x1f5c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x1f5c, lpOverlapped=0x0) returned 1 [0263.237] CloseHandle (hObject=0xdc) returned 1 [0263.238] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf")) returned 1 [0263.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.239] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.239] GetTickCount () returned 0x511cb [0263.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.239] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.239] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235\\....\\temporaryfile")) returned 0 [0263.240] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235\\temporaryfile")) returned 1 [0263.241] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.241] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.241] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.242] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.242] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.242] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.242] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.242] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235\\temporaryfile")) returned 1 [0263.242] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.242] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.242] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235")) returned 1 [0263.242] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF") returned 0 [0263.243] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.243] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea678*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea678*, lpNumberOfBytesWritten=0x18fdd8*=0x1f60, lpOverlapped=0x0) returned 1 [0263.245] CloseHandle (hObject=0xdc) returned 1 [0263.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.246] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2944 [0263.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x294c) returned 0x2e8700 [0263.246] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2944, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2944, lpOverlapped=0x0) returned 1 [0263.248] CloseHandle (hObject=0xdc) returned 1 [0263.248] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf")) returned 1 [0263.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.249] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.249] GetTickCount () returned 0x511cb [0263.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.249] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.249] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235\\....\\temporaryfile")) returned 0 [0263.250] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235\\temporaryfile")) returned 1 [0263.252] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.252] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.252] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.252] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.252] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.252] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.252] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.252] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235\\temporaryfile")) returned 1 [0263.252] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1d7c3e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1d7c3e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1d7c3e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.252] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.252] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332235" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332235")) returned 1 [0263.252] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF") returned 0 [0263.253] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.254] WriteFile (in: hFile=0xdc, lpBuffer=0x2eb060*, nNumberOfBytesToWrite=0x2948, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eb060*, lpNumberOfBytesWritten=0x18fdd8*=0x2948, lpOverlapped=0x0) returned 1 [0263.255] CloseHandle (hObject=0xdc) returned 1 [0263.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.255] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1960 [0263.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1968) returned 0x2c4a70 [0263.256] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1960, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1960, lpOverlapped=0x0) returned 1 [0263.257] CloseHandle (hObject=0xdc) returned 1 [0263.257] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf")) returned 1 [0263.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.258] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.258] GetTickCount () returned 0x511da [0263.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.258] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.259] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250\\....\\temporaryfile")) returned 0 [0263.259] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250\\temporaryfile")) returned 1 [0263.261] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.261] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.261] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.261] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.261] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.261] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.261] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.261] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250\\temporaryfile")) returned 1 [0263.261] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.261] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.261] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250")) returned 1 [0263.262] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF") returned 0 [0263.262] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.262] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1968, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1968, lpOverlapped=0x0) returned 1 [0263.263] CloseHandle (hObject=0xdc) returned 1 [0263.264] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.264] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1708 [0263.264] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1710) returned 0x2c4a70 [0263.264] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1708, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1708, lpOverlapped=0x0) returned 1 [0263.266] CloseHandle (hObject=0xdc) returned 1 [0263.266] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf")) returned 1 [0263.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.267] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.267] GetTickCount () returned 0x511da [0263.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.267] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.268] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250\\....\\temporaryfile")) returned 0 [0263.269] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250\\temporaryfile")) returned 1 [0263.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dc86a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dc86a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.271] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dc86a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dc86a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.271] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.271] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.271] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.271] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.271] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.271] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250\\temporaryfile")) returned 1 [0263.272] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1da2540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1da2540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1da2540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.272] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.272] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332250" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332250")) returned 1 [0263.272] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF") returned 0 [0263.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.273] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1710, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1710, lpOverlapped=0x0) returned 1 [0263.275] CloseHandle (hObject=0xdc) returned 1 [0263.275] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.275] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1264 [0263.276] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x126c) returned 0x25b528 [0263.276] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1264, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1264, lpOverlapped=0x0) returned 1 [0263.277] CloseHandle (hObject=0xdc) returned 1 [0263.277] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf")) returned 1 [0263.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.278] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.278] GetTickCount () returned 0x511ea [0263.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.278] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.279] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332266\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332266\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332266\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332266\\....\\temporaryfile")) returned 0 [0263.279] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332266\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332266\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332266\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332266\\temporaryfile")) returned 1 [0263.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332266\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc86a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dc86a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dc86a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc86a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dc86a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dc86a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc86a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dc86a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dc86a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.281] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332266\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc86a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dc86a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dc86a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.281] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc86a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dc86a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dc86a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.281] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc86a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dc86a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dc86a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.281] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.281] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332266\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332266\\temporaryfile")) returned 1 [0263.281] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc86a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dc86a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dc86a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.281] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.281] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332266" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332266")) returned 1 [0263.282] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF") returned 0 [0263.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.283] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1268, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1268, lpOverlapped=0x0) returned 1 [0263.284] CloseHandle (hObject=0xdc) returned 1 [0263.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.285] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d84 [0263.285] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d8c) returned 0x2e8700 [0263.285] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x1d84, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x1d84, lpOverlapped=0x0) returned 1 [0263.287] CloseHandle (hObject=0xdc) returned 1 [0263.287] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf")) returned 1 [0263.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.288] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.288] GetTickCount () returned 0x511fa [0263.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.288] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.288] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282\\....\\temporaryfile")) returned 0 [0263.289] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282\\temporaryfile")) returned 1 [0263.290] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.290] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.290] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.290] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.290] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.290] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.290] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282\\temporaryfile")) returned 1 [0263.291] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.291] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282")) returned 1 [0263.291] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF") returned 0 [0263.291] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.292] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea4a0*, nNumberOfBytesToWrite=0x1d88, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea4a0*, lpNumberOfBytesWritten=0x18fdd8*=0x1d88, lpOverlapped=0x0) returned 1 [0263.293] CloseHandle (hObject=0xdc) returned 1 [0263.293] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.294] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xae1a [0263.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xae22) returned 0x2e8700 [0263.294] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0xae1a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0xae1a, lpOverlapped=0x0) returned 1 [0263.297] CloseHandle (hObject=0xdc) returned 1 [0263.297] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf")) returned 1 [0263.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.299] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.299] GetTickCount () returned 0x511fa [0263.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.299] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.299] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.300] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282\\....\\temporaryfile")) returned 0 [0263.300] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282\\temporaryfile")) returned 1 [0263.302] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e14960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e14960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.302] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e14960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e14960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.302] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.302] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.302] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.303] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.303] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.303] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282\\temporaryfile")) returned 1 [0263.303] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dee800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1dee800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1dee800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.303] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.303] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332282" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332282")) returned 1 [0263.303] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF") returned 0 [0263.304] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.305] WriteFile (in: hFile=0xdc, lpBuffer=0x2f3538*, nNumberOfBytesToWrite=0xae20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2f3538*, lpNumberOfBytesWritten=0x18fdd8*=0xae20, lpOverlapped=0x0) returned 1 [0263.307] CloseHandle (hObject=0xdc) returned 1 [0263.307] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.308] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5b38 [0263.308] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b40) returned 0x2e8700 [0263.308] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x5b38, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x5b38, lpOverlapped=0x0) returned 1 [0263.310] CloseHandle (hObject=0xdc) returned 1 [0263.310] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf")) returned 1 [0263.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.311] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.311] GetTickCount () returned 0x51209 [0263.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.311] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.311] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332297\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332297\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332297\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332297\\....\\temporaryfile")) returned 0 [0263.312] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332297\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332297\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332297\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332297\\temporaryfile")) returned 1 [0263.313] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332297\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e14960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e14960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e14960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.314] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e14960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e14960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e14960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.314] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e14960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e14960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e14960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.314] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332297\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e14960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e14960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e14960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.314] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e14960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e14960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e14960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.314] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e14960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e14960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e14960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.314] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.314] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332297\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332297\\temporaryfile")) returned 1 [0263.314] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e14960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e14960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e14960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.314] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.314] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332297" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332297")) returned 1 [0263.314] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF") returned 0 [0263.315] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.316] WriteFile (in: hFile=0xdc, lpBuffer=0x2ee250*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ee250*, lpNumberOfBytesWritten=0x18fdd8*=0x5b40, lpOverlapped=0x0) returned 1 [0263.317] CloseHandle (hObject=0xdc) returned 1 [0263.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.318] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1075e [0263.318] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10766) returned 0x2e8700 [0263.318] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x1075e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x1075e, lpOverlapped=0x0) returned 1 [0263.321] CloseHandle (hObject=0xdc) returned 1 [0263.321] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf")) returned 1 [0263.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.322] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.322] GetTickCount () returned 0x51219 [0263.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.322] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.323] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332313\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332313\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.323] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332313\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332313\\....\\temporaryfile")) returned 0 [0263.323] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332313\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332313\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332313\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332313\\temporaryfile")) returned 1 [0263.324] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332313\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e3aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e3aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e3aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e3aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e3aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e3aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e3aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e3aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e3aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.325] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332313\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e3aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e3aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e3aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e3aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e3aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e3aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.325] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e3aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e3aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e3aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.325] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332313\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332313\\temporaryfile")) returned 1 [0263.325] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e3aac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e3aac0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e3aac0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.325] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.325] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332313" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332313")) returned 1 [0263.325] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF") returned 0 [0263.327] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.327] WriteFile (in: hFile=0xdc, lpBuffer=0x2f8e78*, nNumberOfBytesToWrite=0x10768, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2f8e78*, lpNumberOfBytesWritten=0x18fdd8*=0x10768, lpOverlapped=0x0) returned 1 [0263.329] CloseHandle (hObject=0xdc) returned 1 [0263.329] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.330] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x43b0 [0263.330] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x43b8) returned 0x2e8700 [0263.330] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x43b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x43b0, lpOverlapped=0x0) returned 1 [0263.332] CloseHandle (hObject=0xdc) returned 1 [0263.332] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf")) returned 1 [0263.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.333] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.333] GetTickCount () returned 0x51228 [0263.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.333] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.334] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.334] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328\\....\\temporaryfile")) returned 0 [0263.334] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328\\temporaryfile")) returned 1 [0263.336] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.336] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.336] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.336] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.336] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.336] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.336] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.336] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328\\temporaryfile")) returned 1 [0263.336] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.337] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.337] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328")) returned 1 [0263.337] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF") returned 0 [0263.337] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.338] WriteFile (in: hFile=0xdc, lpBuffer=0x2ecac8*, nNumberOfBytesToWrite=0x43b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ecac8*, lpNumberOfBytesWritten=0x18fdd8*=0x43b8, lpOverlapped=0x0) returned 1 [0263.339] CloseHandle (hObject=0xdc) returned 1 [0263.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.340] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x59d8 [0263.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x59e0) returned 0x2e8700 [0263.340] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x59d8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x59d8, lpOverlapped=0x0) returned 1 [0263.341] CloseHandle (hObject=0xdc) returned 1 [0263.342] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf")) returned 1 [0263.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.343] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.343] GetTickCount () returned 0x51228 [0263.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.343] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.344] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.344] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328\\....\\temporaryfile")) returned 0 [0263.345] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328\\temporaryfile")) returned 1 [0263.347] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.347] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.347] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.347] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.347] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.347] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.347] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.347] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328\\temporaryfile")) returned 1 [0263.348] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e60c20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e60c20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e60c20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.348] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.348] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332328" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332328")) returned 1 [0263.348] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF") returned 0 [0263.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.349] WriteFile (in: hFile=0xdc, lpBuffer=0x2ee0f0*, nNumberOfBytesToWrite=0x59e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ee0f0*, lpNumberOfBytesWritten=0x18fdd8*=0x59e0, lpOverlapped=0x0) returned 1 [0263.351] CloseHandle (hObject=0xdc) returned 1 [0263.351] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.352] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x75ca [0263.352] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x75d2) returned 0x2e8700 [0263.352] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x75ca, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x75ca, lpOverlapped=0x0) returned 1 [0263.353] CloseHandle (hObject=0xdc) returned 1 [0263.353] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf")) returned 1 [0263.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.355] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.355] GetTickCount () returned 0x51238 [0263.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.360] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.360] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332344\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332344\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332344\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332344\\....\\temporaryfile")) returned 0 [0263.361] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332344\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332344\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332344\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332344\\temporaryfile")) returned 1 [0263.362] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332344\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e86d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e86d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e86d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e86d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e86d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e86d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e86d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e86d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e86d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.362] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332344\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e86d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e86d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e86d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.362] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e86d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e86d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e86d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.363] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e86d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e86d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e86d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.363] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.363] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332344\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332344\\temporaryfile")) returned 1 [0263.363] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e86d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1e86d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1e86d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.363] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.363] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332344" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332344")) returned 1 [0263.363] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF") returned 0 [0263.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.365] WriteFile (in: hFile=0xdc, lpBuffer=0x2efce8*, nNumberOfBytesToWrite=0x75d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2efce8*, lpNumberOfBytesWritten=0x18fdd8*=0x75d0, lpOverlapped=0x0) returned 1 [0263.366] CloseHandle (hObject=0xdc) returned 1 [0263.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.367] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x51a8 [0263.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x51b0) returned 0x2e8700 [0263.367] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x51a8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x51a8, lpOverlapped=0x0) returned 1 [0263.369] CloseHandle (hObject=0xdc) returned 1 [0263.369] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf")) returned 1 [0263.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.370] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.370] GetTickCount () returned 0x51248 [0263.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.370] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.371] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.371] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332360\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332360\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332360\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332360\\....\\temporaryfile")) returned 0 [0263.371] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332360\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332360\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332360\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332360\\temporaryfile")) returned 1 [0263.373] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332360\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1eacee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1eacee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1eacee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.373] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1eacee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1eacee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1eacee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.373] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1eacee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1eacee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1eacee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.373] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332360\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1eacee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1eacee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1eacee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.373] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1eacee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1eacee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1eacee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.373] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1eacee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1eacee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1eacee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.373] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.373] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332360\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332360\\temporaryfile")) returned 1 [0263.374] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1eacee0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1eacee0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1eacee0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.374] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.374] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332360" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332360")) returned 1 [0263.374] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF") returned 0 [0263.374] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.375] WriteFile (in: hFile=0xdc, lpBuffer=0x2ed8c0*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ed8c0*, lpNumberOfBytesWritten=0x18fdd8*=0x51b0, lpOverlapped=0x0) returned 1 [0263.376] CloseHandle (hObject=0xdc) returned 1 [0263.376] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.377] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x54b0 [0263.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x54b8) returned 0x2e8700 [0263.377] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x54b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x54b0, lpOverlapped=0x0) returned 1 [0263.379] CloseHandle (hObject=0xdc) returned 1 [0263.379] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf")) returned 1 [0263.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.380] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.380] GetTickCount () returned 0x51257 [0263.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.380] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.381] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.381] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.381] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375\\....\\temporaryfile")) returned 0 [0263.381] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375\\temporaryfile")) returned 1 [0263.383] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.383] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.383] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.383] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.383] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.383] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.383] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.383] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375\\temporaryfile")) returned 1 [0263.383] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.383] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.383] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375")) returned 1 [0263.384] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF") returned 0 [0263.384] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.385] WriteFile (in: hFile=0xdc, lpBuffer=0x2edbc8*, nNumberOfBytesToWrite=0x54b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2edbc8*, lpNumberOfBytesWritten=0x18fdd8*=0x54b8, lpOverlapped=0x0) returned 1 [0263.386] CloseHandle (hObject=0xdc) returned 1 [0263.386] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.387] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x47a0 [0263.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x47a8) returned 0x2e8700 [0263.387] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x47a0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x47a0, lpOverlapped=0x0) returned 1 [0263.390] CloseHandle (hObject=0xdc) returned 1 [0263.390] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf")) returned 1 [0263.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.391] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.391] GetTickCount () returned 0x51257 [0263.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.391] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.392] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.392] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.392] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375\\....\\temporaryfile")) returned 0 [0263.392] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375\\temporaryfile")) returned 1 [0263.394] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.394] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.394] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.394] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.394] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.394] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.394] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.395] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375\\temporaryfile")) returned 1 [0263.395] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ed3040, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ed3040, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ed3040, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.395] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.395] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332375" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332375")) returned 1 [0263.395] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF") returned 0 [0263.396] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.396] WriteFile (in: hFile=0xdc, lpBuffer=0x2eceb8*, nNumberOfBytesToWrite=0x47a8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eceb8*, lpNumberOfBytesWritten=0x18fdd8*=0x47a8, lpOverlapped=0x0) returned 1 [0263.397] CloseHandle (hObject=0xdc) returned 1 [0263.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.398] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa8a6 [0263.398] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa8ae) returned 0x2e8700 [0263.398] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0xa8a6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0xa8a6, lpOverlapped=0x0) returned 1 [0263.400] CloseHandle (hObject=0xdc) returned 1 [0263.400] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf")) returned 1 [0263.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.402] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.402] GetTickCount () returned 0x51267 [0263.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.402] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332391\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332391\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332391\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332391\\....\\temporaryfile")) returned 0 [0263.403] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332391\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332391\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332391\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332391\\temporaryfile")) returned 1 [0263.405] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332391\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ef91a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ef91a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ef91a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.405] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ef91a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ef91a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ef91a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.405] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ef91a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ef91a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ef91a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.405] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332391\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ef91a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ef91a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ef91a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.405] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ef91a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ef91a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ef91a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.405] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ef91a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ef91a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ef91a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.405] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.405] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332391\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332391\\temporaryfile")) returned 1 [0263.405] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1ef91a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1ef91a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1ef91a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.405] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.405] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332391" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332391")) returned 1 [0263.406] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF") returned 0 [0263.406] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.407] WriteFile (in: hFile=0xdc, lpBuffer=0x2f2fc0*, nNumberOfBytesToWrite=0xa8b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2f2fc0*, lpNumberOfBytesWritten=0x18fdd8*=0xa8b0, lpOverlapped=0x0) returned 1 [0263.409] CloseHandle (hObject=0xdc) returned 1 [0263.409] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.410] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2566 [0263.410] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x256e) returned 0x2e8700 [0263.410] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2566, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2566, lpOverlapped=0x0) returned 1 [0263.412] CloseHandle (hObject=0xdc) returned 1 [0263.412] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf")) returned 1 [0263.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.412] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.413] GetTickCount () returned 0x51276 [0263.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.413] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.413] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406\\....\\temporaryfile")) returned 0 [0263.414] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406\\temporaryfile")) returned 1 [0263.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.415] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.415] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.415] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.415] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.415] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.415] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406\\temporaryfile")) returned 1 [0263.416] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.416] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.416] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406")) returned 1 [0263.416] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF") returned 0 [0263.416] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.417] WriteFile (in: hFile=0xdc, lpBuffer=0x2eac80*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eac80*, lpNumberOfBytesWritten=0x18fdd8*=0x2570, lpOverlapped=0x0) returned 1 [0263.418] CloseHandle (hObject=0xdc) returned 1 [0263.418] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.419] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6ca8 [0263.419] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6cb0) returned 0x2e8700 [0263.419] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x6ca8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x6ca8, lpOverlapped=0x0) returned 1 [0263.420] CloseHandle (hObject=0xdc) returned 1 [0263.420] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf")) returned 1 [0263.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.422] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.422] GetTickCount () returned 0x51276 [0263.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.422] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.423] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.423] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406\\....\\temporaryfile")) returned 0 [0263.424] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406\\temporaryfile")) returned 1 [0263.428] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.428] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.428] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.428] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.428] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.429] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.429] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406\\temporaryfile")) returned 1 [0263.429] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f1f300, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f1f300, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f1f300, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.429] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.429] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332406" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332406")) returned 1 [0263.429] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF") returned 0 [0263.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.431] WriteFile (in: hFile=0xdc, lpBuffer=0x2ef3c0*, nNumberOfBytesToWrite=0x6cb0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ef3c0*, lpNumberOfBytesWritten=0x18fdd8*=0x6cb0, lpOverlapped=0x0) returned 1 [0263.432] CloseHandle (hObject=0xdc) returned 1 [0263.433] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.433] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1088 [0263.433] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1090) returned 0x25b528 [0263.433] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1088, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1088, lpOverlapped=0x0) returned 1 [0263.435] CloseHandle (hObject=0xdc) returned 1 [0263.435] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf")) returned 1 [0263.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.436] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.436] GetTickCount () returned 0x51286 [0263.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.436] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.436] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332422\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332422\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332422\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332422\\....\\temporaryfile")) returned 0 [0263.437] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332422\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332422\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332422\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332422\\temporaryfile")) returned 1 [0263.438] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332422\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f45460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f45460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f45460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.439] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f45460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f45460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f45460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.439] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f45460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f45460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f45460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.439] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332422\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f45460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f45460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f45460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.439] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f45460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f45460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f45460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.439] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f45460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f45460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f45460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.439] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.439] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332422\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332422\\temporaryfile")) returned 1 [0263.439] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f45460, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f45460, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f45460, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.439] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.439] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332422" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332422")) returned 1 [0263.439] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF") returned 0 [0263.440] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.440] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1090, lpOverlapped=0x0) returned 1 [0263.441] CloseHandle (hObject=0xdc) returned 1 [0263.441] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.442] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x578 [0263.442] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x580) returned 0x259e70 [0263.442] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x578, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x578, lpOverlapped=0x0) returned 1 [0263.443] CloseHandle (hObject=0xdc) returned 1 [0263.444] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf")) returned 1 [0263.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.444] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.444] GetTickCount () returned 0x51296 [0263.444] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.445] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438\\....\\temporaryfile")) returned 0 [0263.446] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438\\temporaryfile")) returned 1 [0263.447] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.447] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.447] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.447] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.447] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.447] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.447] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.447] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438\\temporaryfile")) returned 1 [0263.448] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.448] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.448] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438")) returned 1 [0263.448] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF") returned 0 [0263.448] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.449] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x580, lpOverlapped=0x0) returned 1 [0263.450] CloseHandle (hObject=0xdc) returned 1 [0263.450] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.451] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3086 [0263.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x308e) returned 0x2e8700 [0263.452] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x3086, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x3086, lpOverlapped=0x0) returned 1 [0263.453] CloseHandle (hObject=0xdc) returned 1 [0263.453] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf")) returned 1 [0263.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.454] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.454] GetTickCount () returned 0x51296 [0263.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.455] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.455] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438\\....\\temporaryfile")) returned 0 [0263.455] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438\\temporaryfile")) returned 1 [0263.457] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f91720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f91720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.457] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f91720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f91720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.457] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.457] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.457] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.457] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.457] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438\\temporaryfile")) returned 1 [0263.458] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f6b5c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f6b5c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f6b5c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.458] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.458] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332438" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332438")) returned 1 [0263.458] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF") returned 0 [0263.458] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.459] WriteFile (in: hFile=0xdc, lpBuffer=0x2eb7a0*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eb7a0*, lpNumberOfBytesWritten=0x18fdd8*=0x3090, lpOverlapped=0x0) returned 1 [0263.460] CloseHandle (hObject=0xdc) returned 1 [0263.460] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.461] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d14 [0263.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d1c) returned 0x2e8700 [0263.461] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x1d14, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x1d14, lpOverlapped=0x0) returned 1 [0263.463] CloseHandle (hObject=0xdc) returned 1 [0263.463] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf")) returned 1 [0263.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.464] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.464] GetTickCount () returned 0x512a5 [0263.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.465] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.465] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332453\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332453\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332453\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332453\\....\\temporaryfile")) returned 0 [0263.466] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332453\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332453\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332453\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332453\\temporaryfile")) returned 1 [0263.467] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332453\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f91720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f91720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f91720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.467] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f91720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f91720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f91720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.467] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f91720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f91720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f91720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.467] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332453\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f91720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f91720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f91720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.467] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f91720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f91720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f91720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.467] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f91720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f91720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f91720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.467] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.467] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332453\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332453\\temporaryfile")) returned 1 [0263.468] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1f91720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1f91720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1f91720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.468] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.468] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332453" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332453")) returned 1 [0263.468] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF") returned 0 [0263.468] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.469] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea430*, nNumberOfBytesToWrite=0x1d18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea430*, lpNumberOfBytesWritten=0x18fdd8*=0x1d18, lpOverlapped=0x0) returned 1 [0263.470] CloseHandle (hObject=0xdc) returned 1 [0263.470] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.471] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d68 [0263.471] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d70) returned 0x2e8700 [0263.471] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x1d68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x1d68, lpOverlapped=0x0) returned 1 [0263.472] CloseHandle (hObject=0xdc) returned 1 [0263.472] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf")) returned 1 [0263.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.473] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.473] GetTickCount () returned 0x512b5 [0263.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.474] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469\\....\\temporaryfile")) returned 0 [0263.474] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469\\temporaryfile")) returned 1 [0263.475] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.475] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.476] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.476] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.476] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.476] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.476] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.476] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469\\temporaryfile")) returned 1 [0263.476] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.476] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.476] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469")) returned 1 [0263.476] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF") returned 0 [0263.477] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.477] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea480*, nNumberOfBytesToWrite=0x1d70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea480*, lpNumberOfBytesWritten=0x18fdd8*=0x1d70, lpOverlapped=0x0) returned 1 [0263.478] CloseHandle (hObject=0xdc) returned 1 [0263.478] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.479] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x23a8 [0263.479] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23b0) returned 0x2e8700 [0263.479] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x23a8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x23a8, lpOverlapped=0x0) returned 1 [0263.481] CloseHandle (hObject=0xdc) returned 1 [0263.481] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf")) returned 1 [0263.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.482] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.482] GetTickCount () returned 0x512b5 [0263.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.482] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.483] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469\\....\\temporaryfile")) returned 0 [0263.483] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469\\temporaryfile")) returned 1 [0263.484] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.485] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.485] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.485] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.485] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.485] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.485] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469\\temporaryfile")) returned 1 [0263.485] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fb7880, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fb7880, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fb7880, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.485] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.485] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332469" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332469")) returned 1 [0263.485] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF") returned 0 [0263.486] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.486] WriteFile (in: hFile=0xdc, lpBuffer=0x2eaac0*, nNumberOfBytesToWrite=0x23b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eaac0*, lpNumberOfBytesWritten=0x18fdd8*=0x23b0, lpOverlapped=0x0) returned 1 [0263.488] CloseHandle (hObject=0xdc) returned 1 [0263.488] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.489] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2016 [0263.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x201e) returned 0x2e8700 [0263.489] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2016, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2016, lpOverlapped=0x0) returned 1 [0263.493] CloseHandle (hObject=0xdc) returned 1 [0263.493] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf")) returned 1 [0263.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.494] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.494] GetTickCount () returned 0x512c4 [0263.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.494] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.494] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332484\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332484\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.495] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332484\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332484\\....\\temporaryfile")) returned 0 [0263.495] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332484\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332484\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332484\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332484\\temporaryfile")) returned 1 [0263.496] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332484\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fdd9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fdd9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fdd9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.496] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fdd9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fdd9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fdd9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fdd9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fdd9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fdd9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.497] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332484\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fdd9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fdd9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fdd9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fdd9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fdd9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fdd9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.497] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fdd9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fdd9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fdd9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.497] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332484\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332484\\temporaryfile")) returned 1 [0263.497] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1fdd9e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa1fdd9e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa1fdd9e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.497] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.497] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332484" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332484")) returned 1 [0263.497] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF") returned 0 [0263.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.498] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea730*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea730*, lpNumberOfBytesWritten=0x18fdd8*=0x2020, lpOverlapped=0x0) returned 1 [0263.499] CloseHandle (hObject=0xdc) returned 1 [0263.500] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.500] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x24c8 [0263.500] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x24d0) returned 0x2e8700 [0263.500] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x24c8, lpOverlapped=0x0) returned 1 [0263.502] CloseHandle (hObject=0xdc) returned 1 [0263.502] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf")) returned 1 [0263.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.503] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.503] GetTickCount () returned 0x512d4 [0263.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.503] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.503] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500\\....\\temporaryfile")) returned 0 [0263.504] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500\\temporaryfile")) returned 1 [0263.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.505] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.505] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.505] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.506] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.506] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.506] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.506] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500\\temporaryfile")) returned 1 [0263.506] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.506] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.506] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500")) returned 1 [0263.511] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF") returned 0 [0263.511] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.512] WriteFile (in: hFile=0xdc, lpBuffer=0x2eabe0*, nNumberOfBytesToWrite=0x24d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eabe0*, lpNumberOfBytesWritten=0x18fdd8*=0x24d0, lpOverlapped=0x0) returned 1 [0263.513] CloseHandle (hObject=0xdc) returned 1 [0263.513] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.514] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x266c [0263.514] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2674) returned 0x2e8700 [0263.514] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x266c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x266c, lpOverlapped=0x0) returned 1 [0263.515] CloseHandle (hObject=0xdc) returned 1 [0263.515] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf")) returned 1 [0263.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.516] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.516] GetTickCount () returned 0x512d4 [0263.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.517] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.517] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500\\....\\temporaryfile")) returned 0 [0263.518] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500\\temporaryfile")) returned 1 [0263.519] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.519] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.519] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.519] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.519] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.520] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.520] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.520] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500\\temporaryfile")) returned 1 [0263.520] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2003b40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2003b40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2003b40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.520] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.520] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332500" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332500")) returned 1 [0263.520] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF") returned 0 [0263.520] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.521] WriteFile (in: hFile=0xdc, lpBuffer=0x2ead88*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ead88*, lpNumberOfBytesWritten=0x18fdd8*=0x2670, lpOverlapped=0x0) returned 1 [0263.522] CloseHandle (hObject=0xdc) returned 1 [0263.522] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.523] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1fde [0263.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1fe6) returned 0x2e8700 [0263.524] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x1fde, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x1fde, lpOverlapped=0x0) returned 1 [0263.525] CloseHandle (hObject=0xdc) returned 1 [0263.525] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf")) returned 1 [0263.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.526] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.526] GetTickCount () returned 0x512e4 [0263.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.527] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.527] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332516\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332516\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332516\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332516\\....\\temporaryfile")) returned 0 [0263.527] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332516\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332516\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332516\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332516\\temporaryfile")) returned 1 [0263.529] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332516\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2029ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2029ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2029ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.529] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2029ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2029ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2029ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.529] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2029ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2029ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2029ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.529] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332516\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2029ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2029ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2029ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.529] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2029ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2029ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2029ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.529] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2029ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2029ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2029ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.529] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.529] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332516\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332516\\temporaryfile")) returned 1 [0263.529] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2029ca0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2029ca0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2029ca0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.529] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.530] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332516" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332516")) returned 1 [0263.530] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF") returned 0 [0263.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.531] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea6f8*, nNumberOfBytesToWrite=0x1fe8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea6f8*, lpNumberOfBytesWritten=0x18fdd8*=0x1fe8, lpOverlapped=0x0) returned 1 [0263.532] CloseHandle (hObject=0xdc) returned 1 [0263.532] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.532] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2c2c [0263.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c34) returned 0x2e8700 [0263.532] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2c2c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2c2c, lpOverlapped=0x0) returned 1 [0263.534] CloseHandle (hObject=0xdc) returned 1 [0263.534] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf")) returned 1 [0263.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.535] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.535] GetTickCount () returned 0x512f3 [0263.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.535] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.536] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.536] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531\\....\\temporaryfile")) returned 0 [0263.536] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531\\temporaryfile")) returned 1 [0263.538] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.538] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.538] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.538] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.538] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.538] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.538] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.538] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531\\temporaryfile")) returned 1 [0263.538] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.538] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.538] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531")) returned 1 [0263.538] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF") returned 0 [0263.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.540] WriteFile (in: hFile=0xdc, lpBuffer=0x2eb348*, nNumberOfBytesToWrite=0x2c30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eb348*, lpNumberOfBytesWritten=0x18fdd8*=0x2c30, lpOverlapped=0x0) returned 1 [0263.541] CloseHandle (hObject=0xdc) returned 1 [0263.541] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.542] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30ca [0263.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30d2) returned 0x2e8700 [0263.542] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x30ca, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x30ca, lpOverlapped=0x0) returned 1 [0263.544] CloseHandle (hObject=0xdc) returned 1 [0263.544] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf")) returned 1 [0263.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.545] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.545] GetTickCount () returned 0x512f3 [0263.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.545] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.546] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.546] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531\\....\\temporaryfile")) returned 0 [0263.546] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531\\temporaryfile")) returned 1 [0263.548] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.548] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.548] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.548] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.548] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.548] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.548] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.548] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531\\temporaryfile")) returned 1 [0263.549] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa204fe00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa204fe00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa204fe00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.549] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.549] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332531" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332531")) returned 1 [0263.549] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF") returned 0 [0263.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.550] WriteFile (in: hFile=0xdc, lpBuffer=0x2eb7e8*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eb7e8*, lpNumberOfBytesWritten=0x18fdd8*=0x30d0, lpOverlapped=0x0) returned 1 [0263.551] CloseHandle (hObject=0xdc) returned 1 [0263.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.552] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4c4c [0263.552] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4c54) returned 0x2e8700 [0263.552] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x4c4c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x4c4c, lpOverlapped=0x0) returned 1 [0263.554] CloseHandle (hObject=0xdc) returned 1 [0263.554] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf")) returned 1 [0263.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.555] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.555] GetTickCount () returned 0x51303 [0263.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.555] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.556] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547\\....\\temporaryfile")) returned 0 [0263.556] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547\\temporaryfile")) returned 1 [0263.557] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2075f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2075f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2075f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.558] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2075f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2075f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2075f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.558] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2075f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2075f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2075f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.558] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2075f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2075f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2075f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.558] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2075f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2075f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2075f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.558] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2075f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2075f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2075f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.558] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.558] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547\\temporaryfile")) returned 1 [0263.558] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2075f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2075f60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2075f60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.558] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.558] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547")) returned 1 [0263.558] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF") returned 0 [0263.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.560] WriteFile (in: hFile=0xdc, lpBuffer=0x2ed368*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ed368*, lpNumberOfBytesWritten=0x18fdd8*=0x4c50, lpOverlapped=0x0) returned 1 [0263.561] CloseHandle (hObject=0xdc) returned 1 [0263.561] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.562] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x382a [0263.562] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3832) returned 0x2e8700 [0263.562] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x382a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x382a, lpOverlapped=0x0) returned 1 [0263.563] CloseHandle (hObject=0xdc) returned 1 [0263.563] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf")) returned 1 [0263.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.564] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.564] GetTickCount () returned 0x51303 [0263.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.564] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.565] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.565] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547\\....\\temporaryfile")) returned 0 [0263.566] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547\\temporaryfile")) returned 1 [0263.568] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2075f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.568] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2075f60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.568] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.568] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.568] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.569] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.569] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.569] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547\\temporaryfile")) returned 1 [0263.569] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.569] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.569] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332547" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332547")) returned 1 [0263.569] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF") returned 0 [0263.570] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.571] WriteFile (in: hFile=0xdc, lpBuffer=0x2ebf48*, nNumberOfBytesToWrite=0x3830, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ebf48*, lpNumberOfBytesWritten=0x18fdd8*=0x3830, lpOverlapped=0x0) returned 1 [0263.572] CloseHandle (hObject=0xdc) returned 1 [0263.572] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.573] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b4a [0263.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b52) returned 0x2c4a70 [0263.573] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b4a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b4a, lpOverlapped=0x0) returned 1 [0263.574] CloseHandle (hObject=0xdc) returned 1 [0263.575] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf")) returned 1 [0263.575] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.575] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.576] GetTickCount () returned 0x51312 [0263.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.576] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.576] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332562\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332562\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332562\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332562\\....\\temporaryfile")) returned 0 [0263.577] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332562\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332562\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332562\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332562\\temporaryfile")) returned 1 [0263.578] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332562\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.578] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.579] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.579] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332562\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.579] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.579] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.579] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.579] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332562\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332562\\temporaryfile")) returned 1 [0263.579] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa209c0c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa209c0c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa209c0c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.579] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.579] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332562" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332562")) returned 1 [0263.579] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF") returned 0 [0263.580] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.580] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b50, lpOverlapped=0x0) returned 1 [0263.581] CloseHandle (hObject=0xdc) returned 1 [0263.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.582] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x540 [0263.582] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x548) returned 0x259e70 [0263.582] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x540, lpOverlapped=0x0) returned 1 [0263.584] CloseHandle (hObject=0xdc) returned 1 [0263.584] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf")) returned 1 [0263.584] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.584] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.585] GetTickCount () returned 0x51322 [0263.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.585] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.585] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578\\....\\temporaryfile")) returned 0 [0263.586] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578\\temporaryfile")) returned 1 [0263.587] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.587] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.587] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.587] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.587] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.587] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.588] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.588] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578\\temporaryfile")) returned 1 [0263.588] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.588] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.588] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578")) returned 1 [0263.588] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF") returned 0 [0263.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.589] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x548, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x548, lpOverlapped=0x0) returned 1 [0263.590] CloseHandle (hObject=0xdc) returned 1 [0263.590] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.591] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x334 [0263.591] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x33c) returned 0x259e70 [0263.591] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x334, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x334, lpOverlapped=0x0) returned 1 [0263.592] CloseHandle (hObject=0xdc) returned 1 [0263.592] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf")) returned 1 [0263.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.593] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.593] GetTickCount () returned 0x51322 [0263.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.594] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.594] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578\\....\\temporaryfile")) returned 0 [0263.594] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578\\temporaryfile")) returned 1 [0263.596] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.596] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.596] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.596] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.596] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.596] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.596] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.596] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578\\temporaryfile")) returned 1 [0263.596] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20c2220, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20c2220, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20c2220, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.596] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.597] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332578" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332578")) returned 1 [0263.597] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF") returned 0 [0263.597] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.598] WriteFile (in: hFile=0xdc, lpBuffer=0x25a1c0*, nNumberOfBytesToWrite=0x338, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a1c0*, lpNumberOfBytesWritten=0x18fdd8*=0x338, lpOverlapped=0x0) returned 1 [0263.599] CloseHandle (hObject=0xdc) returned 1 [0263.599] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.600] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x900 [0263.600] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x908) returned 0x2450048 [0263.600] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x900, lpOverlapped=0x0) returned 1 [0263.601] CloseHandle (hObject=0xdc) returned 1 [0263.601] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf")) returned 1 [0263.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.602] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.602] GetTickCount () returned 0x51332 [0263.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.602] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.603] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332594\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332594\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332594\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332594\\....\\temporaryfile")) returned 0 [0263.604] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332594\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332594\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332594\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332594\\temporaryfile")) returned 1 [0263.606] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332594\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20e8380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20e8380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20e8380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.606] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20e8380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20e8380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20e8380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.606] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20e8380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20e8380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20e8380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.606] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332594\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20e8380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20e8380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20e8380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.606] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20e8380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20e8380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20e8380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.606] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20e8380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20e8380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20e8380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.606] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.606] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332594\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332594\\temporaryfile")) returned 1 [0263.607] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa20e8380, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa20e8380, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa20e8380, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.607] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.607] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332594" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332594")) returned 1 [0263.607] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF") returned 0 [0263.607] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.608] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x908, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x908, lpOverlapped=0x0) returned 1 [0263.609] CloseHandle (hObject=0xdc) returned 1 [0263.610] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.611] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe88 [0263.611] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe90) returned 0x2450048 [0263.611] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xe88, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xe88, lpOverlapped=0x0) returned 1 [0263.618] CloseHandle (hObject=0xdc) returned 1 [0263.618] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf")) returned 1 [0263.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.619] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.619] GetTickCount () returned 0x51341 [0263.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.620] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332609\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332609\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332609\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332609\\....\\temporaryfile")) returned 0 [0263.620] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332609\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332609\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332609\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332609\\temporaryfile")) returned 1 [0263.622] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332609\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa210e4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa210e4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa210e4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.622] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa210e4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa210e4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa210e4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.622] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa210e4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa210e4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa210e4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.622] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332609\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa210e4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa210e4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa210e4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.622] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa210e4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa210e4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa210e4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.622] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa210e4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa210e4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa210e4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.622] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332609\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332609\\temporaryfile")) returned 1 [0263.622] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa210e4e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa210e4e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa210e4e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.622] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332609" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332609")) returned 1 [0263.623] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF") returned 0 [0263.623] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.624] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xe90, lpOverlapped=0x0) returned 1 [0263.625] CloseHandle (hObject=0xdc) returned 1 [0263.625] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.625] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8e0 [0263.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8e8) returned 0x2450048 [0263.626] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x8e0, lpOverlapped=0x0) returned 1 [0263.627] CloseHandle (hObject=0xdc) returned 1 [0263.627] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf")) returned 1 [0263.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.628] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.628] GetTickCount () returned 0x51351 [0263.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.628] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625\\....\\temporaryfile")) returned 0 [0263.629] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625\\temporaryfile")) returned 1 [0263.630] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.631] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.631] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.631] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.631] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.631] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.631] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.631] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625\\temporaryfile")) returned 1 [0263.631] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.631] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.631] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625")) returned 1 [0263.631] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF") returned 0 [0263.632] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.632] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x8e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x8e8, lpOverlapped=0x0) returned 1 [0263.633] CloseHandle (hObject=0xdc) returned 1 [0263.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.635] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x818 [0263.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x820) returned 0x2450048 [0263.635] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x818, lpOverlapped=0x0) returned 1 [0263.636] CloseHandle (hObject=0xdc) returned 1 [0263.637] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf")) returned 1 [0263.637] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.638] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.638] GetTickCount () returned 0x51351 [0263.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.638] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625\\....\\temporaryfile")) returned 0 [0263.639] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625\\temporaryfile")) returned 1 [0263.641] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.641] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.641] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.641] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.641] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.641] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.641] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.641] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625\\temporaryfile")) returned 1 [0263.641] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2134640, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2134640, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2134640, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.641] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.641] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332625" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332625")) returned 1 [0263.642] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF") returned 0 [0263.642] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.643] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x820, lpOverlapped=0x0) returned 1 [0263.644] CloseHandle (hObject=0xdc) returned 1 [0263.645] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.646] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa94 [0263.646] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa9c) returned 0x2450048 [0263.646] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xa94, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xa94, lpOverlapped=0x0) returned 1 [0263.648] CloseHandle (hObject=0xdc) returned 1 [0263.648] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf")) returned 1 [0263.648] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.648] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.649] GetTickCount () returned 0x51360 [0263.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.649] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332640\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332640\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332640\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332640\\....\\temporaryfile")) returned 0 [0263.650] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332640\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332640\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332640\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332640\\temporaryfile")) returned 1 [0263.651] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332640\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa215a7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa215a7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa215a7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.651] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa215a7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa215a7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa215a7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.651] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa215a7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa215a7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa215a7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.651] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332640\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa215a7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa215a7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa215a7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.652] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa215a7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa215a7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa215a7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.652] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa215a7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa215a7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa215a7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.652] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.652] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332640\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332640\\temporaryfile")) returned 1 [0263.652] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa215a7a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa215a7a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa215a7a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.652] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.652] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332640" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332640")) returned 1 [0263.652] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF") returned 0 [0263.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.653] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa98, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa98, lpOverlapped=0x0) returned 1 [0263.654] CloseHandle (hObject=0xdc) returned 1 [0263.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.655] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x38c [0263.655] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x394) returned 0x259e70 [0263.655] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x38c, lpOverlapped=0x0) returned 1 [0263.656] CloseHandle (hObject=0xdc) returned 1 [0263.656] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf")) returned 1 [0263.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.662] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.662] GetTickCount () returned 0x51370 [0263.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.662] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.663] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.663] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656\\....\\temporaryfile")) returned 0 [0263.663] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656\\temporaryfile")) returned 1 [0263.665] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.665] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.665] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.665] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.665] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.665] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.665] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.666] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656\\temporaryfile")) returned 1 [0263.666] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.666] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.666] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656")) returned 1 [0263.666] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF") returned 0 [0263.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.667] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x390, lpOverlapped=0x0) returned 1 [0263.668] CloseHandle (hObject=0xdc) returned 1 [0263.668] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.669] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x61c [0263.669] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x624) returned 0x259e70 [0263.669] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x61c, lpOverlapped=0x0) returned 1 [0263.670] CloseHandle (hObject=0xdc) returned 1 [0263.670] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf")) returned 1 [0263.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.671] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.671] GetTickCount () returned 0x51370 [0263.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.671] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.672] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.672] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656\\....\\temporaryfile")) returned 0 [0263.672] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656\\temporaryfile")) returned 1 [0263.674] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.674] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.674] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.674] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.674] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.674] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.674] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.675] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656\\temporaryfile")) returned 1 [0263.675] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2180900, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2180900, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2180900, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.675] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.675] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332656" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332656")) returned 1 [0263.675] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF") returned 0 [0263.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.676] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x620, lpOverlapped=0x0) returned 1 [0263.677] CloseHandle (hObject=0xdc) returned 1 [0263.677] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.678] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xaf0 [0263.678] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xaf8) returned 0x2450048 [0263.678] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xaf0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xaf0, lpOverlapped=0x0) returned 1 [0263.679] CloseHandle (hObject=0xdc) returned 1 [0263.679] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf")) returned 1 [0263.680] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.681] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.681] GetTickCount () returned 0x51380 [0263.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.681] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.681] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332672\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332672\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332672\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332672\\....\\temporaryfile")) returned 0 [0263.682] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332672\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332672\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332672\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332672\\temporaryfile")) returned 1 [0263.684] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332672\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21a6a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21a6a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21a6a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.684] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21a6a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21a6a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21a6a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.684] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21a6a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21a6a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21a6a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.684] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332672\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21a6a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21a6a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21a6a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.685] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21a6a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21a6a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21a6a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.685] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21a6a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21a6a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21a6a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.685] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.685] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332672\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332672\\temporaryfile")) returned 1 [0263.685] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21a6a60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21a6a60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21a6a60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.685] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.685] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332672" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332672")) returned 1 [0263.686] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF") returned 0 [0263.686] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.687] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xaf8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xaf8, lpOverlapped=0x0) returned 1 [0263.688] CloseHandle (hObject=0xdc) returned 1 [0263.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.690] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa68 [0263.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa70) returned 0x2450048 [0263.690] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xa68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xa68, lpOverlapped=0x0) returned 1 [0263.691] CloseHandle (hObject=0xdc) returned 1 [0263.691] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf")) returned 1 [0263.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.692] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.692] GetTickCount () returned 0x5138f [0263.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.692] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.693] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687\\....\\temporaryfile")) returned 0 [0263.694] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687\\temporaryfile")) returned 1 [0263.695] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.695] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.695] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.695] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.696] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.696] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.696] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.696] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687\\temporaryfile")) returned 1 [0263.696] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.696] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.696] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687")) returned 1 [0263.696] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF") returned 0 [0263.696] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.697] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa70, lpOverlapped=0x0) returned 1 [0263.698] CloseHandle (hObject=0xdc) returned 1 [0263.698] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.699] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x30e4 [0263.699] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30ec) returned 0x2e8700 [0263.699] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x30e4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x30e4, lpOverlapped=0x0) returned 1 [0263.701] CloseHandle (hObject=0xdc) returned 1 [0263.701] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf")) returned 1 [0263.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.702] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.702] GetTickCount () returned 0x5138f [0263.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.702] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.703] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687\\....\\temporaryfile")) returned 0 [0263.703] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687\\temporaryfile")) returned 1 [0263.705] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.705] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.705] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.705] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.705] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.705] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.705] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.705] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687\\temporaryfile")) returned 1 [0263.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21ccbc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21ccbc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21ccbc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.706] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.706] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332687" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332687")) returned 1 [0263.706] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF") returned 0 [0263.706] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.707] WriteFile (in: hFile=0xdc, lpBuffer=0x2eb800*, nNumberOfBytesToWrite=0x30e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eb800*, lpNumberOfBytesWritten=0x18fdd8*=0x30e8, lpOverlapped=0x0) returned 1 [0263.708] CloseHandle (hObject=0xdc) returned 1 [0263.708] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.710] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x17a1c [0263.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17a24) returned 0x2e8700 [0263.710] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x17a1c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x17a1c, lpOverlapped=0x0) returned 1 [0263.712] CloseHandle (hObject=0xdc) returned 1 [0263.712] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf")) returned 1 [0263.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.714] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.714] GetTickCount () returned 0x5139f [0263.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.714] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.714] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332703\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332703\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332703\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332703\\....\\temporaryfile")) returned 0 [0263.715] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332703\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332703\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332703\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332703\\temporaryfile")) returned 1 [0263.716] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332703\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21f2d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21f2d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21f2d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.716] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21f2d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21f2d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21f2d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.716] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21f2d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21f2d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21f2d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.717] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332703\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21f2d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21f2d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21f2d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.717] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21f2d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21f2d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21f2d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.717] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21f2d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21f2d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21f2d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.717] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.717] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332703\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332703\\temporaryfile")) returned 1 [0263.717] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21f2d20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa21f2d20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa21f2d20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.717] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.717] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332703" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332703")) returned 1 [0263.717] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF") returned 0 [0263.719] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.720] WriteFile (in: hFile=0xdc, lpBuffer=0x2350050*, nNumberOfBytesToWrite=0x17a20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesWritten=0x18fdd8*=0x17a20, lpOverlapped=0x0) returned 1 [0263.723] CloseHandle (hObject=0xdc) returned 1 [0263.724] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.725] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x670 [0263.725] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x678) returned 0x259e70 [0263.725] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x670, lpOverlapped=0x0) returned 1 [0263.726] CloseHandle (hObject=0xdc) returned 1 [0263.726] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf")) returned 1 [0263.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.727] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.727] GetTickCount () returned 0x513ae [0263.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.727] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.728] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.728] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718\\....\\temporaryfile")) returned 0 [0263.728] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718\\temporaryfile")) returned 1 [0263.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.730] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.730] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.730] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.730] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.730] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.730] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.730] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718\\temporaryfile")) returned 1 [0263.730] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.730] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.730] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718")) returned 1 [0263.730] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF") returned 0 [0263.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.731] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x678, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x678, lpOverlapped=0x0) returned 1 [0263.732] CloseHandle (hObject=0xdc) returned 1 [0263.732] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.733] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5b4 [0263.733] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5bc) returned 0x259e70 [0263.733] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5b4, lpOverlapped=0x0) returned 1 [0263.735] CloseHandle (hObject=0xdc) returned 1 [0263.735] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf")) returned 1 [0263.735] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.736] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.736] GetTickCount () returned 0x513ae [0263.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.736] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.736] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.737] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718\\....\\temporaryfile")) returned 0 [0263.737] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718\\temporaryfile")) returned 1 [0263.739] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa223efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa223efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.739] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa223efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa223efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.739] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.739] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.739] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.739] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.739] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.739] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718\\temporaryfile")) returned 1 [0263.739] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2218e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2218e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2218e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.739] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.739] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332718" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332718")) returned 1 [0263.740] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF") returned 0 [0263.740] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.740] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x5b8, lpOverlapped=0x0) returned 1 [0263.741] CloseHandle (hObject=0xdc) returned 1 [0263.741] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.742] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x504 [0263.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x50c) returned 0x259e70 [0263.742] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x504, lpOverlapped=0x0) returned 1 [0263.743] CloseHandle (hObject=0xdc) returned 1 [0263.744] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf")) returned 1 [0263.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.744] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.744] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.744] GetTickCount () returned 0x513be [0263.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.745] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332734\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332734\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332734\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332734\\....\\temporaryfile")) returned 0 [0263.746] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332734\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332734\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332734\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332734\\temporaryfile")) returned 1 [0263.747] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332734\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa223efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa223efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa223efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.747] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa223efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa223efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa223efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.747] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa223efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa223efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa223efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.747] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332734\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa223efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa223efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa223efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.748] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa223efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa223efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa223efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.748] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa223efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa223efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa223efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.748] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.748] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332734\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332734\\temporaryfile")) returned 1 [0263.748] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa223efe0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa223efe0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa223efe0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.748] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.748] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332734" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332734")) returned 1 [0263.748] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF") returned 0 [0263.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.749] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x508, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x508, lpOverlapped=0x0) returned 1 [0263.750] CloseHandle (hObject=0xdc) returned 1 [0263.750] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.751] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a54 [0263.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a5c) returned 0x2c4a70 [0263.751] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1a54, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a54, lpOverlapped=0x0) returned 1 [0263.753] CloseHandle (hObject=0xdc) returned 1 [0263.753] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf")) returned 1 [0263.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.754] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.754] GetTickCount () returned 0x513ce [0263.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.755] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.755] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750\\....\\temporaryfile")) returned 0 [0263.755] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750\\temporaryfile")) returned 1 [0263.757] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.757] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.757] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.757] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.757] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750\\temporaryfile")) returned 1 [0263.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.757] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750")) returned 1 [0263.758] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF") returned 0 [0263.758] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.759] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1a58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1a58, lpOverlapped=0x0) returned 1 [0263.760] CloseHandle (hObject=0xdc) returned 1 [0263.760] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.761] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x574 [0263.761] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x57c) returned 0x259e70 [0263.761] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x574, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x574, lpOverlapped=0x0) returned 1 [0263.764] CloseHandle (hObject=0xdc) returned 1 [0263.764] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf")) returned 1 [0263.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.765] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.765] GetTickCount () returned 0x513ce [0263.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.765] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.766] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.766] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750\\....\\temporaryfile")) returned 0 [0263.767] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750\\temporaryfile")) returned 1 [0263.769] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.769] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.769] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.769] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.769] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.769] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.769] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.769] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750\\temporaryfile")) returned 1 [0263.769] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2265140, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2265140, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2265140, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.769] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.770] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332750" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332750")) returned 1 [0263.770] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF") returned 0 [0263.770] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.771] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x578, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x578, lpOverlapped=0x0) returned 1 [0263.772] CloseHandle (hObject=0xdc) returned 1 [0263.772] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.774] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x19ca [0263.774] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x19d2) returned 0x2c4a70 [0263.774] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x19ca, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x19ca, lpOverlapped=0x0) returned 1 [0263.775] CloseHandle (hObject=0xdc) returned 1 [0263.776] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf")) returned 1 [0263.776] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.776] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.777] GetTickCount () returned 0x513dd [0263.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.777] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.777] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332765\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332765\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332765\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332765\\....\\temporaryfile")) returned 0 [0263.778] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332765\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332765\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332765\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332765\\temporaryfile")) returned 1 [0263.779] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332765\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa228b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa228b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa228b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.779] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa228b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa228b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa228b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.779] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa228b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa228b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa228b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.779] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332765\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa228b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa228b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa228b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.779] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa228b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa228b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa228b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.780] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa228b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa228b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa228b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.780] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.780] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332765\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332765\\temporaryfile")) returned 1 [0263.780] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa228b2a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa228b2a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa228b2a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.780] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.780] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332765" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332765")) returned 1 [0263.780] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF") returned 0 [0263.780] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.781] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x19d0, lpOverlapped=0x0) returned 1 [0263.782] CloseHandle (hObject=0xdc) returned 1 [0263.782] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.783] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5fec [0263.783] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5ff4) returned 0x2e8700 [0263.783] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x5fec, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x5fec, lpOverlapped=0x0) returned 1 [0263.784] CloseHandle (hObject=0xdc) returned 1 [0263.784] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf")) returned 1 [0263.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.785] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.785] GetTickCount () returned 0x513ed [0263.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.785] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.786] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.786] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781\\....\\temporaryfile")) returned 0 [0263.786] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781\\temporaryfile")) returned 1 [0263.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.788] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.788] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.788] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.788] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.788] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781\\temporaryfile")) returned 1 [0263.788] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.789] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.789] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781")) returned 1 [0263.789] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF") returned 0 [0263.789] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.790] WriteFile (in: hFile=0xdc, lpBuffer=0x2ee708*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ee708*, lpNumberOfBytesWritten=0x18fdd8*=0x5ff0, lpOverlapped=0x0) returned 1 [0263.791] CloseHandle (hObject=0xdc) returned 1 [0263.791] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.792] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7f4e [0263.792] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7f56) returned 0x2e8700 [0263.792] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x7f4e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x7f4e, lpOverlapped=0x0) returned 1 [0263.794] CloseHandle (hObject=0xdc) returned 1 [0263.794] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf")) returned 1 [0263.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.795] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.795] GetTickCount () returned 0x513ed [0263.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.795] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.796] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.796] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781\\....\\temporaryfile")) returned 0 [0263.796] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781\\temporaryfile")) returned 1 [0263.798] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.798] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.798] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.798] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.798] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.798] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.798] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781\\temporaryfile")) returned 1 [0263.798] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22b1400, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22b1400, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22b1400, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.798] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.798] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332781" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332781")) returned 1 [0263.799] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF") returned 0 [0263.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.800] WriteFile (in: hFile=0xdc, lpBuffer=0x2f0668*, nNumberOfBytesToWrite=0x7f58, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2f0668*, lpNumberOfBytesWritten=0x18fdd8*=0x7f58, lpOverlapped=0x0) returned 1 [0263.802] CloseHandle (hObject=0xdc) returned 1 [0263.802] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.803] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x430c [0263.803] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4314) returned 0x2e8700 [0263.803] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x430c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x430c, lpOverlapped=0x0) returned 1 [0263.805] CloseHandle (hObject=0xdc) returned 1 [0263.805] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf")) returned 1 [0263.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.806] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.806] GetTickCount () returned 0x513fc [0263.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.806] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.811] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.811] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332796\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332796\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.812] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332796\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332796\\....\\temporaryfile")) returned 0 [0263.812] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332796\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332796\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332796\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332796\\temporaryfile")) returned 1 [0263.813] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332796\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22d7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22d7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22d7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.813] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22d7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22d7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22d7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.813] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22d7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22d7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22d7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.813] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332796\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22d7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22d7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22d7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.814] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22d7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22d7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22d7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.814] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22d7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22d7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22d7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.814] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.814] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332796\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332796\\temporaryfile")) returned 1 [0263.814] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22d7560, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22d7560, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22d7560, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.814] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.814] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332796" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332796")) returned 1 [0263.814] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF") returned 0 [0263.815] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.815] WriteFile (in: hFile=0xdc, lpBuffer=0x2eca28*, nNumberOfBytesToWrite=0x4310, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eca28*, lpNumberOfBytesWritten=0x18fdd8*=0x4310, lpOverlapped=0x0) returned 1 [0263.816] CloseHandle (hObject=0xdc) returned 1 [0263.817] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.818] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5b70 [0263.818] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b78) returned 0x2e8700 [0263.819] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x5b70, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x5b70, lpOverlapped=0x0) returned 1 [0263.820] CloseHandle (hObject=0xdc) returned 1 [0263.820] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf")) returned 1 [0263.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.821] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.821] GetTickCount () returned 0x5140c [0263.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.821] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.822] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.822] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332812\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332812\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.822] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332812\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332812\\....\\temporaryfile")) returned 0 [0263.822] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332812\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332812\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332812\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332812\\temporaryfile")) returned 1 [0263.824] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332812\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22fd6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22fd6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22fd6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.824] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22fd6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22fd6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22fd6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.824] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22fd6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22fd6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22fd6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.824] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332812\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22fd6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22fd6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22fd6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22fd6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22fd6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22fd6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22fd6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22fd6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22fd6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.824] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.824] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332812\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332812\\temporaryfile")) returned 1 [0263.824] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa22fd6c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa22fd6c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa22fd6c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.824] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.824] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332812" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332812")) returned 1 [0263.824] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF") returned 0 [0263.825] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.826] WriteFile (in: hFile=0xdc, lpBuffer=0x2ee288*, nNumberOfBytesToWrite=0x5b78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ee288*, lpNumberOfBytesWritten=0x18fdd8*=0x5b78, lpOverlapped=0x0) returned 1 [0263.827] CloseHandle (hObject=0xdc) returned 1 [0263.827] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.828] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4b7a [0263.828] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4b82) returned 0x2e8700 [0263.828] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x4b7a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x4b7a, lpOverlapped=0x0) returned 1 [0263.830] CloseHandle (hObject=0xdc) returned 1 [0263.830] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf")) returned 1 [0263.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.831] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.831] GetTickCount () returned 0x5141c [0263.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.832] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.832] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828\\....\\temporaryfile")) returned 0 [0263.832] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828\\temporaryfile")) returned 1 [0263.834] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.834] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.834] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.834] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.834] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828\\temporaryfile")) returned 1 [0263.834] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.834] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.834] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828")) returned 1 [0263.835] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF") returned 0 [0263.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.836] WriteFile (in: hFile=0xdc, lpBuffer=0x2ed298*, nNumberOfBytesToWrite=0x4b80, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ed298*, lpNumberOfBytesWritten=0x18fdd8*=0x4b80, lpOverlapped=0x0) returned 1 [0263.837] CloseHandle (hObject=0xdc) returned 1 [0263.838] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.838] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1262e [0263.838] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12636) returned 0x2e8700 [0263.838] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x1262e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x1262e, lpOverlapped=0x0) returned 1 [0263.840] CloseHandle (hObject=0xdc) returned 1 [0263.840] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf")) returned 1 [0263.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.842] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.842] GetTickCount () returned 0x5141c [0263.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.842] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.842] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828\\....\\temporaryfile")) returned 0 [0263.843] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828\\temporaryfile")) returned 1 [0263.844] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.845] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.845] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.845] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.845] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.845] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.845] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.845] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828\\temporaryfile")) returned 1 [0263.845] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2323820, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2323820, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2323820, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.845] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.845] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332828" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332828")) returned 1 [0263.845] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF") returned 0 [0263.847] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.847] WriteFile (in: hFile=0xdc, lpBuffer=0x2fad48*, nNumberOfBytesToWrite=0x12638, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2fad48*, lpNumberOfBytesWritten=0x18fdd8*=0x12638, lpOverlapped=0x0) returned 1 [0263.849] CloseHandle (hObject=0xdc) returned 1 [0263.852] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.853] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x967a [0263.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9682) returned 0x2e8700 [0263.853] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x967a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x967a, lpOverlapped=0x0) returned 1 [0263.854] CloseHandle (hObject=0xdc) returned 1 [0263.854] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf")) returned 1 [0263.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.855] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.855] GetTickCount () returned 0x5142b [0263.855] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.856] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332843\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332843\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332843\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332843\\....\\temporaryfile")) returned 0 [0263.857] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332843\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332843\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332843\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332843\\temporaryfile")) returned 1 [0263.858] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332843\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2349980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2349980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2349980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2349980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2349980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2349980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2349980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2349980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2349980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.858] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332843\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2349980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2349980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2349980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.858] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2349980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2349980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2349980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.858] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2349980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2349980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2349980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.858] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.858] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332843\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332843\\temporaryfile")) returned 1 [0263.859] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2349980, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2349980, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2349980, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.859] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.859] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332843" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332843")) returned 1 [0263.859] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF") returned 0 [0263.860] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.860] WriteFile (in: hFile=0xdc, lpBuffer=0x2f1d98*, nNumberOfBytesToWrite=0x9680, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2f1d98*, lpNumberOfBytesWritten=0x18fdd8*=0x9680, lpOverlapped=0x0) returned 1 [0263.862] CloseHandle (hObject=0xdc) returned 1 [0263.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.863] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x22f4 [0263.863] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x22fc) returned 0x2e8700 [0263.863] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x22f4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x22f4, lpOverlapped=0x0) returned 1 [0263.865] CloseHandle (hObject=0xdc) returned 1 [0263.865] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf")) returned 1 [0263.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.866] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.866] GetTickCount () returned 0x5143b [0263.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.866] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.866] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859\\....\\temporaryfile")) returned 0 [0263.867] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859\\temporaryfile")) returned 1 [0263.868] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.868] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.868] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.868] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.868] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.868] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.869] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.869] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859\\temporaryfile")) returned 1 [0263.869] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.869] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.869] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859")) returned 1 [0263.869] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF") returned 0 [0263.869] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.870] WriteFile (in: hFile=0xdc, lpBuffer=0x2eaa10*, nNumberOfBytesToWrite=0x22f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eaa10*, lpNumberOfBytesWritten=0x18fdd8*=0x22f8, lpOverlapped=0x0) returned 1 [0263.871] CloseHandle (hObject=0xdc) returned 1 [0263.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.872] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x107b [0263.872] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1083) returned 0x25b528 [0263.872] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x107b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x107b, lpOverlapped=0x0) returned 1 [0263.873] CloseHandle (hObject=0xdc) returned 1 [0263.873] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1 [0263.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.875] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.875] GetTickCount () returned 0x5143b [0263.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.876] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.876] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859\\....\\temporaryfile")) returned 0 [0263.877] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859\\temporaryfile")) returned 1 [0263.879] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2395c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2395c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.879] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2395c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2395c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.879] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.879] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.879] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.879] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.879] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.879] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859\\temporaryfile")) returned 1 [0263.880] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa236fae0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa236fae0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa236fae0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.880] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.880] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332859" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332859")) returned 1 [0263.880] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 0 [0263.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.881] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1080, lpOverlapped=0x0) returned 1 [0263.883] CloseHandle (hObject=0xdc) returned 1 [0263.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.884] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1a2c [0263.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a34) returned 0x2c4a70 [0263.884] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1a2c, lpOverlapped=0x0) returned 1 [0263.885] CloseHandle (hObject=0xdc) returned 1 [0263.885] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0263.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.886] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.886] GetTickCount () returned 0x5144a [0263.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.886] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.887] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.887] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332874\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332874\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332874\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332874\\....\\temporaryfile")) returned 0 [0263.888] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332874\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332874\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332874\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332874\\temporaryfile")) returned 1 [0263.889] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332874\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2395c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2395c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2395c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.889] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2395c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2395c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2395c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.889] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2395c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2395c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2395c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.889] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332874\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2395c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2395c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2395c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.889] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2395c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2395c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2395c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.889] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2395c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2395c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2395c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.890] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.890] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332874\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332874\\temporaryfile")) returned 1 [0263.890] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2395c40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2395c40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2395c40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.890] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.890] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332874" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332874")) returned 1 [0263.890] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 0 [0263.890] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.891] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1a30, lpOverlapped=0x0) returned 1 [0263.892] CloseHandle (hObject=0xdc) returned 1 [0263.892] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.893] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbd6 [0263.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbde) returned 0x2450048 [0263.893] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xbd6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xbd6, lpOverlapped=0x0) returned 1 [0263.895] CloseHandle (hObject=0xdc) returned 1 [0263.895] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf")) returned 1 [0263.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.896] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.896] GetTickCount () returned 0x5145a [0263.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.896] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.896] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890\\....\\temporaryfile")) returned 0 [0263.897] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890\\temporaryfile")) returned 1 [0263.898] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.898] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.898] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.898] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.898] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.898] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.898] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.898] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890\\temporaryfile")) returned 1 [0263.899] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.899] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.899] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890")) returned 1 [0263.899] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF") returned 0 [0263.899] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.900] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xbe0, lpOverlapped=0x0) returned 1 [0263.901] CloseHandle (hObject=0xdc) returned 1 [0263.901] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.902] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa16 [0263.902] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa1e) returned 0x2450048 [0263.902] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xa16, lpOverlapped=0x0) returned 1 [0263.903] CloseHandle (hObject=0xdc) returned 1 [0263.903] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf")) returned 1 [0263.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.904] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.904] GetTickCount () returned 0x5145a [0263.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.904] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.905] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.905] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890\\....\\temporaryfile")) returned 0 [0263.905] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890\\temporaryfile")) returned 1 [0263.907] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.907] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.907] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.907] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.907] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.907] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.907] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.907] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890\\temporaryfile")) returned 1 [0263.907] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23bbda0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23bbda0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23bbda0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.907] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.907] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332890" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332890")) returned 1 [0263.908] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF") returned 0 [0263.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.909] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa20, lpOverlapped=0x0) returned 1 [0263.910] CloseHandle (hObject=0xdc) returned 1 [0263.910] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.910] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x36dc [0263.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x36e4) returned 0x2e8700 [0263.910] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x36dc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x36dc, lpOverlapped=0x0) returned 1 [0263.912] CloseHandle (hObject=0xdc) returned 1 [0263.912] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0263.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.913] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.913] GetTickCount () returned 0x5146a [0263.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.913] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.914] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.914] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906\\....\\temporaryfile")) returned 0 [0263.914] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906\\temporaryfile")) returned 1 [0263.916] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.916] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.916] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.916] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.916] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.916] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.916] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.916] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906\\temporaryfile")) returned 1 [0263.916] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.916] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.916] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906")) returned 1 [0263.916] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 0 [0263.917] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.918] WriteFile (in: hFile=0xdc, lpBuffer=0x2ebdf8*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ebdf8*, lpNumberOfBytesWritten=0x18fdd8*=0x36e0, lpOverlapped=0x0) returned 1 [0263.919] CloseHandle (hObject=0xdc) returned 1 [0263.919] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.919] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2135 [0263.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x213d) returned 0x2e8700 [0263.919] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2135, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2135, lpOverlapped=0x0) returned 1 [0263.921] CloseHandle (hObject=0xdc) returned 1 [0263.921] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0263.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.922] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.922] GetTickCount () returned 0x5146a [0263.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.922] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.923] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.923] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906\\....\\temporaryfile")) returned 0 [0263.924] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906\\temporaryfile")) returned 1 [0263.926] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2408060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2408060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.926] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2408060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2408060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.926] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.926] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.926] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.926] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.926] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.926] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906\\temporaryfile")) returned 1 [0263.927] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa23e1f00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa23e1f00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa23e1f00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.927] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.927] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332906" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332906")) returned 1 [0263.927] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 0 [0263.927] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.928] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea850*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea850*, lpNumberOfBytesWritten=0x18fdd8*=0x2140, lpOverlapped=0x0) returned 1 [0263.929] CloseHandle (hObject=0xdc) returned 1 [0263.930] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.931] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4f0 [0263.931] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4f8) returned 0x259e70 [0263.931] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4f0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x4f0, lpOverlapped=0x0) returned 1 [0263.932] CloseHandle (hObject=0xdc) returned 1 [0263.933] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf")) returned 1 [0263.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.933] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.933] GetTickCount () returned 0x51479 [0263.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.934] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.934] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332921\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332921\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332921\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332921\\....\\temporaryfile")) returned 0 [0263.935] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332921\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332921\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332921\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332921\\temporaryfile")) returned 1 [0263.936] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332921\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2408060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2408060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2408060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.936] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2408060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2408060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2408060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.936] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2408060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2408060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2408060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.936] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332921\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2408060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2408060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2408060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.936] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2408060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2408060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2408060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.936] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2408060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2408060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2408060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.937] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.937] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332921\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332921\\temporaryfile")) returned 1 [0263.937] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2408060, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2408060, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2408060, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.937] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.937] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332921" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332921")) returned 1 [0263.937] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF") returned 0 [0263.937] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.938] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x4f8, lpOverlapped=0x0) returned 1 [0263.939] CloseHandle (hObject=0xdc) returned 1 [0263.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.940] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1844 [0263.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x184c) returned 0x2c4a70 [0263.940] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1844, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1844, lpOverlapped=0x0) returned 1 [0263.941] CloseHandle (hObject=0xdc) returned 1 [0263.941] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf")) returned 1 [0263.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.942] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.942] GetTickCount () returned 0x51489 [0263.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.942] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.943] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.943] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937\\....\\temporaryfile")) returned 0 [0263.943] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937\\temporaryfile")) returned 1 [0263.945] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.945] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.945] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.945] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.945] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.945] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.945] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.945] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937\\temporaryfile")) returned 1 [0263.945] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.945] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.945] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937")) returned 1 [0263.946] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF") returned 0 [0263.946] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.947] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1848, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1848, lpOverlapped=0x0) returned 1 [0263.948] CloseHandle (hObject=0xdc) returned 1 [0263.948] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.949] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x81c [0263.949] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x824) returned 0x2450048 [0263.949] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x81c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x81c, lpOverlapped=0x0) returned 1 [0263.951] CloseHandle (hObject=0xdc) returned 1 [0263.951] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf")) returned 1 [0263.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.952] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.952] GetTickCount () returned 0x51489 [0263.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.952] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.952] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937\\....\\temporaryfile")) returned 0 [0263.953] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937\\temporaryfile")) returned 1 [0263.954] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.954] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.954] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.954] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.955] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.955] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.955] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.955] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937\\temporaryfile")) returned 1 [0263.955] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa242e1c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa242e1c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa242e1c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.955] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.960] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332937" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332937")) returned 1 [0263.960] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF") returned 0 [0263.961] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.961] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x820, lpOverlapped=0x0) returned 1 [0263.962] CloseHandle (hObject=0xdc) returned 1 [0263.962] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.964] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1412 [0263.964] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x141a) returned 0x25b528 [0263.964] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1412, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1412, lpOverlapped=0x0) returned 1 [0263.965] CloseHandle (hObject=0xdc) returned 1 [0263.965] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf")) returned 1 [0263.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.966] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.966] GetTickCount () returned 0x51498 [0263.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.967] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.967] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332952\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332952\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332952\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332952\\....\\temporaryfile")) returned 0 [0263.967] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332952\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332952\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332952\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332952\\temporaryfile")) returned 1 [0263.969] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332952\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2454320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2454320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2454320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.969] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2454320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2454320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2454320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.969] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2454320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2454320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2454320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.969] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332952\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2454320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2454320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2454320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.969] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2454320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2454320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2454320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.969] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2454320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2454320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2454320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.969] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.969] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332952\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332952\\temporaryfile")) returned 1 [0263.969] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2454320, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2454320, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2454320, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.969] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.969] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332952" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332952")) returned 1 [0263.970] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF") returned 0 [0263.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.971] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1418, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1418, lpOverlapped=0x0) returned 1 [0263.972] CloseHandle (hObject=0xdc) returned 1 [0263.972] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.972] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x50c [0263.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x514) returned 0x259e70 [0263.972] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x50c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x50c, lpOverlapped=0x0) returned 1 [0263.974] CloseHandle (hObject=0xdc) returned 1 [0263.974] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf")) returned 1 [0263.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.975] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.975] GetTickCount () returned 0x514a8 [0263.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.976] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.976] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968\\....\\temporaryfile")) returned 0 [0263.976] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968\\temporaryfile")) returned 1 [0263.977] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.978] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.978] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.978] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.978] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.978] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.978] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968\\temporaryfile")) returned 1 [0263.978] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.978] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.978] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968")) returned 1 [0263.978] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF") returned 0 [0263.979] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.979] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x510, lpOverlapped=0x0) returned 1 [0263.980] CloseHandle (hObject=0xdc) returned 1 [0263.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.981] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x778 [0263.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x780) returned 0x2450048 [0263.981] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x778, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x778, lpOverlapped=0x0) returned 1 [0263.982] CloseHandle (hObject=0xdc) returned 1 [0263.982] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf")) returned 1 [0263.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0263.983] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.983] GetTickCount () returned 0x514a8 [0263.983] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.984] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968\\...."), lpSecurityAttributes=0x256228) returned 1 [0263.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968\\....\\temporaryfile")) returned 0 [0263.985] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968\\temporaryfile")) returned 1 [0263.986] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.986] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.986] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.986] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.986] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.987] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.987] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968\\temporaryfile")) returned 1 [0263.987] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa247a480, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa247a480, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa247a480, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.987] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332968" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332968")) returned 1 [0263.987] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF") returned 0 [0263.987] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.988] WriteFile (in: hFile=0xdc, lpBuffer=0x24507d8*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x24507d8*, lpNumberOfBytesWritten=0x18fdd8*=0x780, lpOverlapped=0x0) returned 1 [0263.989] CloseHandle (hObject=0xdc) returned 1 [0263.989] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.990] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2094 [0263.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x209c) returned 0x2e8700 [0263.990] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2094, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2094, lpOverlapped=0x0) returned 1 [0263.991] CloseHandle (hObject=0xdc) returned 1 [0263.991] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf")) returned 1 [0263.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0263.992] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0263.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0263.992] GetTickCount () returned 0x514b8 [0263.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0263.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0263.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0263.993] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984\\...."), lpSecurityAttributes=0x256210) returned 1 [0263.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984\\....\\temporaryfile")) returned 0 [0263.993] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984\\temporaryfile")) returned 1 [0263.995] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24a05e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24a05e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24a05e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0263.995] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24a05e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24a05e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24a05e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.995] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24a05e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24a05e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24a05e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0263.995] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24a05e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24a05e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24a05e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0263.995] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24a05e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24a05e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24a05e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.995] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24a05e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24a05e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24a05e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0263.995] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0263.995] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984\\temporaryfile")) returned 1 [0263.995] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24a05e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24a05e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24a05e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0263.995] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0263.995] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984")) returned 1 [0263.996] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF") returned 0 [0263.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.997] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea7b0*, nNumberOfBytesToWrite=0x2098, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea7b0*, lpNumberOfBytesWritten=0x18fdd8*=0x2098, lpOverlapped=0x0) returned 1 [0263.997] CloseHandle (hObject=0xdc) returned 1 [0263.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0263.999] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2fdc [0263.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2fe4) returned 0x2e8700 [0263.999] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2fdc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2fdc, lpOverlapped=0x0) returned 1 [0264.000] CloseHandle (hObject=0xdc) returned 1 [0264.000] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf")) returned 1 [0264.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.001] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.001] GetTickCount () returned 0x514b8 [0264.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.001] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.002] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984\\....\\temporaryfile")) returned 0 [0264.002] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984\\temporaryfile")) returned 1 [0264.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.004] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.004] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.004] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.004] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984\\temporaryfile")) returned 1 [0264.004] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.005] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.005] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332984" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332984")) returned 1 [0264.005] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF") returned 0 [0264.005] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.006] WriteFile (in: hFile=0xdc, lpBuffer=0x2eb6f8*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eb6f8*, lpNumberOfBytesWritten=0x18fdd8*=0x2fe0, lpOverlapped=0x0) returned 1 [0264.007] CloseHandle (hObject=0xdc) returned 1 [0264.007] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.008] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2764 [0264.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x276c) returned 0x2e8700 [0264.008] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2764, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2764, lpOverlapped=0x0) returned 1 [0264.010] CloseHandle (hObject=0xdc) returned 1 [0264.010] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf")) returned 1 [0264.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.011] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.011] GetTickCount () returned 0x514c7 [0264.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.011] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332999\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332999\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332999\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332999\\....\\temporaryfile")) returned 0 [0264.012] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332999\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332999\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332999\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332999\\temporaryfile")) returned 1 [0264.014] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332999\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.014] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.014] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.014] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332999\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.014] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.014] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.014] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.014] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332999\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332999\\temporaryfile")) returned 1 [0264.014] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24c6740, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24c6740, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24c6740, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.014] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.014] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18332999" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18332999")) returned 1 [0264.015] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF") returned 0 [0264.015] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.016] WriteFile (in: hFile=0xdc, lpBuffer=0x2eae80*, nNumberOfBytesToWrite=0x2768, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eae80*, lpNumberOfBytesWritten=0x18fdd8*=0x2768, lpOverlapped=0x0) returned 1 [0264.017] CloseHandle (hObject=0xdc) returned 1 [0264.017] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.019] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9b0 [0264.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9b8) returned 0x2450048 [0264.019] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x9b0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x9b0, lpOverlapped=0x0) returned 1 [0264.020] CloseHandle (hObject=0xdc) returned 1 [0264.020] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf")) returned 1 [0264.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.021] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.021] GetTickCount () returned 0x514d7 [0264.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.022] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015\\....\\temporaryfile")) returned 0 [0264.022] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015\\temporaryfile")) returned 1 [0264.024] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.024] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.024] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.024] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.024] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.024] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.024] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.024] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015\\temporaryfile")) returned 1 [0264.024] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.024] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.025] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015")) returned 1 [0264.025] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF") returned 0 [0264.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.026] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x9b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x9b8, lpOverlapped=0x0) returned 1 [0264.027] CloseHandle (hObject=0xdc) returned 1 [0264.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.028] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x634 [0264.028] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x63c) returned 0x259e70 [0264.028] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x634, lpOverlapped=0x0) returned 1 [0264.029] CloseHandle (hObject=0xdc) returned 1 [0264.029] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf")) returned 1 [0264.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.030] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.030] GetTickCount () returned 0x514d7 [0264.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.031] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.031] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015\\....\\temporaryfile")) returned 0 [0264.031] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015\\temporaryfile")) returned 1 [0264.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.060] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.061] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.061] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.061] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.061] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.061] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.061] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015\\temporaryfile")) returned 1 [0264.061] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa24ec8a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa24ec8a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa24ec8a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.061] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.061] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333015" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333015")) returned 1 [0264.062] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF") returned 0 [0264.062] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.064] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x638, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x638, lpOverlapped=0x0) returned 1 [0264.065] CloseHandle (hObject=0xdc) returned 1 [0264.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.066] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2734 [0264.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x273c) returned 0x2e8700 [0264.066] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2734, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2734, lpOverlapped=0x0) returned 1 [0264.067] CloseHandle (hObject=0xdc) returned 1 [0264.067] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf")) returned 1 [0264.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.068] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.068] GetTickCount () returned 0x51506 [0264.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.069] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062\\....\\temporaryfile")) returned 0 [0264.070] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062\\temporaryfile")) returned 1 [0264.071] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa255ecc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa255ecc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa255ecc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.072] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa255ecc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa255ecc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa255ecc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.072] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa255ecc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa255ecc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa255ecc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.072] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa255ecc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa255ecc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa255ecc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.072] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa255ecc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa255ecc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa255ecc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.072] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa255ecc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa255ecc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa255ecc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.072] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.072] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062\\temporaryfile")) returned 1 [0264.072] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa255ecc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa255ecc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa255ecc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.072] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.072] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062")) returned 1 [0264.072] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF") returned 0 [0264.073] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.073] WriteFile (in: hFile=0xdc, lpBuffer=0x2eae50*, nNumberOfBytesToWrite=0x2738, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eae50*, lpNumberOfBytesWritten=0x18fdd8*=0x2738, lpOverlapped=0x0) returned 1 [0264.074] CloseHandle (hObject=0xdc) returned 1 [0264.075] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.075] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x78a [0264.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x792) returned 0x2450048 [0264.075] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x78a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x78a, lpOverlapped=0x0) returned 1 [0264.078] CloseHandle (hObject=0xdc) returned 1 [0264.078] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf")) returned 1 [0264.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.079] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.079] GetTickCount () returned 0x51506 [0264.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.079] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.080] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.080] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062\\....\\temporaryfile")) returned 0 [0264.081] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062\\temporaryfile")) returned 1 [0264.082] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.083] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.083] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.083] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.083] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.083] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.083] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.083] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062\\temporaryfile")) returned 1 [0264.083] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.083] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.083] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333062" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333062")) returned 1 [0264.083] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF") returned 0 [0264.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.084] WriteFile (in: hFile=0xdc, lpBuffer=0x24507f0*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x24507f0*, lpNumberOfBytesWritten=0x18fdd8*=0x790, lpOverlapped=0x0) returned 1 [0264.085] CloseHandle (hObject=0xdc) returned 1 [0264.085] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.086] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x326 [0264.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x32e) returned 0x259e70 [0264.087] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x326, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x326, lpOverlapped=0x0) returned 1 [0264.088] CloseHandle (hObject=0xdc) returned 1 [0264.088] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf")) returned 1 [0264.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.089] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.089] GetTickCount () returned 0x51515 [0264.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.089] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.089] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333077\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333077\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333077\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333077\\....\\temporaryfile")) returned 0 [0264.090] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333077\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333077\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333077\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333077\\temporaryfile")) returned 1 [0264.092] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333077\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.092] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.092] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.092] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333077\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.092] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.092] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.092] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.092] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333077\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333077\\temporaryfile")) returned 1 [0264.092] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2584e20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2584e20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2584e20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.092] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.092] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333077" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333077")) returned 1 [0264.093] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF") returned 0 [0264.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.093] WriteFile (in: hFile=0xdc, lpBuffer=0x2a0a90*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a0a90*, lpNumberOfBytesWritten=0x18fdd8*=0x330, lpOverlapped=0x0) returned 1 [0264.094] CloseHandle (hObject=0xdc) returned 1 [0264.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.095] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x470 [0264.095] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x478) returned 0x259e70 [0264.095] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x470, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x470, lpOverlapped=0x0) returned 1 [0264.097] CloseHandle (hObject=0xdc) returned 1 [0264.097] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf")) returned 1 [0264.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.098] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.098] GetTickCount () returned 0x51525 [0264.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.098] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.098] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093\\....\\temporaryfile")) returned 0 [0264.099] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093\\temporaryfile")) returned 1 [0264.100] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.100] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.100] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.100] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.100] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.100] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.101] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.101] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093\\temporaryfile")) returned 1 [0264.101] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.101] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.101] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093")) returned 1 [0264.101] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF") returned 0 [0264.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.102] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x478, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x478, lpOverlapped=0x0) returned 1 [0264.103] CloseHandle (hObject=0xdc) returned 1 [0264.103] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.104] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13c4 [0264.104] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x13cc) returned 0x25b528 [0264.104] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x13c4, lpOverlapped=0x0) returned 1 [0264.105] CloseHandle (hObject=0xdc) returned 1 [0264.105] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf")) returned 1 [0264.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.106] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.106] GetTickCount () returned 0x51525 [0264.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.106] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.107] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093\\....\\temporaryfile")) returned 0 [0264.107] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093\\temporaryfile")) returned 1 [0264.109] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.109] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.109] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.109] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.109] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.109] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.109] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.109] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093\\temporaryfile")) returned 1 [0264.109] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25aaf80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25aaf80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25aaf80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.109] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.110] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333093" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333093")) returned 1 [0264.110] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF") returned 0 [0264.110] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.111] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x13c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x13c8, lpOverlapped=0x0) returned 1 [0264.112] CloseHandle (hObject=0xdc) returned 1 [0264.112] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.113] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xce8 [0264.113] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xcf0) returned 0x2450048 [0264.113] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xce8, lpOverlapped=0x0) returned 1 [0264.114] CloseHandle (hObject=0xdc) returned 1 [0264.115] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf")) returned 1 [0264.115] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.115] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.116] GetTickCount () returned 0x51534 [0264.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.116] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.116] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333108\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333108\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333108\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333108\\....\\temporaryfile")) returned 0 [0264.117] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333108\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333108\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333108\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333108\\temporaryfile")) returned 1 [0264.118] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333108\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25d10e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25d10e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25d10e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.118] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25d10e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25d10e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25d10e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.118] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25d10e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25d10e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25d10e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.118] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333108\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25d10e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25d10e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25d10e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.118] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25d10e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25d10e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25d10e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.118] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25d10e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25d10e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25d10e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.118] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.118] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333108\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333108\\temporaryfile")) returned 1 [0264.119] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25d10e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25d10e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25d10e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.119] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.119] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333108" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333108")) returned 1 [0264.119] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF") returned 0 [0264.119] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.120] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xcf0, lpOverlapped=0x0) returned 1 [0264.121] CloseHandle (hObject=0xdc) returned 1 [0264.126] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.126] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x338e [0264.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3396) returned 0x2e8700 [0264.126] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x338e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x338e, lpOverlapped=0x0) returned 1 [0264.128] CloseHandle (hObject=0xdc) returned 1 [0264.128] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf")) returned 1 [0264.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.129] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.129] GetTickCount () returned 0x51544 [0264.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.129] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124\\....\\temporaryfile")) returned 0 [0264.130] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124\\temporaryfile")) returned 1 [0264.131] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.131] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.131] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.131] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.132] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.132] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.132] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.132] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124\\temporaryfile")) returned 1 [0264.132] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.132] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.132] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124")) returned 1 [0264.132] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF") returned 0 [0264.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.133] WriteFile (in: hFile=0xdc, lpBuffer=0x2ebaa8*, nNumberOfBytesToWrite=0x3398, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ebaa8*, lpNumberOfBytesWritten=0x18fdd8*=0x3398, lpOverlapped=0x0) returned 1 [0264.134] CloseHandle (hObject=0xdc) returned 1 [0264.134] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.135] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8b6 [0264.135] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8be) returned 0x2450048 [0264.135] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x8b6, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x8b6, lpOverlapped=0x0) returned 1 [0264.136] CloseHandle (hObject=0xdc) returned 1 [0264.136] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf")) returned 1 [0264.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.137] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.138] GetTickCount () returned 0x51544 [0264.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.138] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.138] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124\\....\\temporaryfile")) returned 0 [0264.140] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124\\temporaryfile")) returned 1 [0264.141] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.141] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.141] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.141] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.142] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.142] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.142] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.142] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124\\temporaryfile")) returned 1 [0264.142] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa25f7240, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa25f7240, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa25f7240, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.142] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.142] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333124" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333124")) returned 1 [0264.142] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF") returned 0 [0264.143] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.144] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x8c0, lpOverlapped=0x0) returned 1 [0264.145] CloseHandle (hObject=0xdc) returned 1 [0264.145] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.146] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xbde2 [0264.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbdea) returned 0x2e8700 [0264.146] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0xbde2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0xbde2, lpOverlapped=0x0) returned 1 [0264.148] CloseHandle (hObject=0xdc) returned 1 [0264.148] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf")) returned 1 [0264.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.149] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.149] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.149] GetTickCount () returned 0x51554 [0264.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.150] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.150] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333140\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333140\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333140\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333140\\....\\temporaryfile")) returned 0 [0264.151] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333140\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333140\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333140\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333140\\temporaryfile")) returned 1 [0264.152] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333140\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa261d3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa261d3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa261d3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.152] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa261d3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa261d3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa261d3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.152] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa261d3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa261d3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa261d3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.152] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333140\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa261d3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa261d3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa261d3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.152] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa261d3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa261d3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa261d3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.152] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa261d3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa261d3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa261d3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.152] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.152] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333140\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333140\\temporaryfile")) returned 1 [0264.153] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa261d3a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa261d3a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa261d3a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.153] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.153] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333140" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333140")) returned 1 [0264.153] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF") returned 0 [0264.154] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.155] WriteFile (in: hFile=0xdc, lpBuffer=0x2f4500*, nNumberOfBytesToWrite=0xbde8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2f4500*, lpNumberOfBytesWritten=0x18fdd8*=0xbde8, lpOverlapped=0x0) returned 1 [0264.157] CloseHandle (hObject=0xdc) returned 1 [0264.157] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.158] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d5e [0264.158] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d66) returned 0x2e8700 [0264.158] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x1d5e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x1d5e, lpOverlapped=0x0) returned 1 [0264.159] CloseHandle (hObject=0xdc) returned 1 [0264.159] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf")) returned 1 [0264.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.160] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.160] GetTickCount () returned 0x51563 [0264.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.160] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.161] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155\\....\\temporaryfile")) returned 0 [0264.161] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155\\temporaryfile")) returned 1 [0264.163] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.163] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.163] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.163] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.163] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.163] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.163] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155\\temporaryfile")) returned 1 [0264.163] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.163] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.163] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155")) returned 1 [0264.164] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF") returned 0 [0264.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.165] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea478*, nNumberOfBytesToWrite=0x1d68, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea478*, lpNumberOfBytesWritten=0x18fdd8*=0x1d68, lpOverlapped=0x0) returned 1 [0264.166] CloseHandle (hObject=0xdc) returned 1 [0264.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.166] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x243c [0264.167] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2444) returned 0x2e8700 [0264.167] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x243c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x243c, lpOverlapped=0x0) returned 1 [0264.168] CloseHandle (hObject=0xdc) returned 1 [0264.168] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf")) returned 1 [0264.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.169] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.169] GetTickCount () returned 0x51563 [0264.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.170] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.170] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155\\....\\temporaryfile")) returned 0 [0264.170] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155\\temporaryfile")) returned 1 [0264.172] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.172] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.172] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.172] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.172] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.172] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.172] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.172] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155\\temporaryfile")) returned 1 [0264.172] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2643500, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2643500, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2643500, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.172] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.173] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333155" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333155")) returned 1 [0264.173] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF") returned 0 [0264.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.174] WriteFile (in: hFile=0xdc, lpBuffer=0x2eab58*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eab58*, lpNumberOfBytesWritten=0x18fdd8*=0x2440, lpOverlapped=0x0) returned 1 [0264.175] CloseHandle (hObject=0xdc) returned 1 [0264.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.177] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x175a [0264.177] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1762) returned 0x2c4a70 [0264.177] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x175a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x175a, lpOverlapped=0x0) returned 1 [0264.178] CloseHandle (hObject=0xdc) returned 1 [0264.178] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf")) returned 1 [0264.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.179] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.179] GetTickCount () returned 0x51573 [0264.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.179] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.180] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.180] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171\\....\\temporaryfile")) returned 0 [0264.180] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171\\temporaryfile")) returned 1 [0264.181] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.181] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.182] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.182] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.182] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.182] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.182] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.182] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171\\temporaryfile")) returned 1 [0264.182] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.182] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.182] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171")) returned 1 [0264.182] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF") returned 0 [0264.183] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.183] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1760, lpOverlapped=0x0) returned 1 [0264.184] CloseHandle (hObject=0xdc) returned 1 [0264.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.186] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1c12 [0264.186] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1c1a) returned 0x2c4a70 [0264.186] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1c12, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1c12, lpOverlapped=0x0) returned 1 [0264.187] CloseHandle (hObject=0xdc) returned 1 [0264.187] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf")) returned 1 [0264.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.188] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.188] GetTickCount () returned 0x51573 [0264.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.189] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.189] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171\\....\\temporaryfile")) returned 0 [0264.190] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171\\temporaryfile")) returned 1 [0264.191] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa268f7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa268f7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.191] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa268f7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa268f7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.191] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.191] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.191] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.191] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.191] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.191] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171\\temporaryfile")) returned 1 [0264.191] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2669660, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2669660, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2669660, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.192] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.192] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333171" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333171")) returned 1 [0264.192] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF") returned 0 [0264.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.193] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1c18, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1c18, lpOverlapped=0x0) returned 1 [0264.194] CloseHandle (hObject=0xdc) returned 1 [0264.194] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.194] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1224 [0264.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x122c) returned 0x25b528 [0264.194] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1224, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1224, lpOverlapped=0x0) returned 1 [0264.196] CloseHandle (hObject=0xdc) returned 1 [0264.196] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf")) returned 1 [0264.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.197] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.197] GetTickCount () returned 0x51582 [0264.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.197] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333186\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333186\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333186\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333186\\....\\temporaryfile")) returned 0 [0264.198] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333186\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333186\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333186\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333186\\temporaryfile")) returned 1 [0264.199] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333186\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa268f7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa268f7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa268f7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.200] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa268f7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa268f7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa268f7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.200] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa268f7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa268f7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa268f7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.200] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333186\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa268f7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa268f7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa268f7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.200] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa268f7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa268f7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa268f7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.200] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa268f7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa268f7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa268f7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.200] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.200] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333186\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333186\\temporaryfile")) returned 1 [0264.200] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa268f7c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa268f7c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa268f7c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.200] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.200] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333186" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333186")) returned 1 [0264.200] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF") returned 0 [0264.201] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.201] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1228, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1228, lpOverlapped=0x0) returned 1 [0264.202] CloseHandle (hObject=0xdc) returned 1 [0264.202] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.203] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1bc0 [0264.203] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1bc8) returned 0x2c4a70 [0264.203] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1bc0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1bc0, lpOverlapped=0x0) returned 1 [0264.205] CloseHandle (hObject=0xdc) returned 1 [0264.205] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf")) returned 1 [0264.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.206] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.206] GetTickCount () returned 0x51592 [0264.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.206] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202\\....\\temporaryfile")) returned 0 [0264.207] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202\\temporaryfile")) returned 1 [0264.208] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.208] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.208] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.208] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.209] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.209] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.209] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.209] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202\\temporaryfile")) returned 1 [0264.209] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.209] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.209] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202")) returned 1 [0264.209] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF") returned 0 [0264.210] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.210] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1bc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1bc8, lpOverlapped=0x0) returned 1 [0264.211] CloseHandle (hObject=0xdc) returned 1 [0264.211] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.212] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x738 [0264.212] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x740) returned 0x2450048 [0264.212] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x738, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x738, lpOverlapped=0x0) returned 1 [0264.214] CloseHandle (hObject=0xdc) returned 1 [0264.214] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf")) returned 1 [0264.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.215] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.215] GetTickCount () returned 0x51592 [0264.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.215] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.216] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.216] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202\\....\\temporaryfile")) returned 0 [0264.217] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202\\temporaryfile")) returned 1 [0264.218] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.219] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.219] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.219] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.219] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.219] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.219] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202\\temporaryfile")) returned 1 [0264.219] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26b5920, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26b5920, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26b5920, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.219] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.219] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333202" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333202")) returned 1 [0264.220] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF") returned 0 [0264.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.229] WriteFile (in: hFile=0xdc, lpBuffer=0x2450798*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450798*, lpNumberOfBytesWritten=0x18fdd8*=0x740, lpOverlapped=0x0) returned 1 [0264.230] CloseHandle (hObject=0xdc) returned 1 [0264.230] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.232] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xc68 [0264.232] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc70) returned 0x2450048 [0264.232] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xc68, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xc68, lpOverlapped=0x0) returned 1 [0264.233] CloseHandle (hObject=0xdc) returned 1 [0264.233] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf")) returned 1 [0264.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.234] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.234] GetTickCount () returned 0x515a2 [0264.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.235] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333218\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333218\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333218\\....\\temporaryfile")) returned 0 [0264.235] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333218\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333218\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333218\\temporaryfile")) returned 1 [0264.237] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333218\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26dba80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26dba80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26dba80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.237] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26dba80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26dba80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26dba80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.237] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26dba80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26dba80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26dba80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.237] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333218\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26dba80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26dba80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26dba80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.238] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26dba80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26dba80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26dba80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.238] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26dba80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26dba80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26dba80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.238] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333218\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333218\\temporaryfile")) returned 1 [0264.238] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa26dba80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa26dba80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa26dba80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.238] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333218" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333218")) returned 1 [0264.238] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF") returned 0 [0264.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.239] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xc70, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xc70, lpOverlapped=0x0) returned 1 [0264.240] CloseHandle (hObject=0xdc) returned 1 [0264.240] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.241] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf8c [0264.241] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf94) returned 0x2450048 [0264.241] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xf8c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xf8c, lpOverlapped=0x0) returned 1 [0264.242] CloseHandle (hObject=0xdc) returned 1 [0264.242] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf")) returned 1 [0264.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.243] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.243] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.243] GetTickCount () returned 0x515b1 [0264.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.244] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333233\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333233\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333233\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333233\\....\\temporaryfile")) returned 0 [0264.245] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333233\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333233\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333233\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333233\\temporaryfile")) returned 1 [0264.246] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333233\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2701be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2701be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2701be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.247] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2701be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2701be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2701be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.247] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2701be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2701be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2701be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.247] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333233\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2701be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2701be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2701be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.247] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2701be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2701be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2701be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.247] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2701be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2701be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2701be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.247] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.247] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333233\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333233\\temporaryfile")) returned 1 [0264.247] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2701be0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2701be0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2701be0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.247] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.247] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333233" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333233")) returned 1 [0264.247] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF") returned 0 [0264.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.248] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xf90, lpOverlapped=0x0) returned 1 [0264.249] CloseHandle (hObject=0xdc) returned 1 [0264.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.250] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf74 [0264.250] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf7c) returned 0x2450048 [0264.250] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xf74, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xf74, lpOverlapped=0x0) returned 1 [0264.252] CloseHandle (hObject=0xdc) returned 1 [0264.252] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf")) returned 1 [0264.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.253] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.253] GetTickCount () returned 0x515c1 [0264.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.253] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.253] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249\\....\\temporaryfile")) returned 0 [0264.254] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249\\temporaryfile")) returned 1 [0264.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.255] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.255] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.255] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.255] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.256] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.256] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.256] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249\\temporaryfile")) returned 1 [0264.256] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.256] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.256] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249")) returned 1 [0264.256] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF") returned 0 [0264.256] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.257] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xf78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xf78, lpOverlapped=0x0) returned 1 [0264.258] CloseHandle (hObject=0xdc) returned 1 [0264.258] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.259] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x15bc [0264.259] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15c4) returned 0x2c4a70 [0264.259] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x15bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x15bc, lpOverlapped=0x0) returned 1 [0264.260] CloseHandle (hObject=0xdc) returned 1 [0264.260] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf")) returned 1 [0264.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.261] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.261] GetTickCount () returned 0x515c1 [0264.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.261] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.263] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.263] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249\\....\\temporaryfile")) returned 0 [0264.264] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249\\temporaryfile")) returned 1 [0264.266] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.266] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.266] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.266] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.266] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.266] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249\\temporaryfile")) returned 1 [0264.266] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2727d40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2727d40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2727d40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.266] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.267] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333249" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333249")) returned 1 [0264.267] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF") returned 0 [0264.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.268] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x15c0, lpOverlapped=0x0) returned 1 [0264.270] CloseHandle (hObject=0xdc) returned 1 [0264.270] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.270] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1da8 [0264.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1db0) returned 0x2e8700 [0264.271] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x1da8, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x1da8, lpOverlapped=0x0) returned 1 [0264.274] CloseHandle (hObject=0xdc) returned 1 [0264.274] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf")) returned 1 [0264.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.275] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.275] GetTickCount () returned 0x515d0 [0264.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.275] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.275] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333264\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333264\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333264\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333264\\....\\temporaryfile")) returned 0 [0264.276] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333264\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333264\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333264\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333264\\temporaryfile")) returned 1 [0264.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333264\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa274dea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa274dea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa274dea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa274dea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa274dea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa274dea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa274dea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa274dea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa274dea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.282] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333264\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa274dea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa274dea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa274dea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa274dea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa274dea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa274dea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.282] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa274dea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa274dea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa274dea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.282] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.282] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333264\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333264\\temporaryfile")) returned 1 [0264.282] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa274dea0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa274dea0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa274dea0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.283] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.283] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333264" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333264")) returned 1 [0264.283] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF") returned 0 [0264.283] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.284] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea4c0*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea4c0*, lpNumberOfBytesWritten=0x18fdd8*=0x1db0, lpOverlapped=0x0) returned 1 [0264.285] CloseHandle (hObject=0xdc) returned 1 [0264.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.286] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7dc [0264.286] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7e4) returned 0x2450048 [0264.286] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x7dc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x7dc, lpOverlapped=0x0) returned 1 [0264.288] CloseHandle (hObject=0xdc) returned 1 [0264.288] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf")) returned 1 [0264.288] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.289] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.289] GetTickCount () returned 0x515e0 [0264.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.289] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.289] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280\\....\\temporaryfile")) returned 0 [0264.290] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280\\temporaryfile")) returned 1 [0264.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2774000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2774000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2774000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.291] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2774000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2774000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2774000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.291] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2774000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2774000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2774000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.291] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2774000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2774000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2774000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.291] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2774000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2774000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2774000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.291] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2774000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2774000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2774000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.291] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.291] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280\\temporaryfile")) returned 1 [0264.292] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2774000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2774000, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2774000, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.292] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.292] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280")) returned 1 [0264.292] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF") returned 0 [0264.292] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.293] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x7e0, lpOverlapped=0x0) returned 1 [0264.294] CloseHandle (hObject=0xdc) returned 1 [0264.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.294] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xf72 [0264.294] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf7a) returned 0x2450048 [0264.295] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xf72, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xf72, lpOverlapped=0x0) returned 1 [0264.296] CloseHandle (hObject=0xdc) returned 1 [0264.296] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf")) returned 1 [0264.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.297] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.297] GetTickCount () returned 0x515e0 [0264.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.297] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.298] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.298] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280\\....\\temporaryfile")) returned 0 [0264.299] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280\\temporaryfile")) returned 1 [0264.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2774000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2774000, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.301] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.301] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.301] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.301] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.301] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280\\temporaryfile")) returned 1 [0264.302] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.302] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.302] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333280" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333280")) returned 1 [0264.302] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF") returned 0 [0264.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.303] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xf78, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xf78, lpOverlapped=0x0) returned 1 [0264.304] CloseHandle (hObject=0xdc) returned 1 [0264.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.306] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9d2 [0264.306] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9da) returned 0x2450048 [0264.306] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x9d2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x9d2, lpOverlapped=0x0) returned 1 [0264.308] CloseHandle (hObject=0xdc) returned 1 [0264.308] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf")) returned 1 [0264.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.309] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.309] GetTickCount () returned 0x515f0 [0264.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.309] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.310] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.310] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333296\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333296\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333296\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333296\\....\\temporaryfile")) returned 0 [0264.310] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333296\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333296\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333296\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333296\\temporaryfile")) returned 1 [0264.312] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333296\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.312] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.312] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.312] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333296\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.312] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.312] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.312] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.312] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333296\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333296\\temporaryfile")) returned 1 [0264.312] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa279a160, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa279a160, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa279a160, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.312] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.312] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333296" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333296")) returned 1 [0264.313] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF") returned 0 [0264.313] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.316] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x9d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x9d8, lpOverlapped=0x0) returned 1 [0264.316] CloseHandle (hObject=0xdc) returned 1 [0264.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.317] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x236 [0264.317] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x23e) returned 0x28f1f8 [0264.317] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x236, lpOverlapped=0x0) returned 1 [0264.318] CloseHandle (hObject=0xdc) returned 1 [0264.318] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf")) returned 1 [0264.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.319] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.319] GetTickCount () returned 0x515ff [0264.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.319] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.320] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.320] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311\\....\\temporaryfile")) returned 0 [0264.320] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311\\temporaryfile")) returned 1 [0264.322] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.322] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.322] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.322] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.322] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.322] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.322] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.322] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311\\temporaryfile")) returned 1 [0264.322] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.322] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.322] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311")) returned 1 [0264.323] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF") returned 0 [0264.323] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.323] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x240, lpOverlapped=0x0) returned 1 [0264.325] CloseHandle (hObject=0xdc) returned 1 [0264.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.325] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x66a [0264.325] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x672) returned 0x259e70 [0264.325] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x66a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x66a, lpOverlapped=0x0) returned 1 [0264.327] CloseHandle (hObject=0xdc) returned 1 [0264.327] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf")) returned 1 [0264.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.328] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.328] GetTickCount () returned 0x515ff [0264.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.328] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311\\....\\temporaryfile")) returned 0 [0264.329] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311\\temporaryfile")) returned 1 [0264.331] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.331] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.331] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.331] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.331] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.331] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.331] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.331] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311\\temporaryfile")) returned 1 [0264.331] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27c02c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27c02c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27c02c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.331] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.331] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333311" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333311")) returned 1 [0264.332] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF") returned 0 [0264.332] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.332] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x670, lpOverlapped=0x0) returned 1 [0264.333] CloseHandle (hObject=0xdc) returned 1 [0264.333] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.335] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4e02 [0264.335] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4e0a) returned 0x2e8700 [0264.335] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x4e02, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x4e02, lpOverlapped=0x0) returned 1 [0264.339] CloseHandle (hObject=0xdc) returned 1 [0264.339] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf")) returned 1 [0264.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.340] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.340] GetTickCount () returned 0x5160f [0264.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.340] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333327\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333327\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.341] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333327\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333327\\....\\temporaryfile")) returned 0 [0264.341] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333327\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333327\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333327\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333327\\temporaryfile")) returned 1 [0264.342] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333327\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27e6420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27e6420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27e6420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.343] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27e6420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27e6420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27e6420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.343] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27e6420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27e6420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27e6420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333327\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27e6420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27e6420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27e6420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.343] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27e6420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27e6420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27e6420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.343] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27e6420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27e6420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27e6420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.343] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.343] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333327\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333327\\temporaryfile")) returned 1 [0264.343] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa27e6420, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa27e6420, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa27e6420, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.343] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.343] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333327" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333327")) returned 1 [0264.344] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF") returned 0 [0264.344] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.345] WriteFile (in: hFile=0xdc, lpBuffer=0x2ed520*, nNumberOfBytesToWrite=0x4e08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ed520*, lpNumberOfBytesWritten=0x18fdd8*=0x4e08, lpOverlapped=0x0) returned 1 [0264.346] CloseHandle (hObject=0xdc) returned 1 [0264.346] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.347] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x276a [0264.347] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2772) returned 0x2e8700 [0264.347] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x276a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x276a, lpOverlapped=0x0) returned 1 [0264.349] CloseHandle (hObject=0xdc) returned 1 [0264.349] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf")) returned 1 [0264.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.350] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.350] GetTickCount () returned 0x5161e [0264.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.350] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.350] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.350] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342\\....\\temporaryfile")) returned 0 [0264.351] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342\\temporaryfile")) returned 1 [0264.352] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.352] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.352] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.352] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.352] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.352] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.352] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.352] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342\\temporaryfile")) returned 1 [0264.353] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.353] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.353] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342")) returned 1 [0264.353] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF") returned 0 [0264.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.354] WriteFile (in: hFile=0xdc, lpBuffer=0x2eae88*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eae88*, lpNumberOfBytesWritten=0x18fdd8*=0x2770, lpOverlapped=0x0) returned 1 [0264.355] CloseHandle (hObject=0xdc) returned 1 [0264.355] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.356] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x228c [0264.356] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2294) returned 0x2e8700 [0264.356] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x228c, lpOverlapped=0x0) returned 1 [0264.357] CloseHandle (hObject=0xdc) returned 1 [0264.357] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf")) returned 1 [0264.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.358] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.358] GetTickCount () returned 0x5161e [0264.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.358] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.359] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.359] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342\\....\\temporaryfile")) returned 0 [0264.359] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342\\temporaryfile")) returned 1 [0264.361] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.361] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.361] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.361] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.361] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.361] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.361] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.361] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342\\temporaryfile")) returned 1 [0264.362] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa280c580, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa280c580, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa280c580, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.362] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.362] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333342" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333342")) returned 1 [0264.362] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF") returned 0 [0264.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.363] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea9a8*, nNumberOfBytesToWrite=0x2290, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea9a8*, lpNumberOfBytesWritten=0x18fdd8*=0x2290, lpOverlapped=0x0) returned 1 [0264.364] CloseHandle (hObject=0xdc) returned 1 [0264.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.365] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x9fc [0264.365] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa04) returned 0x2450048 [0264.365] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x9fc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x9fc, lpOverlapped=0x0) returned 1 [0264.366] CloseHandle (hObject=0xdc) returned 1 [0264.366] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf")) returned 1 [0264.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.367] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.367] GetTickCount () returned 0x5162e [0264.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.367] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.368] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.368] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333358\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333358\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333358\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333358\\....\\temporaryfile")) returned 0 [0264.368] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333358\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333358\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333358\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333358\\temporaryfile")) returned 1 [0264.370] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333358\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28326e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28326e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28326e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.370] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28326e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28326e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28326e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.370] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28326e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28326e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28326e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.370] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333358\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28326e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28326e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28326e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.370] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28326e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28326e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28326e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.370] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28326e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28326e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28326e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.370] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.370] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333358\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333358\\temporaryfile")) returned 1 [0264.370] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28326e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28326e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28326e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.370] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.370] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333358" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333358")) returned 1 [0264.371] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF") returned 0 [0264.371] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.371] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa00, lpOverlapped=0x0) returned 1 [0264.372] CloseHandle (hObject=0xdc) returned 1 [0264.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.375] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x25bc [0264.375] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25c4) returned 0x2e8700 [0264.375] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x25bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x25bc, lpOverlapped=0x0) returned 1 [0264.376] CloseHandle (hObject=0xdc) returned 1 [0264.376] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf")) returned 1 [0264.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.377] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.377] GetTickCount () returned 0x5163e [0264.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.377] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.378] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.378] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374\\....\\temporaryfile")) returned 0 [0264.378] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374\\temporaryfile")) returned 1 [0264.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.380] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.380] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.380] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.380] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.380] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374\\temporaryfile")) returned 1 [0264.381] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.381] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.381] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374")) returned 1 [0264.381] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF") returned 0 [0264.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.382] WriteFile (in: hFile=0xdc, lpBuffer=0x2eacd8*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eacd8*, lpNumberOfBytesWritten=0x18fdd8*=0x25c0, lpOverlapped=0x0) returned 1 [0264.383] CloseHandle (hObject=0xdc) returned 1 [0264.383] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.384] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1234 [0264.384] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x123c) returned 0x25b528 [0264.384] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1234, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1234, lpOverlapped=0x0) returned 1 [0264.385] CloseHandle (hObject=0xdc) returned 1 [0264.385] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf")) returned 1 [0264.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.386] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.386] GetTickCount () returned 0x5163e [0264.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.386] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.387] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.387] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.387] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374\\....\\temporaryfile")) returned 0 [0264.387] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374\\temporaryfile")) returned 1 [0264.389] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.389] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.389] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.389] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.389] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.389] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374\\temporaryfile")) returned 1 [0264.389] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2858840, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2858840, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2858840, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.389] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.390] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333374" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333374")) returned 1 [0264.390] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF") returned 0 [0264.390] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.391] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1238, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1238, lpOverlapped=0x0) returned 1 [0264.392] CloseHandle (hObject=0xdc) returned 1 [0264.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.393] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x235c [0264.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2364) returned 0x2e8700 [0264.393] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x235c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x235c, lpOverlapped=0x0) returned 1 [0264.394] CloseHandle (hObject=0xdc) returned 1 [0264.394] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf")) returned 1 [0264.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.395] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.395] GetTickCount () returned 0x5164d [0264.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.395] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.396] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.396] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389\\....\\temporaryfile")) returned 0 [0264.396] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389\\temporaryfile")) returned 1 [0264.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.398] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.398] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.398] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.398] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.398] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389\\temporaryfile")) returned 1 [0264.398] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.398] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.398] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389")) returned 1 [0264.399] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF") returned 0 [0264.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.400] WriteFile (in: hFile=0xdc, lpBuffer=0x2eaa78*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2eaa78*, lpNumberOfBytesWritten=0x18fdd8*=0x2360, lpOverlapped=0x0) returned 1 [0264.401] CloseHandle (hObject=0xdc) returned 1 [0264.401] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.402] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2142 [0264.402] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x214a) returned 0x2e8700 [0264.402] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2142, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2142, lpOverlapped=0x0) returned 1 [0264.404] CloseHandle (hObject=0xdc) returned 1 [0264.404] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf")) returned 1 [0264.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.405] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.405] GetTickCount () returned 0x5164d [0264.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.405] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.406] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389\\....\\temporaryfile")) returned 0 [0264.406] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389\\temporaryfile")) returned 1 [0264.408] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.408] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.408] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.408] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.408] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.408] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.408] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.408] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389\\temporaryfile")) returned 1 [0264.409] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa287e9a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa287e9a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa287e9a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.409] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.409] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333389" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333389")) returned 1 [0264.409] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF") returned 0 [0264.409] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.410] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea860*, nNumberOfBytesToWrite=0x2148, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea860*, lpNumberOfBytesWritten=0x18fdd8*=0x2148, lpOverlapped=0x0) returned 1 [0264.411] CloseHandle (hObject=0xdc) returned 1 [0264.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.412] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x6cc0 [0264.412] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6cc8) returned 0x2e8700 [0264.412] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x6cc0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x6cc0, lpOverlapped=0x0) returned 1 [0264.414] CloseHandle (hObject=0xdc) returned 1 [0264.414] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf")) returned 1 [0264.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.415] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.415] GetTickCount () returned 0x5165d [0264.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.415] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.415] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333405\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333405\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333405\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333405\\....\\temporaryfile")) returned 0 [0264.416] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333405\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333405\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333405\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333405\\temporaryfile")) returned 1 [0264.417] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333405\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28a4b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28a4b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28a4b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.417] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28a4b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28a4b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28a4b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.417] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28a4b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28a4b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28a4b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.417] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333405\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28a4b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28a4b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28a4b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.418] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28a4b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28a4b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28a4b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.418] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28a4b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28a4b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28a4b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.418] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.418] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333405\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333405\\temporaryfile")) returned 1 [0264.418] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28a4b00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28a4b00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28a4b00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.418] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.418] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333405" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333405")) returned 1 [0264.418] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF") returned 0 [0264.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.425] WriteFile (in: hFile=0xdc, lpBuffer=0x2ef3d8*, nNumberOfBytesToWrite=0x6cc8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ef3d8*, lpNumberOfBytesWritten=0x18fdd8*=0x6cc8, lpOverlapped=0x0) returned 1 [0264.426] CloseHandle (hObject=0xdc) returned 1 [0264.426] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.427] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x7c4a [0264.427] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x7c52) returned 0x2e8700 [0264.427] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x7c4a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x7c4a, lpOverlapped=0x0) returned 1 [0264.428] CloseHandle (hObject=0xdc) returned 1 [0264.428] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf")) returned 1 [0264.429] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.429] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.430] GetTickCount () returned 0x5166c [0264.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.430] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.430] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333420\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333420\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333420\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333420\\....\\temporaryfile")) returned 0 [0264.431] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333420\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333420\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333420\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333420\\temporaryfile")) returned 1 [0264.432] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333420\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28cac60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28cac60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28cac60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.432] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28cac60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28cac60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28cac60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.432] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28cac60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28cac60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28cac60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.432] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333420\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28cac60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28cac60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28cac60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.432] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28cac60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28cac60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28cac60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.432] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28cac60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28cac60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28cac60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.432] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.432] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333420\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333420\\temporaryfile")) returned 1 [0264.433] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28cac60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28cac60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28cac60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.433] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.433] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333420" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333420")) returned 1 [0264.433] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF") returned 0 [0264.434] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.434] WriteFile (in: hFile=0xdc, lpBuffer=0x2f0368*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2f0368*, lpNumberOfBytesWritten=0x18fdd8*=0x7c50, lpOverlapped=0x0) returned 1 [0264.435] CloseHandle (hObject=0xdc) returned 1 [0264.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.437] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x8e0 [0264.437] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8e8) returned 0x2450048 [0264.437] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x8e0, lpOverlapped=0x0) returned 1 [0264.438] CloseHandle (hObject=0xdc) returned 1 [0264.438] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf")) returned 1 [0264.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.439] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.439] GetTickCount () returned 0x5167c [0264.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.439] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.440] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.440] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436\\....\\temporaryfile")) returned 0 [0264.440] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436\\temporaryfile")) returned 1 [0264.442] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.442] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.442] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.442] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.442] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.442] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.442] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.442] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436\\temporaryfile")) returned 1 [0264.442] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.442] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.442] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436")) returned 1 [0264.442] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF") returned 0 [0264.443] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.443] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x8e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x8e8, lpOverlapped=0x0) returned 1 [0264.444] CloseHandle (hObject=0xdc) returned 1 [0264.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.445] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2054 [0264.445] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x205c) returned 0x2e8700 [0264.445] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2054, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2054, lpOverlapped=0x0) returned 1 [0264.446] CloseHandle (hObject=0xdc) returned 1 [0264.447] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf")) returned 1 [0264.447] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.448] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.448] GetTickCount () returned 0x5167c [0264.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.448] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436\\....\\temporaryfile")) returned 0 [0264.449] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436\\temporaryfile")) returned 1 [0264.450] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.450] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.450] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.450] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.451] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.451] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.451] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.451] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436\\temporaryfile")) returned 1 [0264.451] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa28f0dc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa28f0dc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa28f0dc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.451] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.451] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333436" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333436")) returned 1 [0264.451] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF") returned 0 [0264.452] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.452] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea770*, nNumberOfBytesToWrite=0x2058, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea770*, lpNumberOfBytesWritten=0x18fdd8*=0x2058, lpOverlapped=0x0) returned 1 [0264.453] CloseHandle (hObject=0xdc) returned 1 [0264.453] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.454] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1800 [0264.454] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1808) returned 0x2c4a70 [0264.454] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1800, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1800, lpOverlapped=0x0) returned 1 [0264.455] CloseHandle (hObject=0xdc) returned 1 [0264.455] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf")) returned 1 [0264.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.456] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.456] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.456] GetTickCount () returned 0x5168c [0264.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.457] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.457] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452\\....\\temporaryfile")) returned 0 [0264.458] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452\\temporaryfile")) returned 1 [0264.459] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.459] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.459] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.459] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.459] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.459] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.459] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.459] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452\\temporaryfile")) returned 1 [0264.459] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.460] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.460] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452")) returned 1 [0264.460] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF") returned 0 [0264.460] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.461] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1808, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1808, lpOverlapped=0x0) returned 1 [0264.462] CloseHandle (hObject=0xdc) returned 1 [0264.462] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.463] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x342e [0264.463] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3436) returned 0x2e8700 [0264.463] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x342e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x342e, lpOverlapped=0x0) returned 1 [0264.465] CloseHandle (hObject=0xdc) returned 1 [0264.465] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0264.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.466] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.466] GetTickCount () returned 0x5168c [0264.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.466] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.466] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452\\....\\temporaryfile")) returned 0 [0264.467] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452\\temporaryfile")) returned 1 [0264.469] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.469] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.469] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.469] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.469] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.469] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.469] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.469] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452\\temporaryfile")) returned 1 [0264.469] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2916f20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2916f20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2916f20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.469] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.469] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333452" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333452")) returned 1 [0264.469] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 0 [0264.470] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.471] WriteFile (in: hFile=0xdc, lpBuffer=0x2ebb48*, nNumberOfBytesToWrite=0x3438, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ebb48*, lpNumberOfBytesWritten=0x18fdd8*=0x3438, lpOverlapped=0x0) returned 1 [0264.472] CloseHandle (hObject=0xdc) returned 1 [0264.472] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.473] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1361 [0264.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1369) returned 0x25b528 [0264.473] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1361, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x1361, lpOverlapped=0x0) returned 1 [0264.475] CloseHandle (hObject=0xdc) returned 1 [0264.475] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0264.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.476] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.476] GetTickCount () returned 0x5169b [0264.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.476] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.476] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.477] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467\\....\\temporaryfile")) returned 0 [0264.477] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467\\temporaryfile")) returned 1 [0264.478] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa293d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa293d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa293d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.478] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa293d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa293d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa293d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.478] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa293d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa293d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa293d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.478] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa293d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa293d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa293d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.478] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa293d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa293d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa293d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.478] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa293d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa293d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa293d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.478] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.479] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467\\temporaryfile")) returned 1 [0264.479] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa293d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa293d080, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa293d080, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.479] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.479] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467")) returned 1 [0264.479] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 0 [0264.479] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.480] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1368, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1368, lpOverlapped=0x0) returned 1 [0264.481] CloseHandle (hObject=0xdc) returned 1 [0264.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.482] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2e4 [0264.482] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ec) returned 0x259e70 [0264.482] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2e4, lpOverlapped=0x0) returned 1 [0264.484] CloseHandle (hObject=0xdc) returned 1 [0264.484] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 1 [0264.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.485] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.485] GetTickCount () returned 0x5169b [0264.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.485] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.485] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467\\....\\temporaryfile")) returned 0 [0264.486] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467\\temporaryfile")) returned 1 [0264.487] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa293d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.488] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa293d080, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.488] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.488] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.488] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.488] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.488] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.488] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467\\temporaryfile")) returned 1 [0264.488] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.488] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.488] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333467" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333467")) returned 1 [0264.488] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF") returned 0 [0264.489] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.489] WriteFile (in: hFile=0xdc, lpBuffer=0x25a170*, nNumberOfBytesToWrite=0x2e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a170*, lpNumberOfBytesWritten=0x18fdd8*=0x2e8, lpOverlapped=0x0) returned 1 [0264.490] CloseHandle (hObject=0xdc) returned 1 [0264.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.491] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x16b [0264.491] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x173) returned 0x28f1f8 [0264.491] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x16b, lpOverlapped=0x0) returned 1 [0264.492] CloseHandle (hObject=0xdc) returned 1 [0264.492] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 1 [0264.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.493] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.493] GetTickCount () returned 0x516ab [0264.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.493] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.493] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483\\....\\temporaryfile")) returned 0 [0264.494] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483\\temporaryfile")) returned 1 [0264.495] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.496] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.496] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.496] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.496] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.496] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.496] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.496] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483\\temporaryfile")) returned 1 [0264.496] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29631e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29631e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29631e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.496] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.496] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483")) returned 1 [0264.496] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF") returned 0 [0264.497] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.497] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x170, lpOverlapped=0x0) returned 1 [0264.498] CloseHandle (hObject=0xdc) returned 1 [0264.498] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.499] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x167 [0264.499] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x16f) returned 0x28f1f8 [0264.499] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x167, lpOverlapped=0x0) returned 1 [0264.500] CloseHandle (hObject=0xdc) returned 1 [0264.500] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 1 [0264.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.501] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.501] GetTickCount () returned 0x516ab [0264.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.501] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.501] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483\\....\\temporaryfile")) returned 0 [0264.502] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483\\temporaryfile")) returned 1 [0264.503] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.503] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.503] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.503] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.503] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.503] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.503] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.503] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483\\temporaryfile")) returned 1 [0264.504] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.504] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.504] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333483" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333483")) returned 1 [0264.504] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF") returned 0 [0264.504] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.505] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x170, lpOverlapped=0x0) returned 1 [0264.506] CloseHandle (hObject=0xdc) returned 1 [0264.506] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.506] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x19a [0264.506] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1a2) returned 0x28f1f8 [0264.507] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x19a, lpOverlapped=0x0) returned 1 [0264.507] CloseHandle (hObject=0xdc) returned 1 [0264.507] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif")) returned 1 [0264.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.508] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.508] GetTickCount () returned 0x516ba [0264.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.508] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.509] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.509] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333498\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333498\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333498\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333498\\....\\temporaryfile")) returned 0 [0264.510] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333498\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333498\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333498\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333498\\temporaryfile")) returned 1 [0264.511] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333498\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.511] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.511] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.511] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333498\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.511] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.511] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.511] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.511] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333498\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333498\\temporaryfile")) returned 1 [0264.512] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2989340, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2989340, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2989340, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.512] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.512] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333498" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333498")) returned 1 [0264.512] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF") returned 0 [0264.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.522] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x1a0, lpOverlapped=0x0) returned 1 [0264.523] CloseHandle (hObject=0xdc) returned 1 [0264.523] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.524] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x14d [0264.524] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x155) returned 0x28f1f8 [0264.524] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x14d, lpOverlapped=0x0) returned 1 [0264.525] CloseHandle (hObject=0xdc) returned 1 [0264.525] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif")) returned 1 [0264.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.526] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.526] GetTickCount () returned 0x516ca [0264.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.526] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.526] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333514\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333514\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333514\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333514\\....\\temporaryfile")) returned 0 [0264.527] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333514\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333514\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333514\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333514\\temporaryfile")) returned 1 [0264.529] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333514\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29af4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29af4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29af4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.529] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29af4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29af4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29af4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.529] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29af4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29af4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29af4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.529] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333514\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29af4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29af4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29af4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.529] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29af4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29af4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29af4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.529] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29af4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29af4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29af4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.529] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.529] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333514\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333514\\temporaryfile")) returned 1 [0264.529] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29af4a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29af4a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29af4a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.529] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.529] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333514" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333514")) returned 1 [0264.529] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF") returned 0 [0264.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.530] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x158, lpOverlapped=0x0) returned 1 [0264.531] CloseHandle (hObject=0xdc) returned 1 [0264.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.532] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x182 [0264.532] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18a) returned 0x28f1f8 [0264.532] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x182, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x182, lpOverlapped=0x0) returned 1 [0264.533] CloseHandle (hObject=0xdc) returned 1 [0264.533] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif")) returned 1 [0264.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.534] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.534] GetTickCount () returned 0x516da [0264.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.534] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.534] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530\\....\\temporaryfile")) returned 0 [0264.535] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530\\temporaryfile")) returned 1 [0264.536] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.536] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.536] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.536] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.537] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.537] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.537] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.537] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530\\temporaryfile")) returned 1 [0264.537] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.537] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.537] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530")) returned 1 [0264.537] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF") returned 0 [0264.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.538] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x188, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x188, lpOverlapped=0x0) returned 1 [0264.539] CloseHandle (hObject=0xdc) returned 1 [0264.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.540] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x158 [0264.540] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x160) returned 0x28f1f8 [0264.540] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x158, lpOverlapped=0x0) returned 1 [0264.541] CloseHandle (hObject=0xdc) returned 1 [0264.541] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif")) returned 1 [0264.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.542] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.542] GetTickCount () returned 0x516da [0264.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.542] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530\\....\\temporaryfile")) returned 0 [0264.543] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530\\temporaryfile")) returned 1 [0264.544] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.544] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.544] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.544] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.544] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.545] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.545] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.545] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530\\temporaryfile")) returned 1 [0264.545] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29d5600, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29d5600, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29d5600, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.545] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.545] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333530" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333530")) returned 1 [0264.545] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF") returned 0 [0264.545] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.546] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x160, lpOverlapped=0x0) returned 1 [0264.547] CloseHandle (hObject=0xdc) returned 1 [0264.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.548] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1af [0264.548] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b7) returned 0x28f1f8 [0264.548] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1af, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x1af, lpOverlapped=0x0) returned 1 [0264.549] CloseHandle (hObject=0xdc) returned 1 [0264.549] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif")) returned 1 [0264.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.550] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.550] GetTickCount () returned 0x516e9 [0264.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.551] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.551] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545\\....\\temporaryfile")) returned 0 [0264.551] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545\\temporaryfile")) returned 1 [0264.553] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.553] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.553] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.553] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.553] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.553] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.553] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545\\temporaryfile")) returned 1 [0264.553] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.553] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.553] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545")) returned 1 [0264.554] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF") returned 0 [0264.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.554] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x1b8, lpOverlapped=0x0) returned 1 [0264.555] CloseHandle (hObject=0xdc) returned 1 [0264.556] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.556] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1d3 [0264.556] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1db) returned 0x28f1f8 [0264.556] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x1d3, lpOverlapped=0x0) returned 1 [0264.557] CloseHandle (hObject=0xdc) returned 1 [0264.557] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif")) returned 1 [0264.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.558] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.558] GetTickCount () returned 0x516e9 [0264.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.558] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.559] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.559] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545\\....\\temporaryfile")) returned 0 [0264.565] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545\\temporaryfile")) returned 1 [0264.566] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a218c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a218c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.566] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a218c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a218c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.566] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.566] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.566] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.566] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.566] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.566] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545\\temporaryfile")) returned 1 [0264.567] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa29fb760, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa29fb760, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa29fb760, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.567] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.567] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333545" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333545")) returned 1 [0264.567] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF") returned 0 [0264.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.568] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x1d8, lpOverlapped=0x0) returned 1 [0264.569] CloseHandle (hObject=0xdc) returned 1 [0264.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.571] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x155 [0264.571] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15d) returned 0x28f1f8 [0264.571] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x155, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x155, lpOverlapped=0x0) returned 1 [0264.572] CloseHandle (hObject=0xdc) returned 1 [0264.572] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif")) returned 1 [0264.572] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.573] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.573] GetTickCount () returned 0x516f9 [0264.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.573] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.573] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333561\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333561\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.574] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333561\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333561\\....\\temporaryfile")) returned 0 [0264.574] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333561\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333561\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333561\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333561\\temporaryfile")) returned 1 [0264.575] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333561\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a218c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a218c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a218c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.575] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a218c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a218c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a218c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.575] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a218c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a218c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a218c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.575] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333561\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a218c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a218c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a218c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.575] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a218c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a218c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a218c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.575] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a218c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a218c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a218c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.576] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.576] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333561\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333561\\temporaryfile")) returned 1 [0264.576] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a218c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a218c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a218c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.576] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.576] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333561" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333561")) returned 1 [0264.576] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF") returned 0 [0264.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.577] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x160, lpOverlapped=0x0) returned 1 [0264.578] CloseHandle (hObject=0xdc) returned 1 [0264.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.578] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ce [0264.578] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1d6) returned 0x28f1f8 [0264.579] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1ce, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x1ce, lpOverlapped=0x0) returned 1 [0264.580] CloseHandle (hObject=0xdc) returned 1 [0264.580] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif")) returned 1 [0264.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.581] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.581] GetTickCount () returned 0x51708 [0264.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.581] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.581] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576\\....\\temporaryfile")) returned 0 [0264.582] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576\\temporaryfile")) returned 1 [0264.583] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.583] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.583] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.583] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.583] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.583] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.583] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.584] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576\\temporaryfile")) returned 1 [0264.584] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.584] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.584] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576")) returned 1 [0264.584] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF") returned 0 [0264.584] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.585] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x1d8, lpOverlapped=0x0) returned 1 [0264.586] CloseHandle (hObject=0xdc) returned 1 [0264.586] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.586] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xff7 [0264.586] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xfff) returned 0x26aa38 [0264.586] ReadFile (in: hFile=0xdc, lpBuffer=0x26aa40, nNumberOfBytesToRead=0xff7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x26aa40*, lpNumberOfBytesRead=0x18fdf0*=0xff7, lpOverlapped=0x0) returned 1 [0264.588] CloseHandle (hObject=0xdc) returned 1 [0264.588] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif")) returned 1 [0264.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.589] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.589] GetTickCount () returned 0x51708 [0264.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.589] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.590] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.590] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576\\....\\temporaryfile")) returned 0 [0264.590] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576\\temporaryfile")) returned 1 [0264.592] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.592] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.592] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.592] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.592] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.592] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.592] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.592] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576\\temporaryfile")) returned 1 [0264.592] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a47a20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a47a20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a47a20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.592] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.592] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333576" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333576")) returned 1 [0264.592] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF") returned 0 [0264.593] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.593] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x1000, lpOverlapped=0x0) returned 1 [0264.594] CloseHandle (hObject=0xdc) returned 1 [0264.594] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.595] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ab [0264.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b3) returned 0x28f1f8 [0264.595] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x1ab, lpOverlapped=0x0) returned 1 [0264.596] CloseHandle (hObject=0xdc) returned 1 [0264.596] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif")) returned 1 [0264.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.597] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.597] GetTickCount () returned 0x51718 [0264.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.598] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592\\....\\temporaryfile")) returned 0 [0264.598] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592\\temporaryfile")) returned 1 [0264.599] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.599] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.600] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.600] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.600] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.600] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.600] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.600] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592\\temporaryfile")) returned 1 [0264.600] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.600] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.600] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592")) returned 1 [0264.600] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF") returned 0 [0264.601] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.601] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x1b0, lpOverlapped=0x0) returned 1 [0264.602] CloseHandle (hObject=0xdc) returned 1 [0264.602] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.603] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x255 [0264.603] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25d) returned 0x2a8a88 [0264.603] ReadFile (in: hFile=0xdc, lpBuffer=0x2a8a90, nNumberOfBytesToRead=0x255, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a8a90*, lpNumberOfBytesRead=0x18fdf0*=0x255, lpOverlapped=0x0) returned 1 [0264.604] CloseHandle (hObject=0xdc) returned 1 [0264.604] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif")) returned 1 [0264.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.605] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.605] GetTickCount () returned 0x51718 [0264.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.605] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.605] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592\\....\\temporaryfile")) returned 0 [0264.606] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592\\temporaryfile")) returned 1 [0264.607] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.607] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.608] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.608] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.608] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.608] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.608] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.608] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592\\temporaryfile")) returned 1 [0264.608] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a6db80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a6db80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a6db80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.608] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.608] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333592" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333592")) returned 1 [0264.608] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF") returned 0 [0264.609] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.609] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x260, lpOverlapped=0x0) returned 1 [0264.616] CloseHandle (hObject=0xdc) returned 1 [0264.616] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.617] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a7 [0264.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2af) returned 0x259e70 [0264.617] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2a7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2a7, lpOverlapped=0x0) returned 1 [0264.618] CloseHandle (hObject=0xdc) returned 1 [0264.618] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif")) returned 1 [0264.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.619] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.619] GetTickCount () returned 0x51728 [0264.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.619] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.620] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.620] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333608\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333608\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333608\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333608\\....\\temporaryfile")) returned 0 [0264.620] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333608\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333608\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333608\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333608\\temporaryfile")) returned 1 [0264.621] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333608\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a93ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a93ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a93ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.621] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a93ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a93ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a93ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.622] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a93ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a93ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a93ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.622] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333608\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a93ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a93ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a93ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.622] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a93ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a93ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a93ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.622] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a93ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a93ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a93ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.622] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333608\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333608\\temporaryfile")) returned 1 [0264.622] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2a93ce0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2a93ce0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2a93ce0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.622] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.622] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333608" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333608")) returned 1 [0264.622] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF") returned 0 [0264.623] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.623] WriteFile (in: hFile=0xdc, lpBuffer=0x25a130*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a130*, lpNumberOfBytesWritten=0x18fdd8*=0x2b0, lpOverlapped=0x0) returned 1 [0264.624] CloseHandle (hObject=0xdc) returned 1 [0264.624] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.625] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2ad [0264.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b5) returned 0x259e70 [0264.625] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2ad, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2ad, lpOverlapped=0x0) returned 1 [0264.626] CloseHandle (hObject=0xdc) returned 1 [0264.626] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif")) returned 1 [0264.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.627] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.627] GetTickCount () returned 0x51737 [0264.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.627] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.628] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.628] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623\\....\\temporaryfile")) returned 0 [0264.628] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623\\temporaryfile")) returned 1 [0264.629] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.630] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.630] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.630] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.630] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.630] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.630] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.630] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623\\temporaryfile")) returned 1 [0264.630] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.630] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.630] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623")) returned 1 [0264.630] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF") returned 0 [0264.631] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.631] WriteFile (in: hFile=0xdc, lpBuffer=0x25a138*, nNumberOfBytesToWrite=0x2b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a138*, lpNumberOfBytesWritten=0x18fdd8*=0x2b8, lpOverlapped=0x0) returned 1 [0264.632] CloseHandle (hObject=0xdc) returned 1 [0264.632] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.633] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x161 [0264.633] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x169) returned 0x28f1f8 [0264.633] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x161, lpOverlapped=0x0) returned 1 [0264.634] CloseHandle (hObject=0xdc) returned 1 [0264.634] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif")) returned 1 [0264.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.635] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.635] GetTickCount () returned 0x51737 [0264.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.635] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623\\....\\temporaryfile")) returned 0 [0264.636] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623\\temporaryfile")) returned 1 [0264.638] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.638] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.638] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.638] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.638] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.638] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.638] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.638] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623\\temporaryfile")) returned 1 [0264.638] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ab9e40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ab9e40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ab9e40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.638] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.638] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333623" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333623")) returned 1 [0264.638] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF") returned 0 [0264.639] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.639] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x168, lpOverlapped=0x0) returned 1 [0264.640] CloseHandle (hObject=0xdc) returned 1 [0264.640] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.641] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1ef [0264.641] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f7) returned 0x28f1f8 [0264.641] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x1ef, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x1ef, lpOverlapped=0x0) returned 1 [0264.642] CloseHandle (hObject=0xdc) returned 1 [0264.642] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif")) returned 1 [0264.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.643] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.643] GetTickCount () returned 0x51747 [0264.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.643] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.644] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.644] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639\\....\\temporaryfile")) returned 0 [0264.644] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639\\temporaryfile")) returned 1 [0264.645] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.646] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.646] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.646] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.646] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.646] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.646] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.646] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639\\temporaryfile")) returned 1 [0264.646] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.646] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.646] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639")) returned 1 [0264.646] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF") returned 0 [0264.647] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.647] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x1f8, lpOverlapped=0x0) returned 1 [0264.648] CloseHandle (hObject=0xdc) returned 1 [0264.648] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.649] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x37e [0264.649] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x386) returned 0x259e70 [0264.649] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x37e, lpOverlapped=0x0) returned 1 [0264.650] CloseHandle (hObject=0xdc) returned 1 [0264.650] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif")) returned 1 [0264.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.651] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.651] GetTickCount () returned 0x51747 [0264.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.651] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.652] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.652] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.653] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639\\....\\temporaryfile")) returned 0 [0264.653] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639\\temporaryfile")) returned 1 [0264.654] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.654] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.654] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.654] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.654] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.654] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.654] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.654] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639\\temporaryfile")) returned 1 [0264.655] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2adffa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2adffa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2adffa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.655] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.655] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333639" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333639")) returned 1 [0264.655] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF") returned 0 [0264.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.656] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x388, lpOverlapped=0x0) returned 1 [0264.657] CloseHandle (hObject=0xdc) returned 1 [0264.657] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.658] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2bc [0264.658] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2c4) returned 0x259e70 [0264.658] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2bc, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2bc, lpOverlapped=0x0) returned 1 [0264.659] CloseHandle (hObject=0xdc) returned 1 [0264.659] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif")) returned 1 [0264.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.660] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.660] GetTickCount () returned 0x51756 [0264.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.660] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.661] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.661] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.661] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654\\....\\temporaryfile")) returned 0 [0264.661] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654\\temporaryfile")) returned 1 [0264.662] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.663] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.663] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.663] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.663] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.663] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.663] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.663] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654\\temporaryfile")) returned 1 [0264.663] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.663] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.663] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654")) returned 1 [0264.663] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF") returned 0 [0264.664] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.664] WriteFile (in: hFile=0xdc, lpBuffer=0x25a148*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a148*, lpNumberOfBytesWritten=0x18fdd8*=0x2c0, lpOverlapped=0x0) returned 1 [0264.665] CloseHandle (hObject=0xdc) returned 1 [0264.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.666] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x13e [0264.666] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x146) returned 0x28f1f8 [0264.666] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x13e, lpOverlapped=0x0) returned 1 [0264.667] CloseHandle (hObject=0xdc) returned 1 [0264.667] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif")) returned 1 [0264.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.668] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.668] GetTickCount () returned 0x51756 [0264.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.668] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.668] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654\\....\\temporaryfile")) returned 0 [0264.669] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654\\temporaryfile")) returned 1 [0264.670] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.671] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.671] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.671] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.671] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.671] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.671] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.671] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654\\temporaryfile")) returned 1 [0264.671] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b06100, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b06100, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b06100, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.671] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.671] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333654" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333654")) returned 1 [0264.671] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF") returned 0 [0264.672] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.672] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x148, lpOverlapped=0x0) returned 1 [0264.673] CloseHandle (hObject=0xdc) returned 1 [0264.673] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.674] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x250 [0264.674] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x258) returned 0x28f1f8 [0264.674] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x250, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x250, lpOverlapped=0x0) returned 1 [0264.675] CloseHandle (hObject=0xdc) returned 1 [0264.675] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif")) returned 1 [0264.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.676] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.676] GetTickCount () returned 0x51766 [0264.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.676] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.676] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670\\....\\temporaryfile")) returned 0 [0264.677] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670\\temporaryfile")) returned 1 [0264.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.678] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.678] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.679] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.679] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.679] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670\\temporaryfile")) returned 1 [0264.679] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.679] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.679] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670")) returned 1 [0264.679] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF") returned 0 [0264.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.680] WriteFile (in: hFile=0xdc, lpBuffer=0x2a8a90*, nNumberOfBytesToWrite=0x258, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a8a90*, lpNumberOfBytesWritten=0x18fdd8*=0x258, lpOverlapped=0x0) returned 1 [0264.681] CloseHandle (hObject=0xdc) returned 1 [0264.681] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.682] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2a9 [0264.682] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2b1) returned 0x259e70 [0264.682] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2a9, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2a9, lpOverlapped=0x0) returned 1 [0264.683] CloseHandle (hObject=0xdc) returned 1 [0264.683] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif")) returned 1 [0264.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.684] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.684] GetTickCount () returned 0x51766 [0264.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.684] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.684] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670\\....\\temporaryfile")) returned 0 [0264.685] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670\\temporaryfile")) returned 1 [0264.686] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.686] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.687] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.687] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.687] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.687] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.687] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670\\temporaryfile")) returned 1 [0264.687] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b2c260, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b2c260, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b2c260, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.687] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.687] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333670" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333670")) returned 1 [0264.687] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 0 [0264.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.688] WriteFile (in: hFile=0xdc, lpBuffer=0x25a138*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a138*, lpNumberOfBytesWritten=0x18fdd8*=0x2b0, lpOverlapped=0x0) returned 1 [0264.689] CloseHandle (hObject=0xdc) returned 1 [0264.689] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.690] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2076 [0264.690] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x207e) returned 0x2e8700 [0264.690] ReadFile (in: hFile=0xdc, lpBuffer=0x2e8708, nNumberOfBytesToRead=0x2076, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesRead=0x18fdf0*=0x2076, lpOverlapped=0x0) returned 1 [0264.691] CloseHandle (hObject=0xdc) returned 1 [0264.692] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif")) returned 1 [0264.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.693] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.693] GetTickCount () returned 0x51776 [0264.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.693] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.695] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.695] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686\\....\\temporaryfile")) returned 0 [0264.695] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686\\temporaryfile")) returned 1 [0264.697] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b523c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b523c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b523c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b523c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b523c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b523c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b523c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b523c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b523c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.697] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b523c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b523c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b523c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.697] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b523c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b523c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b523c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.697] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b523c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b523c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b523c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.697] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686\\temporaryfile")) returned 1 [0264.697] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b523c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b523c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b523c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.697] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.697] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686")) returned 1 [0264.698] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 0 [0264.698] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.699] WriteFile (in: hFile=0xdc, lpBuffer=0x2ea790*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2ea790*, lpNumberOfBytesWritten=0x18fdd8*=0x2080, lpOverlapped=0x0) returned 1 [0264.700] CloseHandle (hObject=0xdc) returned 1 [0264.700] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.701] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x172 [0264.701] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17a) returned 0x28f1f8 [0264.701] ReadFile (in: hFile=0xdc, lpBuffer=0x28f200, nNumberOfBytesToRead=0x172, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x28f200*, lpNumberOfBytesRead=0x18fdf0*=0x172, lpOverlapped=0x0) returned 1 [0264.702] CloseHandle (hObject=0xdc) returned 1 [0264.702] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif")) returned 1 [0264.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.703] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.703] GetTickCount () returned 0x51776 [0264.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.703] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.704] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.704] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686\\....\\temporaryfile")) returned 0 [0264.705] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686\\temporaryfile")) returned 1 [0264.706] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b523c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b523c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.706] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.706] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.706] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.706] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.706] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686\\temporaryfile")) returned 1 [0264.706] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.707] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.707] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333686" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333686")) returned 1 [0264.707] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 0 [0264.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.708] WriteFile (in: hFile=0xdc, lpBuffer=0x259e78*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesWritten=0x18fdd8*=0x178, lpOverlapped=0x0) returned 1 [0264.708] CloseHandle (hObject=0xdc) returned 1 [0264.709] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.710] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x899 [0264.710] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8a1) returned 0x2450048 [0264.710] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x899, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x899, lpOverlapped=0x0) returned 1 [0264.711] CloseHandle (hObject=0xdc) returned 1 [0264.711] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif")) returned 1 [0264.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.712] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.712] GetTickCount () returned 0x51785 [0264.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.712] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.713] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.713] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333701\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333701\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333701\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333701\\....\\temporaryfile")) returned 0 [0264.714] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333701\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333701\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333701\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333701\\temporaryfile")) returned 1 [0264.715] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333701\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.715] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.715] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.715] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333701\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.715] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.716] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.716] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.716] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333701\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333701\\temporaryfile")) returned 1 [0264.716] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b78520, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b78520, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b78520, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.716] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.716] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333701" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333701")) returned 1 [0264.716] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 0 [0264.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.717] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x8a0, lpOverlapped=0x0) returned 1 [0264.718] CloseHandle (hObject=0xdc) returned 1 [0264.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.719] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2c3 [0264.719] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2cb) returned 0x259e70 [0264.719] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2c3, lpOverlapped=0x0) returned 1 [0264.720] CloseHandle (hObject=0xdc) returned 1 [0264.720] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif")) returned 1 [0264.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.720] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.720] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.721] GetTickCount () returned 0x51795 [0264.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.721] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.721] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717\\....\\temporaryfile")) returned 0 [0264.722] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717\\temporaryfile")) returned 1 [0264.723] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.723] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.723] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.723] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.723] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.723] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.723] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.723] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717\\temporaryfile")) returned 1 [0264.723] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.724] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.724] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717")) returned 1 [0264.724] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 0 [0264.724] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.725] WriteFile (in: hFile=0xdc, lpBuffer=0x25a150*, nNumberOfBytesToWrite=0x2c8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a150*, lpNumberOfBytesWritten=0x18fdd8*=0x2c8, lpOverlapped=0x0) returned 1 [0264.725] CloseHandle (hObject=0xdc) returned 1 [0264.726] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.726] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x253 [0264.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x25b) returned 0x2a8a88 [0264.726] ReadFile (in: hFile=0xdc, lpBuffer=0x2a8a90, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2a8a90*, lpNumberOfBytesRead=0x18fdf0*=0x253, lpOverlapped=0x0) returned 1 [0264.727] CloseHandle (hObject=0xdc) returned 1 [0264.727] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif")) returned 1 [0264.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.728] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.728] GetTickCount () returned 0x51795 [0264.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.728] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.729] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.729] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717\\....\\temporaryfile")) returned 0 [0264.729] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717\\temporaryfile")) returned 1 [0264.731] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.731] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.731] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.731] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.731] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.731] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.731] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.731] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717\\temporaryfile")) returned 1 [0264.731] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2b9e680, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2b9e680, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2b9e680, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.731] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.731] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333717" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333717")) returned 1 [0264.731] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 0 [0264.732] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.732] WriteFile (in: hFile=0xdc, lpBuffer=0x2a8cf8*, nNumberOfBytesToWrite=0x258, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2a8cf8*, lpNumberOfBytesWritten=0x18fdd8*=0x258, lpOverlapped=0x0) returned 1 [0264.733] CloseHandle (hObject=0xdc) returned 1 [0264.734] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.734] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x4d5 [0264.734] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4dd) returned 0x259e70 [0264.734] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x4d5, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x4d5, lpOverlapped=0x0) returned 1 [0264.736] CloseHandle (hObject=0xdc) returned 1 [0264.736] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif")) returned 1 [0264.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.737] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.737] GetTickCount () returned 0x517a4 [0264.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.737] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.737] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.737] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732\\....\\temporaryfile")) returned 0 [0264.738] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732\\temporaryfile")) returned 1 [0264.739] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.739] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.739] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.739] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.739] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.739] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.739] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.739] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732\\temporaryfile")) returned 1 [0264.740] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.740] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.740] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732")) returned 1 [0264.740] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 0 [0264.740] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.741] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x4e0, lpOverlapped=0x0) returned 1 [0264.742] CloseHandle (hObject=0xdc) returned 1 [0264.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.742] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x31f [0264.742] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x327) returned 0x259e70 [0264.742] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x31f, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x31f, lpOverlapped=0x0) returned 1 [0264.744] CloseHandle (hObject=0xdc) returned 1 [0264.744] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif")) returned 1 [0264.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.745] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.745] GetTickCount () returned 0x517a4 [0264.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.745] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.746] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.746] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732\\....\\temporaryfile")) returned 0 [0264.746] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732\\temporaryfile")) returned 1 [0264.748] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.748] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.748] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.748] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.748] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.748] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.748] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.748] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732\\temporaryfile")) returned 1 [0264.748] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bc47e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bc47e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bc47e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.748] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.748] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333732" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333732")) returned 1 [0264.749] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 0 [0264.749] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.749] WriteFile (in: hFile=0xdc, lpBuffer=0x25a1a8*, nNumberOfBytesToWrite=0x328, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a1a8*, lpNumberOfBytesWritten=0x18fdd8*=0x328, lpOverlapped=0x0) returned 1 [0264.750] CloseHandle (hObject=0xdc) returned 1 [0264.751] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.751] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5ac [0264.751] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x5b4) returned 0x259e70 [0264.751] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5ac, lpOverlapped=0x0) returned 1 [0264.753] CloseHandle (hObject=0xdc) returned 1 [0264.753] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif")) returned 1 [0264.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.753] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.753] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.754] GetTickCount () returned 0x517b4 [0264.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.754] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.754] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748\\....\\temporaryfile")) returned 0 [0264.755] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748\\temporaryfile")) returned 1 [0264.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.756] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.756] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.756] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.756] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.756] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.756] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.756] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748\\temporaryfile")) returned 1 [0264.757] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.757] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.757] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748")) returned 1 [0264.757] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 0 [0264.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.758] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x5b0, lpOverlapped=0x0) returned 1 [0264.759] CloseHandle (hObject=0xdc) returned 1 [0264.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.760] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2e2 [0264.760] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2ea) returned 0x259e70 [0264.760] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2e2, lpOverlapped=0x0) returned 1 [0264.762] CloseHandle (hObject=0xdc) returned 1 [0264.762] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif")) returned 1 [0264.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.763] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.763] GetTickCount () returned 0x517b4 [0264.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.763] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.764] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.764] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.764] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748\\....\\temporaryfile")) returned 0 [0264.764] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748\\temporaryfile")) returned 1 [0264.766] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.766] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.766] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.766] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.766] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.766] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.766] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.766] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748\\temporaryfile")) returned 1 [0264.767] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2bea940, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2bea940, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2bea940, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.767] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.767] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333748" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333748")) returned 1 [0264.767] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 0 [0264.767] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.768] WriteFile (in: hFile=0xdc, lpBuffer=0x25a170*, nNumberOfBytesToWrite=0x2e8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a170*, lpNumberOfBytesWritten=0x18fdd8*=0x2e8, lpOverlapped=0x0) returned 1 [0264.769] CloseHandle (hObject=0xdc) returned 1 [0264.769] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.770] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x387 [0264.770] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x38f) returned 0x259e70 [0264.770] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x387, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x387, lpOverlapped=0x0) returned 1 [0264.771] CloseHandle (hObject=0xdc) returned 1 [0264.771] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif")) returned 1 [0264.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.772] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.772] GetTickCount () returned 0x517c4 [0264.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.772] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.773] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764\\....\\temporaryfile")) returned 0 [0264.773] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764\\temporaryfile")) returned 1 [0264.774] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c10aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c10aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c10aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.775] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c10aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c10aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c10aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.775] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c10aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c10aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c10aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.775] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c10aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c10aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c10aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.775] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c10aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c10aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c10aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.775] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c10aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c10aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c10aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.775] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.775] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764\\temporaryfile")) returned 1 [0264.775] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c10aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c10aa0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c10aa0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.775] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.775] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764")) returned 1 [0264.775] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 0 [0264.776] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.776] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x390, lpOverlapped=0x0) returned 1 [0264.777] CloseHandle (hObject=0xdc) returned 1 [0264.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.779] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x2d7 [0264.779] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2df) returned 0x259e70 [0264.779] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x2d7, lpOverlapped=0x0) returned 1 [0264.780] CloseHandle (hObject=0xdc) returned 1 [0264.780] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif")) returned 1 [0264.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.781] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.781] GetTickCount () returned 0x517c4 [0264.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.781] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.782] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.782] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764\\....\\temporaryfile")) returned 0 [0264.782] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764\\temporaryfile")) returned 1 [0264.784] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c10aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.784] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c10aa0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.784] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.784] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.784] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.784] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.784] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.784] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764\\temporaryfile")) returned 1 [0264.784] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.784] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.784] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333764" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333764")) returned 1 [0264.785] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 0 [0264.785] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.786] WriteFile (in: hFile=0xdc, lpBuffer=0x25a160*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a160*, lpNumberOfBytesWritten=0x18fdd8*=0x2e0, lpOverlapped=0x0) returned 1 [0264.786] CloseHandle (hObject=0xdc) returned 1 [0264.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.787] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3b4 [0264.787] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3bc) returned 0x259e70 [0264.787] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x3b4, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x3b4, lpOverlapped=0x0) returned 1 [0264.789] CloseHandle (hObject=0xdc) returned 1 [0264.789] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif")) returned 1 [0264.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.790] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.790] GetTickCount () returned 0x517d3 [0264.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.790] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.790] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333779\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333779\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333779\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333779\\....\\temporaryfile")) returned 0 [0264.791] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333779\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333779\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333779\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333779\\temporaryfile")) returned 1 [0264.792] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333779\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.793] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.793] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.793] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333779\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.793] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.793] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.793] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.793] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333779\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333779\\temporaryfile")) returned 1 [0264.793] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c36c00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c36c00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c36c00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.793] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.793] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333779" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333779")) returned 1 [0264.793] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 0 [0264.794] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.794] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x3b8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x3b8, lpOverlapped=0x0) returned 1 [0264.795] CloseHandle (hObject=0xdc) returned 1 [0264.795] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.796] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x494 [0264.796] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x49c) returned 0x259e70 [0264.796] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x494, lpOverlapped=0x0) returned 1 [0264.797] CloseHandle (hObject=0xdc) returned 1 [0264.797] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif")) returned 1 [0264.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.798] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.798] GetTickCount () returned 0x517e3 [0264.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.798] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.799] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.799] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795\\....\\temporaryfile")) returned 0 [0264.799] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795\\temporaryfile")) returned 1 [0264.801] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.801] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.801] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.801] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.801] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.801] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.801] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.801] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795\\temporaryfile")) returned 1 [0264.801] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.801] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.802] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795")) returned 1 [0264.802] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 0 [0264.802] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.803] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x498, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x498, lpOverlapped=0x0) returned 1 [0264.804] CloseHandle (hObject=0xdc) returned 1 [0264.804] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.804] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x3b9 [0264.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3c1) returned 0x259e70 [0264.804] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x3b9, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x3b9, lpOverlapped=0x0) returned 1 [0264.806] CloseHandle (hObject=0xdc) returned 1 [0264.806] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif")) returned 1 [0264.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.807] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.807] GetTickCount () returned 0x517e3 [0264.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.807] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.807] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.808] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795\\....\\temporaryfile")) returned 0 [0264.808] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795\\temporaryfile")) returned 1 [0264.810] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.810] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.810] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.810] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.810] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.810] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795\\temporaryfile")) returned 1 [0264.810] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c5cd60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c5cd60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c5cd60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.810] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.810] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333795" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333795")) returned 1 [0264.810] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 0 [0264.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.811] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x3c0, lpOverlapped=0x0) returned 1 [0264.812] CloseHandle (hObject=0xdc) returned 1 [0264.812] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.814] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x304 [0264.814] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x30c) returned 0x259e70 [0264.814] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x304, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x304, lpOverlapped=0x0) returned 1 [0264.815] CloseHandle (hObject=0xdc) returned 1 [0264.815] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif")) returned 1 [0264.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.816] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.816] GetTickCount () returned 0x517f2 [0264.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.816] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.817] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.817] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333810\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333810\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333810\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333810\\....\\temporaryfile")) returned 0 [0264.817] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333810\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333810\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333810\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333810\\temporaryfile")) returned 1 [0264.824] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333810\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c82ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c82ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c82ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.824] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c82ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c82ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c82ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.824] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c82ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c82ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c82ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.824] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333810\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c82ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c82ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c82ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c82ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c82ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c82ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.824] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c82ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c82ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c82ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.824] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.824] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333810\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333810\\temporaryfile")) returned 1 [0264.824] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2c82ec0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2c82ec0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2c82ec0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.824] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.825] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333810" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333810")) returned 1 [0264.825] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 0 [0264.825] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.826] WriteFile (in: hFile=0xdc, lpBuffer=0x25a190*, nNumberOfBytesToWrite=0x308, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25a190*, lpNumberOfBytesWritten=0x18fdd8*=0x308, lpOverlapped=0x0) returned 1 [0264.826] CloseHandle (hObject=0xdc) returned 1 [0264.827] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.827] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xe44 [0264.827] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe4c) returned 0x2450048 [0264.827] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xe44, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xe44, lpOverlapped=0x0) returned 1 [0264.829] CloseHandle (hObject=0xdc) returned 1 [0264.829] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif")) returned 1 [0264.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.830] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.830] GetTickCount () returned 0x51802 [0264.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.830] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.831] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.831] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826\\....\\temporaryfile")) returned 0 [0264.831] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826\\temporaryfile")) returned 1 [0264.832] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.833] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.833] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.833] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.833] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.833] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826\\temporaryfile")) returned 1 [0264.833] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.833] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.833] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826")) returned 1 [0264.833] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 0 [0264.834] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.834] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xe48, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xe48, lpOverlapped=0x0) returned 1 [0264.835] CloseHandle (hObject=0xdc) returned 1 [0264.836] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.836] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x446 [0264.836] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x44e) returned 0x259e70 [0264.836] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x446, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x446, lpOverlapped=0x0) returned 1 [0264.838] CloseHandle (hObject=0xdc) returned 1 [0264.838] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif")) returned 1 [0264.838] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.838] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.839] GetTickCount () returned 0x51802 [0264.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.839] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.839] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826\\....\\temporaryfile")) returned 0 [0264.840] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826\\temporaryfile")) returned 1 [0264.841] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.841] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.841] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.841] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.842] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.842] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.842] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.842] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826\\temporaryfile")) returned 1 [0264.842] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ca9020, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ca9020, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ca9020, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.842] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.842] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333826" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333826")) returned 1 [0264.842] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 0 [0264.842] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.843] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x450, lpOverlapped=0x0) returned 1 [0264.844] CloseHandle (hObject=0xdc) returned 1 [0264.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.845] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x5fe [0264.845] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x606) returned 0x259e70 [0264.845] ReadFile (in: hFile=0xdc, lpBuffer=0x259e78, nNumberOfBytesToRead=0x5fe, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdf0*=0x5fe, lpOverlapped=0x0) returned 1 [0264.846] CloseHandle (hObject=0xdc) returned 1 [0264.846] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif")) returned 1 [0264.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.847] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.847] GetTickCount () returned 0x51812 [0264.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.847] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.848] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.848] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842\\....\\temporaryfile")) returned 0 [0264.848] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842\\temporaryfile")) returned 1 [0264.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.850] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.850] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.850] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.850] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.850] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842\\temporaryfile")) returned 1 [0264.850] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.851] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.851] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842")) returned 1 [0264.851] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 0 [0264.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.852] WriteFile (in: hFile=0xdc, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x608, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdd8*=0x608, lpOverlapped=0x0) returned 1 [0264.853] CloseHandle (hObject=0xdc) returned 1 [0264.853] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.853] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x76c [0264.853] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x774) returned 0x2450048 [0264.853] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x76c, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x76c, lpOverlapped=0x0) returned 1 [0264.855] CloseHandle (hObject=0xdc) returned 1 [0264.855] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif")) returned 1 [0264.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.856] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.856] GetTickCount () returned 0x51812 [0264.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.856] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.856] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842\\....\\temporaryfile")) returned 0 [0264.857] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842\\temporaryfile")) returned 1 [0264.858] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.858] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.859] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.859] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.859] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.859] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.859] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842\\temporaryfile")) returned 1 [0264.859] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ccf180, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ccf180, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ccf180, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.859] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.859] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333842" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333842")) returned 1 [0264.859] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 0 [0264.859] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.860] WriteFile (in: hFile=0xdc, lpBuffer=0x24507d0*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x24507d0*, lpNumberOfBytesWritten=0x18fdd8*=0x770, lpOverlapped=0x0) returned 1 [0264.861] CloseHandle (hObject=0xdc) returned 1 [0264.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.862] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x12d1 [0264.862] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12d9) returned 0x25b528 [0264.862] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x12d1, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x12d1, lpOverlapped=0x0) returned 1 [0264.863] CloseHandle (hObject=0xdc) returned 1 [0264.863] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif")) returned 1 [0264.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.864] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.864] GetTickCount () returned 0x51821 [0264.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.864] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.865] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.865] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857\\....\\temporaryfile")) returned 0 [0264.865] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857\\temporaryfile")) returned 1 [0264.867] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.867] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.867] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.867] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.867] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.867] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.867] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.867] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857\\temporaryfile")) returned 1 [0264.867] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.868] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.868] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857")) returned 1 [0264.868] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 0 [0264.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.869] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x12d8, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x12d8, lpOverlapped=0x0) returned 1 [0264.870] CloseHandle (hObject=0xdc) returned 1 [0264.870] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.871] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x102b [0264.871] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1033) returned 0x25b528 [0264.871] ReadFile (in: hFile=0xdc, lpBuffer=0x25b530, nNumberOfBytesToRead=0x102b, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdf0*=0x102b, lpOverlapped=0x0) returned 1 [0264.873] CloseHandle (hObject=0xdc) returned 1 [0264.873] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif")) returned 1 [0264.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.874] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.874] GetTickCount () returned 0x51821 [0264.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.874] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.875] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.875] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857\\....\\temporaryfile")) returned 0 [0264.875] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857\\temporaryfile")) returned 1 [0264.877] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d1b440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d1b440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.877] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d1b440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d1b440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.877] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.877] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.877] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.877] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.877] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.877] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857\\temporaryfile")) returned 1 [0264.877] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2cf52e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2cf52e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2cf52e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.877] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.878] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333857" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333857")) returned 1 [0264.878] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 0 [0264.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.879] WriteFile (in: hFile=0xdc, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdd8*=0x1030, lpOverlapped=0x0) returned 1 [0264.880] CloseHandle (hObject=0xdc) returned 1 [0264.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.881] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa16 [0264.881] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa1e) returned 0x2450048 [0264.881] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xa16, lpOverlapped=0x0) returned 1 [0264.883] CloseHandle (hObject=0xdc) returned 1 [0264.883] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf")) returned 1 [0264.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.884] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.884] GetTickCount () returned 0x51831 [0264.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.884] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.884] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333873\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333873\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333873\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333873\\....\\temporaryfile")) returned 0 [0264.885] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333873\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333873\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333873\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333873\\temporaryfile")) returned 1 [0264.886] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333873\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d1b440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d1b440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d1b440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.886] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d1b440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d1b440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d1b440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.886] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d1b440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d1b440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d1b440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.887] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333873\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d1b440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d1b440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d1b440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.887] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d1b440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d1b440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d1b440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.887] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d1b440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d1b440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d1b440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.887] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.887] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333873\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333873\\temporaryfile")) returned 1 [0264.887] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d1b440, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d1b440, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d1b440, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.887] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.887] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333873" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333873")) returned 1 [0264.887] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned 0 [0264.888] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.888] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa20, lpOverlapped=0x0) returned 1 [0264.889] CloseHandle (hObject=0xdc) returned 1 [0264.889] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.890] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xb96 [0264.890] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xb9e) returned 0x2450048 [0264.890] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xb96, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xb96, lpOverlapped=0x0) returned 1 [0264.891] CloseHandle (hObject=0xdc) returned 1 [0264.892] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf")) returned 1 [0264.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.892] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.892] GetTickCount () returned 0x51840 [0264.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.892] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.893] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.893] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888\\....\\temporaryfile")) returned 0 [0264.894] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888\\temporaryfile")) returned 1 [0264.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.895] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.895] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.895] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.895] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.895] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.895] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.895] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888\\temporaryfile")) returned 1 [0264.896] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.896] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.896] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888")) returned 1 [0264.896] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned 0 [0264.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.897] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xba0, lpOverlapped=0x0) returned 1 [0264.898] CloseHandle (hObject=0xdc) returned 1 [0264.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.898] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0xa16 [0264.898] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xa1e) returned 0x2450048 [0264.898] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0xa16, lpOverlapped=0x0) returned 1 [0264.900] CloseHandle (hObject=0xdc) returned 1 [0264.900] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf")) returned 1 [0264.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.901] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.901] GetTickCount () returned 0x51840 [0264.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.901] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.902] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888\\....\\temporaryfile")) returned 0 [0264.902] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888\\temporaryfile")) returned 1 [0264.904] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.904] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.904] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.904] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.904] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.904] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888\\temporaryfile")) returned 1 [0264.904] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d415a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d415a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d415a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.904] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.904] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333888" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333888")) returned 1 [0264.905] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned 0 [0264.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.905] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0xa20, lpOverlapped=0x0) returned 1 [0264.907] CloseHandle (hObject=0xdc) returned 1 [0264.907] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.907] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x976 [0264.907] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x97e) returned 0x2450048 [0264.907] ReadFile (in: hFile=0xdc, lpBuffer=0x2450050, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdf0*=0x976, lpOverlapped=0x0) returned 1 [0264.909] CloseHandle (hObject=0xdc) returned 1 [0264.909] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf")) returned 1 [0264.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0264.910] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.910] GetTickCount () returned 0x51850 [0264.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.910] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.910] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904\\...."), lpSecurityAttributes=0x256228) returned 1 [0264.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904\\....\\temporaryfile")) returned 0 [0264.911] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904\\temporaryfile")) returned 1 [0264.912] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.912] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.912] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.912] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.913] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.913] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.913] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.913] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904\\temporaryfile")) returned 1 [0264.913] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.913] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.913] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904")) returned 1 [0264.913] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned 0 [0264.913] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.914] WriteFile (in: hFile=0xdc, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdd8*=0x980, lpOverlapped=0x0) returned 1 [0264.915] CloseHandle (hObject=0xdc) returned 1 [0264.915] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.916] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x18fdf0 | out: lpFileSizeHigh=0x18fdf0*=0x0) returned 0x1b03 [0264.916] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b0b) returned 0x2c4a70 [0264.916] ReadFile (in: hFile=0xdc, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b03, lpNumberOfBytesRead=0x18fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdf0*=0x1b03, lpOverlapped=0x0) returned 1 [0264.918] CloseHandle (hObject=0xdc) returned 1 [0264.918] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0264.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.919] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc9c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.919] GetTickCount () returned 0x51850 [0264.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0264.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.919] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0264.919] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904\\....\\temporaryfile")) returned 0 [0264.920] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904\\temporaryfile")) returned 1 [0264.921] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\*", lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.921] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.921] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.921] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\TemporaryFile\\*", lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.922] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.922] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18f814 | out: lpFindFileData=0x18f814*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.922] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904\\temporaryfile")) returned 1 [0264.922] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb74 | out: lpFindFileData=0x18fb74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d67700, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d67700, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d67700, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.922] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.922] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333904" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333904")) returned 1 [0264.922] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 0 [0264.923] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xdc [0264.923] WriteFile (in: hFile=0xdc, lpBuffer=0x2e8708*, nNumberOfBytesToWrite=0x1b08, lpNumberOfBytesWritten=0x18fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2e8708*, lpNumberOfBytesWritten=0x18fdd8*=0x1b08, lpOverlapped=0x0) returned 1 [0264.924] CloseHandle (hObject=0xdc) returned 1 [0264.924] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0264.925] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa2d8d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d8d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0264.925] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0264.927] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0264.927] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56406370, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.928] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56406370, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0264.928] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56406370, dwReserved1=0x1d301bf, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0264.928] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56406370, dwReserved1=0x1d301bf, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0264.928] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0264.928] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x18fcc8 | out: lpFindFileData=0x18fcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56406370, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0264.928] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9e0 [0264.928] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56406370, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0264.929] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x56406370, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0264.929] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x56406370, dwReserved1=0x1d301bf, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0264.929] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd) returned 0x256210 [0264.930] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.930] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xf77 [0264.930] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf7f) returned 0x2450048 [0264.930] ReadFile (in: hFile=0xe0, lpBuffer=0x2450050, nNumberOfBytesToRead=0xf77, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdd0*=0xf77, lpOverlapped=0x0) returned 1 [0264.931] CloseHandle (hObject=0xe0) returned 1 [0264.931] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif")) returned 1 [0264.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0264.932] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.932] GetTickCount () returned 0x51860 [0264.932] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0264.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.933] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0264.933] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333920\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0264.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333920\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333920\\....\\temporaryfile")) returned 0 [0264.934] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333920\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333920\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333920\\temporaryfile")) returned 1 [0264.935] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333920\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d8d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d8d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d8d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.935] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d8d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d8d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d8d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.935] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d8d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d8d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d8d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.935] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333920\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d8d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d8d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d8d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0264.935] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d8d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d8d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d8d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.935] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d8d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d8d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d8d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.935] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0264.935] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333920\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333920\\temporaryfile")) returned 1 [0264.936] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d8d860, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2d8d860, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2d8d860, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.936] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.936] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333920" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333920")) returned 1 [0264.936] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned 0 [0264.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.937] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0xf80, lpOverlapped=0x0) returned 1 [0264.938] CloseHandle (hObject=0xe0) returned 1 [0264.938] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.939] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2f [0264.939] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x37) returned 0x289b50 [0264.939] ReadFile (in: hFile=0xe0, lpBuffer=0x289b58, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x289b58*, lpNumberOfBytesRead=0x18fdd0*=0x2f, lpOverlapped=0x0) returned 1 [0264.940] CloseHandle (hObject=0xe0) returned 1 [0264.940] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif")) returned 1 [0264.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.941] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.941] GetTickCount () returned 0x5186f [0264.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0264.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289c10 [0264.941] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935\\....\\temporaryfile")) returned 0 [0264.942] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935\\temporaryfile")) returned 1 [0264.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0264.943] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.943] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c50 [0264.943] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.943] FindNextFileA (in: hFindFile=0x289c50, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289c2c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.943] FindClose (in: hFindFile=0x289c50 | out: hFindFile=0x289c50) returned 1 [0264.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935\\temporaryfile")) returned 1 [0264.944] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.944] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0264.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935")) returned 1 [0264.944] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 0 [0264.944] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.946] WriteFile (in: hFile=0xe0, lpBuffer=0x2579d0*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2579d0*, lpNumberOfBytesWritten=0x18fdb8*=0x38, lpOverlapped=0x0) returned 1 [0264.947] CloseHandle (hObject=0xe0) returned 1 [0264.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.948] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2dd [0264.948] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2e5) returned 0x259e70 [0264.948] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x2dd, lpOverlapped=0x0) returned 1 [0264.949] CloseHandle (hObject=0xe0) returned 1 [0264.950] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif")) returned 1 [0264.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0264.951] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.951] GetTickCount () returned 0x5186f [0264.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0264.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.951] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0264.951] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0264.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935\\....\\temporaryfile")) returned 0 [0264.952] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935\\temporaryfile")) returned 1 [0264.954] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.954] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.954] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.954] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0264.954] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.954] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.954] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0264.954] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935\\temporaryfile")) returned 1 [0264.954] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2db39c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2db39c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2db39c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.954] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.954] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333935" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333935")) returned 1 [0264.955] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned 0 [0264.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.961] WriteFile (in: hFile=0xe0, lpBuffer=0x25a168*, nNumberOfBytesToWrite=0x2e8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25a168*, lpNumberOfBytesWritten=0x18fdb8*=0x2e8, lpOverlapped=0x0) returned 1 [0264.962] CloseHandle (hObject=0xe0) returned 1 [0264.962] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.962] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x595 [0264.962] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x59d) returned 0x259e70 [0264.963] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x595, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x595, lpOverlapped=0x0) returned 1 [0264.964] CloseHandle (hObject=0xe0) returned 1 [0264.964] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif")) returned 1 [0264.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.965] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.965] GetTickCount () returned 0x5187f [0264.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0264.965] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.966] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0264.966] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333951\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333951\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333951\\....\\temporaryfile")) returned 0 [0264.966] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333951\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333951\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333951\\temporaryfile")) returned 1 [0264.968] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333951\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dd9b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dd9b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dd9b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.968] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dd9b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dd9b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dd9b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.968] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dd9b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dd9b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dd9b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.968] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333951\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dd9b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dd9b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dd9b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0264.968] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dd9b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dd9b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dd9b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.968] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dd9b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dd9b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dd9b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.968] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0264.968] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333951\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333951\\temporaryfile")) returned 1 [0264.968] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dd9b20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dd9b20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dd9b20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.968] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.969] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333951" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333951")) returned 1 [0264.969] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned 0 [0264.969] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.970] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x5a0, lpOverlapped=0x0) returned 1 [0264.971] CloseHandle (hObject=0xe0) returned 1 [0264.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.972] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x11d1 [0264.972] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x11d9) returned 0x25b528 [0264.972] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x11d1, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x11d1, lpOverlapped=0x0) returned 1 [0264.974] CloseHandle (hObject=0xe0) returned 1 [0264.974] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif")) returned 1 [0264.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0264.975] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.975] GetTickCount () returned 0x5188e [0264.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0264.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.975] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0264.975] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0264.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966\\....\\temporaryfile")) returned 0 [0264.976] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966\\temporaryfile")) returned 1 [0264.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.978] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.978] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.978] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0264.978] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.978] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.978] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0264.978] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966\\temporaryfile")) returned 1 [0264.978] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.978] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.978] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966")) returned 1 [0264.978] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned 0 [0264.979] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.979] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x11d8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x11d8, lpOverlapped=0x0) returned 1 [0264.980] CloseHandle (hObject=0xe0) returned 1 [0264.981] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.981] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1323 [0264.981] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x132b) returned 0x25b528 [0264.981] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x1323, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x1323, lpOverlapped=0x0) returned 1 [0264.983] CloseHandle (hObject=0xe0) returned 1 [0264.983] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif")) returned 1 [0264.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0264.984] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.984] GetTickCount () returned 0x5188e [0264.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0264.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.984] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0264.984] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966\\...."), lpSecurityAttributes=0x256210) returned 1 [0264.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966\\....\\temporaryfile")) returned 0 [0264.985] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966\\temporaryfile")) returned 1 [0264.987] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e25de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e25de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.987] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e25de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e25de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.987] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.987] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0264.987] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.987] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.987] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0264.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966\\temporaryfile")) returned 1 [0264.987] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2dffc80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2dffc80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2dffc80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.987] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.987] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333966" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333966")) returned 1 [0264.988] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned 0 [0264.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.989] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1328, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1328, lpOverlapped=0x0) returned 1 [0264.990] CloseHandle (hObject=0xe0) returned 1 [0264.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.990] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x43e [0264.990] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x446) returned 0x259e70 [0264.990] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x43e, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x43e, lpOverlapped=0x0) returned 1 [0264.992] CloseHandle (hObject=0xe0) returned 1 [0264.992] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif")) returned 1 [0264.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0264.993] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0264.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0264.993] GetTickCount () returned 0x5189e [0264.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0264.993] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0264.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0264.994] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333982\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333982\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0264.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333982\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333982\\....\\temporaryfile")) returned 0 [0264.994] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333982\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333982\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333982\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333982\\temporaryfile")) returned 1 [0264.996] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333982\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e25de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e25de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e25de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0264.996] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e25de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e25de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e25de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.996] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e25de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e25de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e25de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0264.996] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333982\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e25de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e25de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e25de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0264.996] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e25de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e25de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e25de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.996] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e25de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e25de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e25de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0264.996] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0264.996] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333982\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333982\\temporaryfile")) returned 1 [0264.996] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e25de0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e25de0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e25de0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0264.997] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0264.997] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333982" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333982")) returned 1 [0264.997] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned 0 [0264.997] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.998] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x448, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x448, lpOverlapped=0x0) returned 1 [0264.999] CloseHandle (hObject=0xe0) returned 1 [0264.999] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0264.999] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x412 [0264.999] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x41a) returned 0x259e70 [0264.999] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x412, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x412, lpOverlapped=0x0) returned 1 [0265.001] CloseHandle (hObject=0xe0) returned 1 [0265.001] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif")) returned 1 [0265.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.002] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.002] GetTickCount () returned 0x518ae [0265.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.002] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.002] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.003] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998\\....\\temporaryfile")) returned 0 [0265.003] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998\\temporaryfile")) returned 1 [0265.004] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.005] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.005] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.005] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.005] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.005] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.005] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.005] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998\\temporaryfile")) returned 1 [0265.005] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.005] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.005] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998")) returned 1 [0265.005] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned 0 [0265.006] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.006] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x418, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x418, lpOverlapped=0x0) returned 1 [0265.007] CloseHandle (hObject=0xe0) returned 1 [0265.007] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.008] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1b7f [0265.008] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1b87) returned 0x2c4a70 [0265.008] ReadFile (in: hFile=0xe0, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1b7f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1b7f, lpOverlapped=0x0) returned 1 [0265.010] CloseHandle (hObject=0xe0) returned 1 [0265.010] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif")) returned 1 [0265.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.011] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.011] GetTickCount () returned 0x518ae [0265.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.011] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.012] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.012] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998\\....\\temporaryfile")) returned 0 [0265.013] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998\\temporaryfile")) returned 1 [0265.014] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.015] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.015] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.015] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.015] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.015] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.015] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.015] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998\\temporaryfile")) returned 1 [0265.015] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e4bf40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e4bf40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e4bf40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.015] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.015] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18333998" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18333998")) returned 1 [0265.015] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned 0 [0265.016] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.017] WriteFile (in: hFile=0xe0, lpBuffer=0x2ea708*, nNumberOfBytesToWrite=0x1b88, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesWritten=0x18fdb8*=0x1b88, lpOverlapped=0x0) returned 1 [0265.018] CloseHandle (hObject=0xe0) returned 1 [0265.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.019] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x6ad [0265.019] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6b5) returned 0x2450048 [0265.019] ReadFile (in: hFile=0xe0, lpBuffer=0x2450050, nNumberOfBytesToRead=0x6ad, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdd0*=0x6ad, lpOverlapped=0x0) returned 1 [0265.020] CloseHandle (hObject=0xe0) returned 1 [0265.020] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif")) returned 1 [0265.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.021] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.021] GetTickCount () returned 0x518bd [0265.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.021] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.022] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.022] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013\\....\\temporaryfile")) returned 0 [0265.022] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013\\temporaryfile")) returned 1 [0265.024] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.024] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.024] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.024] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.024] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.024] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.024] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.024] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013\\temporaryfile")) returned 1 [0265.024] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.025] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.025] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013")) returned 1 [0265.025] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned 0 [0265.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.026] WriteFile (in: hFile=0xe0, lpBuffer=0x2450710*, nNumberOfBytesToWrite=0x6b8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450710*, lpNumberOfBytesWritten=0x18fdb8*=0x6b8, lpOverlapped=0x0) returned 1 [0265.027] CloseHandle (hObject=0xe0) returned 1 [0265.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.027] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x69f [0265.027] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x6a7) returned 0x259e70 [0265.027] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x69f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x69f, lpOverlapped=0x0) returned 1 [0265.029] CloseHandle (hObject=0xe0) returned 1 [0265.029] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif")) returned 1 [0265.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.030] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.030] GetTickCount () returned 0x518bd [0265.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.030] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.030] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013\\....\\temporaryfile")) returned 0 [0265.031] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013\\temporaryfile")) returned 1 [0265.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e98200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e98200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.033] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e98200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e98200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.033] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.033] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.033] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.033] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.033] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.033] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013\\temporaryfile")) returned 1 [0265.033] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e720a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e720a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e720a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.033] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.033] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334013" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334013")) returned 1 [0265.033] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned 0 [0265.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.034] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x6a8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x6a8, lpOverlapped=0x0) returned 1 [0265.035] CloseHandle (hObject=0xe0) returned 1 [0265.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.036] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x124a [0265.036] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1252) returned 0x25b528 [0265.036] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x124a, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x124a, lpOverlapped=0x0) returned 1 [0265.038] CloseHandle (hObject=0xe0) returned 1 [0265.038] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif")) returned 1 [0265.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.039] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.039] GetTickCount () returned 0x518cd [0265.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.039] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.039] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334029\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334029\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334029\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334029\\....\\temporaryfile")) returned 0 [0265.040] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334029\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334029\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334029\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334029\\temporaryfile")) returned 1 [0265.041] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334029\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e98200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e98200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e98200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.042] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e98200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e98200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e98200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.042] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e98200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e98200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e98200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.042] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334029\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e98200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e98200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e98200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.042] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e98200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e98200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e98200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.042] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e98200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e98200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e98200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.042] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.042] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334029\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334029\\temporaryfile")) returned 1 [0265.042] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2e98200, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2e98200, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2e98200, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.042] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.042] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334029" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334029")) returned 1 [0265.042] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned 0 [0265.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.043] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1250, lpOverlapped=0x0) returned 1 [0265.044] CloseHandle (hObject=0xe0) returned 1 [0265.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.045] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2017 [0265.045] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x201f) returned 0x2ea700 [0265.045] ReadFile (in: hFile=0xe0, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x2017, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fdd0*=0x2017, lpOverlapped=0x0) returned 1 [0265.047] CloseHandle (hObject=0xe0) returned 1 [0265.047] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif")) returned 1 [0265.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.048] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.048] GetTickCount () returned 0x518dc [0265.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.048] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.049] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.049] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044\\....\\temporaryfile")) returned 0 [0265.049] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044\\temporaryfile")) returned 1 [0265.050] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.051] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.051] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.051] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.051] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.051] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.051] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.051] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044\\temporaryfile")) returned 1 [0265.051] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.051] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.051] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044")) returned 1 [0265.051] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned 0 [0265.052] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.052] WriteFile (in: hFile=0xe0, lpBuffer=0x2ec730*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ec730*, lpNumberOfBytesWritten=0x18fdb8*=0x2020, lpOverlapped=0x0) returned 1 [0265.053] CloseHandle (hObject=0xe0) returned 1 [0265.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.057] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x20ee [0265.057] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20f6) returned 0x2ea700 [0265.057] ReadFile (in: hFile=0xe0, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x20ee, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fdd0*=0x20ee, lpOverlapped=0x0) returned 1 [0265.058] CloseHandle (hObject=0xe0) returned 1 [0265.058] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif")) returned 1 [0265.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.059] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.059] GetTickCount () returned 0x518dc [0265.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.059] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.060] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044\\....\\temporaryfile")) returned 0 [0265.061] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044\\temporaryfile")) returned 1 [0265.062] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.062] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.062] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.062] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.063] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.063] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.063] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.063] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044\\temporaryfile")) returned 1 [0265.063] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ebe360, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ebe360, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ebe360, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.063] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.063] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334044" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334044")) returned 1 [0265.063] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned 0 [0265.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.064] WriteFile (in: hFile=0xe0, lpBuffer=0x2ec808*, nNumberOfBytesToWrite=0x20f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ec808*, lpNumberOfBytesWritten=0x18fdb8*=0x20f8, lpOverlapped=0x0) returned 1 [0265.065] CloseHandle (hObject=0xe0) returned 1 [0265.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.066] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2026 [0265.066] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x202e) returned 0x2ea700 [0265.066] ReadFile (in: hFile=0xe0, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x2026, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fdd0*=0x2026, lpOverlapped=0x0) returned 1 [0265.068] CloseHandle (hObject=0xe0) returned 1 [0265.068] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif")) returned 1 [0265.068] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.069] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.069] GetTickCount () returned 0x518ec [0265.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.069] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.069] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060\\....\\temporaryfile")) returned 0 [0265.070] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060\\temporaryfile")) returned 1 [0265.071] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ee44c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ee44c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ee44c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.071] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ee44c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ee44c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ee44c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.071] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ee44c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ee44c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ee44c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.071] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ee44c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ee44c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ee44c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.071] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ee44c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ee44c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ee44c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.071] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ee44c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ee44c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ee44c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.071] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.071] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060\\temporaryfile")) returned 1 [0265.072] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ee44c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2ee44c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2ee44c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.072] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.072] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060")) returned 1 [0265.072] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned 0 [0265.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.073] WriteFile (in: hFile=0xe0, lpBuffer=0x2ec740*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ec740*, lpNumberOfBytesWritten=0x18fdb8*=0x2030, lpOverlapped=0x0) returned 1 [0265.074] CloseHandle (hObject=0xe0) returned 1 [0265.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.075] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2313 [0265.075] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x231b) returned 0x2ea700 [0265.075] ReadFile (in: hFile=0xe0, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x2313, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fdd0*=0x2313, lpOverlapped=0x0) returned 1 [0265.076] CloseHandle (hObject=0xe0) returned 1 [0265.076] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif")) returned 1 [0265.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.077] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.077] GetTickCount () returned 0x518ec [0265.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.077] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.078] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.078] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060\\....\\temporaryfile")) returned 0 [0265.079] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060\\temporaryfile")) returned 1 [0265.080] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ee44c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2ee44c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.080] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.080] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.081] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.081] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.081] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.081] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060\\temporaryfile")) returned 1 [0265.081] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.081] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.081] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334060" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334060")) returned 1 [0265.081] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned 0 [0265.082] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.082] WriteFile (in: hFile=0xe0, lpBuffer=0x2eca30*, nNumberOfBytesToWrite=0x2318, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2eca30*, lpNumberOfBytesWritten=0x18fdb8*=0x2318, lpOverlapped=0x0) returned 1 [0265.083] CloseHandle (hObject=0xe0) returned 1 [0265.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.084] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1f8f [0265.084] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1f97) returned 0x2ea700 [0265.084] ReadFile (in: hFile=0xe0, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x1f8f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fdd0*=0x1f8f, lpOverlapped=0x0) returned 1 [0265.086] CloseHandle (hObject=0xe0) returned 1 [0265.086] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif")) returned 1 [0265.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.087] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.087] GetTickCount () returned 0x518fc [0265.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.087] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.087] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334076\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334076\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334076\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334076\\....\\temporaryfile")) returned 0 [0265.088] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334076\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334076\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334076\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334076\\temporaryfile")) returned 1 [0265.089] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334076\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.090] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334076\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.090] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.090] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.090] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334076\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334076\\temporaryfile")) returned 1 [0265.090] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f0a620, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f0a620, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f0a620, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.090] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.090] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334076" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334076")) returned 1 [0265.090] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned 0 [0265.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.091] WriteFile (in: hFile=0xe0, lpBuffer=0x2ec6a8*, nNumberOfBytesToWrite=0x1f98, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ec6a8*, lpNumberOfBytesWritten=0x18fdb8*=0x1f98, lpOverlapped=0x0) returned 1 [0265.092] CloseHandle (hObject=0xe0) returned 1 [0265.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.093] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xe1d [0265.093] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xe25) returned 0x2450048 [0265.093] ReadFile (in: hFile=0xe0, lpBuffer=0x2450050, nNumberOfBytesToRead=0xe1d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdd0*=0xe1d, lpOverlapped=0x0) returned 1 [0265.095] CloseHandle (hObject=0xe0) returned 1 [0265.095] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif")) returned 1 [0265.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.096] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.096] GetTickCount () returned 0x5190b [0265.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.096] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.096] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334091\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334091\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334091\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334091\\....\\temporaryfile")) returned 0 [0265.102] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334091\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334091\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334091\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334091\\temporaryfile")) returned 1 [0265.103] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334091\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f30780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f30780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f30780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.103] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f30780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f30780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f30780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.103] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f30780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f30780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f30780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.103] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334091\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f30780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f30780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f30780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.103] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f30780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f30780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f30780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.104] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f30780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f30780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f30780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.104] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334091\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334091\\temporaryfile")) returned 1 [0265.104] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f30780, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f30780, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f30780, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.104] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.104] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334091" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334091")) returned 1 [0265.104] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned 0 [0265.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.105] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xe28, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0xe28, lpOverlapped=0x0) returned 1 [0265.106] CloseHandle (hObject=0xe0) returned 1 [0265.106] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.107] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x38c [0265.107] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x394) returned 0x259e70 [0265.107] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x38c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x38c, lpOverlapped=0x0) returned 1 [0265.109] CloseHandle (hObject=0xe0) returned 1 [0265.109] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif")) returned 1 [0265.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.110] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.110] GetTickCount () returned 0x5191b [0265.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.110] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.111] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.111] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.111] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107\\....\\temporaryfile")) returned 0 [0265.111] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107\\temporaryfile")) returned 1 [0265.113] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.113] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.113] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.113] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.113] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.113] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.113] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.113] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107\\temporaryfile")) returned 1 [0265.113] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.113] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.113] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107")) returned 1 [0265.114] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 0 [0265.114] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.114] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x390, lpOverlapped=0x0) returned 1 [0265.115] CloseHandle (hObject=0xe0) returned 1 [0265.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.117] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x987 [0265.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x98f) returned 0x2450048 [0265.117] ReadFile (in: hFile=0xe0, lpBuffer=0x2450050, nNumberOfBytesToRead=0x987, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdd0*=0x987, lpOverlapped=0x0) returned 1 [0265.118] CloseHandle (hObject=0xe0) returned 1 [0265.118] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif")) returned 1 [0265.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.119] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.119] GetTickCount () returned 0x5191b [0265.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.119] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.120] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.120] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.120] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107\\....\\temporaryfile")) returned 0 [0265.120] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107\\temporaryfile")) returned 1 [0265.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.122] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.122] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.122] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.122] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.122] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.122] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.122] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107\\temporaryfile")) returned 1 [0265.122] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f568e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f568e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f568e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.123] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.123] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334107" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334107")) returned 1 [0265.123] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 0 [0265.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.124] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x990, lpOverlapped=0x0) returned 1 [0265.125] CloseHandle (hObject=0xe0) returned 1 [0265.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.126] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x37d [0265.126] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x385) returned 0x259e70 [0265.126] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x37d, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x37d, lpOverlapped=0x0) returned 1 [0265.127] CloseHandle (hObject=0xe0) returned 1 [0265.127] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif")) returned 1 [0265.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.128] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.128] GetTickCount () returned 0x5192a [0265.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.128] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.129] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.129] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122\\....\\temporaryfile")) returned 0 [0265.129] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122\\temporaryfile")) returned 1 [0265.130] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.131] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.131] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.131] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.131] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.131] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.131] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.131] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122\\temporaryfile")) returned 1 [0265.131] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.131] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.131] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122")) returned 1 [0265.131] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 0 [0265.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.132] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x388, lpOverlapped=0x0) returned 1 [0265.133] CloseHandle (hObject=0xe0) returned 1 [0265.133] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.134] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x516 [0265.134] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x51e) returned 0x259e70 [0265.134] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x516, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x516, lpOverlapped=0x0) returned 1 [0265.135] CloseHandle (hObject=0xe0) returned 1 [0265.135] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif")) returned 1 [0265.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.136] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.136] GetTickCount () returned 0x5192a [0265.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.136] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.137] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.137] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122\\....\\temporaryfile")) returned 0 [0265.138] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122\\temporaryfile")) returned 1 [0265.139] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.139] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.139] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.139] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.139] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.139] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.139] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.139] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122\\temporaryfile")) returned 1 [0265.140] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2f7ca40, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2f7ca40, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2f7ca40, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.140] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.140] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334122" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334122")) returned 1 [0265.140] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 0 [0265.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.141] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x520, lpOverlapped=0x0) returned 1 [0265.142] CloseHandle (hObject=0xe0) returned 1 [0265.142] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.143] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x2fd [0265.143] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x305) returned 0x259e70 [0265.143] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x2fd, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x2fd, lpOverlapped=0x0) returned 1 [0265.144] CloseHandle (hObject=0xe0) returned 1 [0265.144] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif")) returned 1 [0265.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.145] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.145] GetTickCount () returned 0x5193a [0265.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.145] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.146] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.146] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138\\....\\temporaryfile")) returned 0 [0265.146] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138\\temporaryfile")) returned 1 [0265.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.148] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.148] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.148] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.148] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.148] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.148] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.148] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138\\temporaryfile")) returned 1 [0265.148] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.148] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.148] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138")) returned 1 [0265.149] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 0 [0265.149] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.149] WriteFile (in: hFile=0xe0, lpBuffer=0x25a188*, nNumberOfBytesToWrite=0x308, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25a188*, lpNumberOfBytesWritten=0x18fdb8*=0x308, lpOverlapped=0x0) returned 1 [0265.150] CloseHandle (hObject=0xe0) returned 1 [0265.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.151] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x996 [0265.151] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x99e) returned 0x2450048 [0265.151] ReadFile (in: hFile=0xe0, lpBuffer=0x2450050, nNumberOfBytesToRead=0x996, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdd0*=0x996, lpOverlapped=0x0) returned 1 [0265.153] CloseHandle (hObject=0xe0) returned 1 [0265.153] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif")) returned 1 [0265.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.154] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.154] GetTickCount () returned 0x5193a [0265.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.154] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.155] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.155] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138\\....\\temporaryfile")) returned 0 [0265.156] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138\\temporaryfile")) returned 1 [0265.157] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.157] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.157] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.157] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.157] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.157] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.157] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.157] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138\\temporaryfile")) returned 1 [0265.158] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fa2ba0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fa2ba0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fa2ba0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.158] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.158] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334138" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334138")) returned 1 [0265.158] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 0 [0265.158] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.159] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x9a0, lpOverlapped=0x0) returned 1 [0265.160] CloseHandle (hObject=0xe0) returned 1 [0265.160] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.161] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x90c [0265.161] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x914) returned 0x2450048 [0265.161] ReadFile (in: hFile=0xe0, lpBuffer=0x2450050, nNumberOfBytesToRead=0x90c, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdd0*=0x90c, lpOverlapped=0x0) returned 1 [0265.162] CloseHandle (hObject=0xe0) returned 1 [0265.162] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif")) returned 1 [0265.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.163] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.163] GetTickCount () returned 0x5194a [0265.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.163] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.164] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.164] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334154\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334154\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334154\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334154\\....\\temporaryfile")) returned 0 [0265.164] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334154\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334154\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334154\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334154\\temporaryfile")) returned 1 [0265.166] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334154\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fc8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fc8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fc8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.166] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fc8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fc8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fc8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.166] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fc8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fc8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fc8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.166] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334154\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fc8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fc8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fc8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.166] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fc8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fc8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fc8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.166] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fc8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fc8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fc8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.166] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.166] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334154\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334154\\temporaryfile")) returned 1 [0265.166] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2fc8d00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2fc8d00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2fc8d00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.166] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.167] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334154" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334154")) returned 1 [0265.167] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 0 [0265.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.168] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x910, lpOverlapped=0x0) returned 1 [0265.169] CloseHandle (hObject=0xe0) returned 1 [0265.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.169] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x581 [0265.169] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x589) returned 0x259e70 [0265.169] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x581, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x581, lpOverlapped=0x0) returned 1 [0265.171] CloseHandle (hObject=0xe0) returned 1 [0265.171] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif")) returned 1 [0265.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.172] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.172] GetTickCount () returned 0x51959 [0265.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.172] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.172] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169\\....\\temporaryfile")) returned 0 [0265.173] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169\\temporaryfile")) returned 1 [0265.174] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.174] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.175] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.175] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.175] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.175] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.175] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.175] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169\\temporaryfile")) returned 1 [0265.175] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.175] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.175] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169")) returned 1 [0265.175] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 0 [0265.176] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.176] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x588, lpOverlapped=0x0) returned 1 [0265.177] CloseHandle (hObject=0xe0) returned 1 [0265.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.178] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x15fa [0265.178] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1602) returned 0x2c4a70 [0265.178] ReadFile (in: hFile=0xe0, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x15fa, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdd0*=0x15fa, lpOverlapped=0x0) returned 1 [0265.180] CloseHandle (hObject=0xe0) returned 1 [0265.180] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif")) returned 1 [0265.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.181] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.181] GetTickCount () returned 0x51959 [0265.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.181] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.181] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169\\....\\temporaryfile")) returned 0 [0265.182] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169\\temporaryfile")) returned 1 [0265.183] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.184] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.184] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.184] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.184] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.184] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.184] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169\\temporaryfile")) returned 1 [0265.184] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2feee60, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa2feee60, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa2feee60, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.184] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.184] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334169" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334169")) returned 1 [0265.184] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 0 [0265.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.185] WriteFile (in: hFile=0xe0, lpBuffer=0x2ea708*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesWritten=0x18fdb8*=0x1600, lpOverlapped=0x0) returned 1 [0265.186] CloseHandle (hObject=0xe0) returned 1 [0265.187] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.188] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x3ef [0265.188] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3f7) returned 0x259e70 [0265.188] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x3ef, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x3ef, lpOverlapped=0x0) returned 1 [0265.189] CloseHandle (hObject=0xe0) returned 1 [0265.189] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif")) returned 1 [0265.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.190] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.190] GetTickCount () returned 0x51969 [0265.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.191] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185\\....\\temporaryfile")) returned 0 [0265.191] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185\\temporaryfile")) returned 1 [0265.193] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.193] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.193] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.193] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.193] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.193] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.193] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.193] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185\\temporaryfile")) returned 1 [0265.194] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.194] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.194] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185")) returned 1 [0265.194] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 0 [0265.194] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.195] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x3f8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x3f8, lpOverlapped=0x0) returned 1 [0265.196] CloseHandle (hObject=0xe0) returned 1 [0265.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.197] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x97f [0265.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x987) returned 0x2450048 [0265.197] ReadFile (in: hFile=0xe0, lpBuffer=0x2450050, nNumberOfBytesToRead=0x97f, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdd0*=0x97f, lpOverlapped=0x0) returned 1 [0265.198] CloseHandle (hObject=0xe0) returned 1 [0265.198] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif")) returned 1 [0265.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.199] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.199] GetTickCount () returned 0x51969 [0265.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.199] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.200] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.200] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185\\....\\temporaryfile")) returned 0 [0265.200] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185\\temporaryfile")) returned 1 [0265.202] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.202] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.202] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.202] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.202] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.202] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.202] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.202] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185\\temporaryfile")) returned 1 [0265.203] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3014fc0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3014fc0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3014fc0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.203] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.203] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334185" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334185")) returned 1 [0265.203] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 0 [0265.203] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.204] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0x988, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0x988, lpOverlapped=0x0) returned 1 [0265.205] CloseHandle (hObject=0xe0) returned 1 [0265.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.206] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x579 [0265.206] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x581) returned 0x259e70 [0265.206] ReadFile (in: hFile=0xe0, lpBuffer=0x259e78, nNumberOfBytesToRead=0x579, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x259e78*, lpNumberOfBytesRead=0x18fdd0*=0x579, lpOverlapped=0x0) returned 1 [0265.207] CloseHandle (hObject=0xe0) returned 1 [0265.207] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif")) returned 1 [0265.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.208] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.208] GetTickCount () returned 0x51978 [0265.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.208] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.209] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.209] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200\\....\\temporaryfile")) returned 0 [0265.209] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200\\temporaryfile")) returned 1 [0265.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.211] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.211] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.211] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.211] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.211] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.211] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200\\temporaryfile")) returned 1 [0265.211] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.211] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.211] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200")) returned 1 [0265.212] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 0 [0265.212] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.212] WriteFile (in: hFile=0xe0, lpBuffer=0x2450050*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesWritten=0x18fdb8*=0x580, lpOverlapped=0x0) returned 1 [0265.213] CloseHandle (hObject=0xe0) returned 1 [0265.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.214] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x4abc [0265.214] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x4ac4) returned 0x2ea700 [0265.214] ReadFile (in: hFile=0xe0, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x4abc, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fdd0*=0x4abc, lpOverlapped=0x0) returned 1 [0265.216] CloseHandle (hObject=0xe0) returned 1 [0265.216] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif")) returned 1 [0265.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.217] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.217] GetTickCount () returned 0x51978 [0265.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.217] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.217] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.218] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200\\....\\temporaryfile")) returned 0 [0265.218] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200\\temporaryfile")) returned 1 [0265.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.220] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.220] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.220] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.220] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.220] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.220] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.220] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200\\temporaryfile")) returned 1 [0265.220] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa303b120, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa303b120, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa303b120, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.220] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.220] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334200" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334200")) returned 1 [0265.221] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 0 [0265.221] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.222] WriteFile (in: hFile=0xe0, lpBuffer=0x2ef1d8*, nNumberOfBytesToWrite=0x4ac0, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ef1d8*, lpNumberOfBytesWritten=0x18fdb8*=0x4ac0, lpOverlapped=0x0) returned 1 [0265.223] CloseHandle (hObject=0xe0) returned 1 [0265.223] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.224] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x1653 [0265.224] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x165b) returned 0x2c4a70 [0265.224] ReadFile (in: hFile=0xe0, lpBuffer=0x2c4a78, nNumberOfBytesToRead=0x1653, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2c4a78*, lpNumberOfBytesRead=0x18fdd0*=0x1653, lpOverlapped=0x0) returned 1 [0265.232] CloseHandle (hObject=0xe0) returned 1 [0265.232] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif")) returned 1 [0265.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.234] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.234] GetTickCount () returned 0x51988 [0265.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.234] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.235] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334216\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334216\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334216\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334216\\....\\temporaryfile")) returned 0 [0265.235] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334216\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334216\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334216\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334216\\temporaryfile")) returned 1 [0265.237] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334216\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3061280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.237] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3061280, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.237] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.237] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334216\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.237] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.237] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.237] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334216\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334216\\temporaryfile")) returned 1 [0265.238] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.238] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.238] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334216" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334216")) returned 1 [0265.238] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 0 [0265.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.241] WriteFile (in: hFile=0xe0, lpBuffer=0x2ea708*, nNumberOfBytesToWrite=0x1658, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesWritten=0x18fdb8*=0x1658, lpOverlapped=0x0) returned 1 [0265.242] CloseHandle (hObject=0xe0) returned 1 [0265.242] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.243] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0x136b [0265.244] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1373) returned 0x25b528 [0265.244] ReadFile (in: hFile=0xe0, lpBuffer=0x25b530, nNumberOfBytesToRead=0x136b, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x25b530*, lpNumberOfBytesRead=0x18fdd0*=0x136b, lpOverlapped=0x0) returned 1 [0265.245] CloseHandle (hObject=0xe0) returned 1 [0265.245] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif")) returned 1 [0265.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561e0 [0265.246] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.246] GetTickCount () returned 0x51998 [0265.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.246] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.247] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.247] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334232\\...."), lpSecurityAttributes=0x2561e0) returned 1 [0265.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334232\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334232\\....\\temporaryfile")) returned 0 [0265.247] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334232\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334232\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334232\\temporaryfile")) returned 1 [0265.249] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334232\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.249] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.249] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334232\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.249] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.249] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.249] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.249] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334232\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334232\\temporaryfile")) returned 1 [0265.250] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30873e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30873e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30873e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.250] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.250] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334232" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334232")) returned 1 [0265.250] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 0 [0265.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.251] WriteFile (in: hFile=0xe0, lpBuffer=0x29b468*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x29b468*, lpNumberOfBytesWritten=0x18fdb8*=0x1370, lpOverlapped=0x0) returned 1 [0265.252] CloseHandle (hObject=0xe0) returned 1 [0265.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.253] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x18fdd0 | out: lpFileSizeHigh=0x18fdd0*=0x0) returned 0xbc4 [0265.254] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xbcc) returned 0x2450048 [0265.254] ReadFile (in: hFile=0xe0, lpBuffer=0x2450050, nNumberOfBytesToRead=0xbc4, lpNumberOfBytesRead=0x18fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2450050*, lpNumberOfBytesRead=0x18fdd0*=0xbc4, lpOverlapped=0x0) returned 1 [0265.255] CloseHandle (hObject=0xe0) returned 1 [0265.255] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif")) returned 1 [0265.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256210 [0265.256] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fc7c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.256] GetTickCount () returned 0x519a7 [0265.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x256198 [0265.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea48 [0265.256] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b50 [0265.256] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334247\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334247\\...."), lpSecurityAttributes=0x256210) returned 1 [0265.257] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334247\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334247\\....\\temporaryfile")) returned 0 [0265.257] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334247\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334247\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334247\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334247\\temporaryfile")) returned 1 [0265.259] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334247\\*", lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30ad540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30ad540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30ad540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b50 [0265.259] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30ad540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30ad540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30ad540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.259] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30ad540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30ad540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30ad540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.259] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334247\\TemporaryFile\\*", lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30ad540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30ad540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30ad540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289c10 [0265.259] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30ad540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30ad540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30ad540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.259] FindNextFileA (in: hFindFile=0x289c10, lpFindFileData=0x18f7f4 | out: lpFindFileData=0x18f7f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30ad540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30ad540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30ad540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289b6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.259] FindClose (in: hFindFile=0x289c10 | out: hFindFile=0x289c10) returned 1 [0265.259] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334247\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334247\\temporaryfile")) returned 1 [0265.259] FindNextFileA (in: hFindFile=0x289b50, lpFindFileData=0x18fb54 | out: lpFindFileData=0x18fb54*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30ad540, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30ad540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30ad540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.259] FindClose (in: hFindFile=0x289b50 | out: hFindFile=0x289b50) returned 1 [0265.259] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334247" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334247")) returned 1 [0265.260] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 0 [0265.260] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xe0 [0265.260] WriteFile (in: hFile=0xe0, lpBuffer=0x25f588*, nNumberOfBytesToWrite=0xbc8, lpNumberOfBytesWritten=0x18fdb8, lpOverlapped=0x0 | out: lpBuffer=0x25f588*, lpNumberOfBytesWritten=0x18fdb8*=0xbc8, lpOverlapped=0x0) returned 1 [0265.261] CloseHandle (hObject=0xe0) returned 1 [0265.262] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.262] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x18fca8 | out: lpFindFileData=0x18fca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa30ad540, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30ad540, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3a0043, dwReserved1=0x50005c, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.262] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x2) returned 0x25c9b0 [0265.262] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.262] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.262] FindClose (in: hFindFile=0x289a90 | out: hFindFile=0x289a90) returned 1 [0265.263] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5127f1f0, dwReserved1=0x1d301bf, cFileName=".", cAlternateFileName="")) returned 0x289ad0 [0265.265] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5127f1f0, dwReserved1=0x1d301bf, cFileName="..", cAlternateFileName="")) returned 1 [0265.266] FindNextFileA (in: hFindFile=0x289ad0, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x5127f1f0, dwReserved1=0x1d301bf, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0265.266] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xf) returned 0x256228 [0265.266] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.268] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xd0aa [0265.268] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xd0b2) returned 0x2ea700 [0265.268] ReadFile (in: hFile=0xd8, lpBuffer=0x2ea708, nNumberOfBytesToRead=0xd0aa, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fe10*=0xd0aa, lpOverlapped=0x0) returned 1 [0265.270] CloseHandle (hObject=0xd8) returned 1 [0265.270] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx")) returned 1 [0265.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0265.271] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.271] GetTickCount () returned 0x519b7 [0265.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.271] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.272] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.272] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334263\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334263\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0265.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334263\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334263\\....\\temporaryfile")) returned 0 [0265.272] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334263\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334263\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334263\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334263\\temporaryfile")) returned 1 [0265.274] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334263\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30d36a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30d36a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30d36a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.274] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30d36a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30d36a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30d36a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.274] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30d36a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30d36a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30d36a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.274] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334263\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30d36a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30d36a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30d36a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.274] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30d36a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30d36a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30d36a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.274] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30d36a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30d36a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30d36a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.274] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.274] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334263\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334263\\temporaryfile")) returned 1 [0265.274] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30d36a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30d36a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30d36a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.274] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.274] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334263" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334263")) returned 1 [0265.275] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned 0 [0265.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.276] WriteFile (in: hFile=0xd8, lpBuffer=0x2f77c8*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2f77c8*, lpNumberOfBytesWritten=0x18fdf8*=0xd0b0, lpOverlapped=0x0) returned 1 [0265.278] CloseHandle (hObject=0xd8) returned 1 [0265.278] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.279] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x11098 [0265.279] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x110a0) returned 0x2ea700 [0265.279] ReadFile (in: hFile=0xd8, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x11098, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fe10*=0x11098, lpOverlapped=0x0) returned 1 [0265.281] CloseHandle (hObject=0xd8) returned 1 [0265.281] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx")) returned 1 [0265.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0265.283] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.283] GetTickCount () returned 0x519c6 [0265.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.283] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.283] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334278\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334278\\...."), lpSecurityAttributes=0x256228) returned 1 [0265.284] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334278\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334278\\....\\temporaryfile")) returned 0 [0265.284] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334278\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334278\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334278\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334278\\temporaryfile")) returned 1 [0265.285] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334278\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30f9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30f9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30f9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.285] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30f9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30f9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30f9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.285] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30f9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30f9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30f9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.285] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334278\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30f9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30f9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30f9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.286] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30f9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30f9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30f9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.286] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30f9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30f9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30f9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.286] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.286] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334278\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334278\\temporaryfile")) returned 1 [0265.286] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa30f9800, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa30f9800, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa30f9800, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.286] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.286] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334278" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334278")) returned 1 [0265.286] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned 0 [0265.288] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.288] WriteFile (in: hFile=0xd8, lpBuffer=0x2fb7b0*, nNumberOfBytesToWrite=0x110a0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2fb7b0*, lpNumberOfBytesWritten=0x18fdf8*=0x110a0, lpOverlapped=0x0) returned 1 [0265.290] CloseHandle (hObject=0xd8) returned 1 [0265.291] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.292] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x3f427 [0265.292] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x3f42f) returned 0x2350048 [0265.293] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x3f427, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x3f427, lpOverlapped=0x0) returned 1 [0265.301] CloseHandle (hObject=0xd8) returned 1 [0265.301] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx")) returned 1 [0265.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0265.303] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.303] GetTickCount () returned 0x519d6 [0265.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.303] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.304] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.304] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334294\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0265.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334294\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334294\\....\\temporaryfile")) returned 0 [0265.304] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334294\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334294\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334294\\temporaryfile")) returned 1 [0265.306] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334294\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa311f960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa311f960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa311f960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.306] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa311f960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa311f960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa311f960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.306] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa311f960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa311f960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa311f960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.306] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334294\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa311f960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa311f960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa311f960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.306] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa311f960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa311f960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa311f960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.306] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa311f960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa311f960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa311f960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.306] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.306] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334294\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334294\\temporaryfile")) returned 1 [0265.306] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa311f960, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa311f960, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa311f960, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.306] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.307] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334294" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334294")) returned 1 [0265.307] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned 0 [0265.314] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.314] WriteFile (in: hFile=0xd8, lpBuffer=0x238f488*, nNumberOfBytesToWrite=0x3f430, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x238f488*, lpNumberOfBytesWritten=0x18fdf8*=0x3f430, lpOverlapped=0x0) returned 1 [0265.320] CloseHandle (hObject=0xd8) returned 1 [0265.323] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.324] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x15a56 [0265.324] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x15a5e) returned 0x2ea700 [0265.324] ReadFile (in: hFile=0xd8, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x15a56, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fe10*=0x15a56, lpOverlapped=0x0) returned 1 [0265.326] CloseHandle (hObject=0xd8) returned 1 [0265.326] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx")) returned 1 [0265.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0265.327] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.327] GetTickCount () returned 0x519e6 [0265.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.327] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.328] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.328] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334310\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334310\\...."), lpSecurityAttributes=0x256228) returned 1 [0265.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334310\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334310\\....\\temporaryfile")) returned 0 [0265.329] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334310\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334310\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334310\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334310\\temporaryfile")) returned 1 [0265.330] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334310\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3145ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3145ac0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.330] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.330] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334310\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.330] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.330] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.331] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.331] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334310\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334310\\temporaryfile")) returned 1 [0265.331] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.331] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.331] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334310" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334310")) returned 1 [0265.331] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned 0 [0265.334] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.334] WriteFile (in: hFile=0xd8, lpBuffer=0x300170*, nNumberOfBytesToWrite=0x15a60, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x300170*, lpNumberOfBytesWritten=0x18fdf8*=0x15a60, lpOverlapped=0x0) returned 1 [0265.336] CloseHandle (hObject=0xd8) returned 1 [0265.336] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.337] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x109e5 [0265.337] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x109ed) returned 0x2ea700 [0265.337] ReadFile (in: hFile=0xd8, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x109e5, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fe10*=0x109e5, lpOverlapped=0x0) returned 1 [0265.339] CloseHandle (hObject=0xd8) returned 1 [0265.339] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx")) returned 1 [0265.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0265.340] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.340] GetTickCount () returned 0x519f5 [0265.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.340] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.341] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.341] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334325\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334325\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0265.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334325\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334325\\....\\temporaryfile")) returned 0 [0265.342] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334325\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334325\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334325\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334325\\temporaryfile")) returned 1 [0265.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334325\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.343] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.343] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.343] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334325\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.344] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.344] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.344] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334325\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334325\\temporaryfile")) returned 1 [0265.344] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa316bc20, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa316bc20, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa316bc20, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.344] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.344] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334325" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334325")) returned 1 [0265.344] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned 0 [0265.345] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.346] WriteFile (in: hFile=0xd8, lpBuffer=0x2fb100*, nNumberOfBytesToWrite=0x109f0, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2fb100*, lpNumberOfBytesWritten=0x18fdf8*=0x109f0, lpOverlapped=0x0) returned 1 [0265.347] CloseHandle (hObject=0xd8) returned 1 [0265.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.349] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1763b [0265.349] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x17643) returned 0x2ea700 [0265.349] ReadFile (in: hFile=0xd8, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x1763b, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fe10*=0x1763b, lpOverlapped=0x0) returned 1 [0265.353] CloseHandle (hObject=0xd8) returned 1 [0265.353] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx")) returned 1 [0265.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0265.354] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.354] GetTickCount () returned 0x51a05 [0265.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.354] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.355] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.355] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334341\\...."), lpSecurityAttributes=0x256228) returned 1 [0265.355] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334341\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334341\\....\\temporaryfile")) returned 0 [0265.355] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334341\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334341\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334341\\temporaryfile")) returned 1 [0265.357] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334341\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3191d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3191d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3191d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.357] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3191d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3191d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3191d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.357] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3191d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3191d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3191d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.357] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334341\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3191d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3191d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3191d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.357] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3191d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3191d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3191d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.357] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3191d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3191d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3191d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.357] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.357] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334341\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334341\\temporaryfile")) returned 1 [0265.357] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3191d80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3191d80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3191d80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.358] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.358] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334341" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334341")) returned 1 [0265.358] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned 0 [0265.360] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.360] WriteFile (in: hFile=0xd8, lpBuffer=0x301d58*, nNumberOfBytesToWrite=0x17640, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x301d58*, lpNumberOfBytesWritten=0x18fdf8*=0x17640, lpOverlapped=0x0) returned 1 [0265.362] CloseHandle (hObject=0xd8) returned 1 [0265.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.363] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x9ff03 [0265.363] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9ff0b) returned 0x1d70020 [0265.364] ReadFile (in: hFile=0xd8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x9ff03, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe10*=0x9ff03, lpOverlapped=0x0) returned 1 [0265.387] CloseHandle (hObject=0xd8) returned 1 [0265.387] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx")) returned 1 [0265.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0265.393] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.393] GetTickCount () returned 0x51a34 [0265.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.393] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.393] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334388\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334388\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0265.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334388\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334388\\....\\temporaryfile")) returned 0 [0265.394] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334388\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334388\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334388\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334388\\temporaryfile")) returned 1 [0265.395] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334388\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32041a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32041a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32041a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.396] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32041a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32041a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32041a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.396] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32041a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32041a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32041a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.396] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334388\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32041a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32041a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32041a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.396] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32041a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32041a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32041a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.396] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32041a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32041a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32041a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.396] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.396] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334388\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334388\\temporaryfile")) returned 1 [0265.396] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32041a0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32041a0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32041a0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.396] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.396] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334388" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334388")) returned 1 [0265.396] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned 0 [0265.428] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.429] WriteFile (in: hFile=0xd8, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x9ff08, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdf8*=0x9ff08, lpOverlapped=0x0) returned 1 [0265.440] CloseHandle (hObject=0xd8) returned 1 [0265.445] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.448] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x18c11 [0265.448] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x18c19) returned 0x2ea700 [0265.448] ReadFile (in: hFile=0xd8, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x18c11, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fe10*=0x18c11, lpOverlapped=0x0) returned 1 [0265.449] CloseHandle (hObject=0xd8) returned 1 [0265.450] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx")) returned 1 [0265.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0265.451] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.451] GetTickCount () returned 0x51a62 [0265.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.451] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.452] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.452] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334434\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334434\\...."), lpSecurityAttributes=0x256228) returned 1 [0265.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334434\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334434\\....\\temporaryfile")) returned 0 [0265.452] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334434\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334434\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334434\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334434\\temporaryfile")) returned 1 [0265.454] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334434\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32765c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32765c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32765c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.454] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32765c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32765c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32765c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.454] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32765c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32765c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32765c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.454] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334434\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32765c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32765c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32765c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.454] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32765c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32765c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32765c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.454] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32765c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32765c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32765c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.455] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.455] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334434\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334434\\temporaryfile")) returned 1 [0265.455] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32765c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32765c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32765c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.455] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.455] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334434" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334434")) returned 1 [0265.455] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned 0 [0265.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.457] WriteFile (in: hFile=0xd8, lpBuffer=0x303330*, nNumberOfBytesToWrite=0x18c18, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x303330*, lpNumberOfBytesWritten=0x18fdf8*=0x18c18, lpOverlapped=0x0) returned 1 [0265.459] CloseHandle (hObject=0xd8) returned 1 [0265.460] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.461] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x105f4 [0265.461] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x105fc) returned 0x2ea700 [0265.461] ReadFile (in: hFile=0xd8, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x105f4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fe10*=0x105f4, lpOverlapped=0x0) returned 1 [0265.462] CloseHandle (hObject=0xd8) returned 1 [0265.463] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx")) returned 1 [0265.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0265.464] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.464] GetTickCount () returned 0x51a72 [0265.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.464] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.464] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334450\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0265.465] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334450\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334450\\....\\temporaryfile")) returned 0 [0265.465] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334450\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334450\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334450\\temporaryfile")) returned 1 [0265.467] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334450\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa329c720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa329c720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa329c720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.467] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa329c720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa329c720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa329c720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.467] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa329c720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa329c720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa329c720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.467] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334450\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa329c720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa329c720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa329c720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.467] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa329c720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa329c720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa329c720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.467] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa329c720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa329c720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa329c720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.467] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.467] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334450\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334450\\temporaryfile")) returned 1 [0265.468] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa329c720, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa329c720, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa329c720, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.468] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.468] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334450" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334450")) returned 1 [0265.468] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned 0 [0265.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.470] WriteFile (in: hFile=0xd8, lpBuffer=0x2fad10*, nNumberOfBytesToWrite=0x105f8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2fad10*, lpNumberOfBytesWritten=0x18fdf8*=0x105f8, lpOverlapped=0x0) returned 1 [0265.471] CloseHandle (hObject=0xd8) returned 1 [0265.471] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.473] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x8ad4d [0265.473] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x8ad55) returned 0x1d70020 [0265.473] ReadFile (in: hFile=0xd8, lpBuffer=0x1d70028, nNumberOfBytesToRead=0x8ad4d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x1d70028*, lpNumberOfBytesRead=0x18fe10*=0x8ad4d, lpOverlapped=0x0) returned 1 [0265.484] CloseHandle (hObject=0xd8) returned 1 [0265.484] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx")) returned 1 [0265.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0265.489] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.489] GetTickCount () returned 0x51a91 [0265.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.489] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.490] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.490] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334481\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334481\\...."), lpSecurityAttributes=0x256228) returned 1 [0265.490] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334481\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334481\\....\\temporaryfile")) returned 0 [0265.490] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334481\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334481\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334481\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334481\\temporaryfile")) returned 1 [0265.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334481\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32e89e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32e89e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32e89e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32e89e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32e89e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32e89e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.492] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32e89e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32e89e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32e89e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.492] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334481\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32e89e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32e89e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32e89e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.492] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32e89e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32e89e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32e89e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.493] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32e89e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32e89e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32e89e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.493] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.493] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334481\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334481\\temporaryfile")) returned 1 [0265.493] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa32e89e0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa32e89e0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa32e89e0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.493] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.493] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334481" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334481")) returned 1 [0265.493] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned 0 [0265.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.522] WriteFile (in: hFile=0xd8, lpBuffer=0x2650028*, nNumberOfBytesToWrite=0x8ad58, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesWritten=0x18fdf8*=0x8ad58, lpOverlapped=0x0) returned 1 [0265.532] CloseHandle (hObject=0xd8) returned 1 [0265.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.538] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1240d [0265.538] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x12415) returned 0x2ea700 [0265.538] ReadFile (in: hFile=0xd8, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x1240d, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fe10*=0x1240d, lpOverlapped=0x0) returned 1 [0265.540] CloseHandle (hObject=0xd8) returned 1 [0265.540] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx")) returned 1 [0265.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0265.541] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.541] GetTickCount () returned 0x51ac0 [0265.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.541] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.542] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.542] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334528\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0265.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334528\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334528\\....\\temporaryfile")) returned 0 [0265.542] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334528\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334528\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334528\\temporaryfile")) returned 1 [0265.544] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334528\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa335ae00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa335ae00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa335ae00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.544] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa335ae00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa335ae00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa335ae00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.544] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa335ae00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa335ae00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa335ae00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.544] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334528\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa335ae00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa335ae00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa335ae00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.544] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa335ae00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa335ae00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa335ae00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.544] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa335ae00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa335ae00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa335ae00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.544] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.544] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334528\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334528\\temporaryfile")) returned 1 [0265.545] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa335ae00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa335ae00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa335ae00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.545] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.545] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334528" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334528")) returned 1 [0265.545] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned 0 [0265.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.547] WriteFile (in: hFile=0xd8, lpBuffer=0x2fcb28*, nNumberOfBytesToWrite=0x12418, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb28*, lpNumberOfBytesWritten=0x18fdf8*=0x12418, lpOverlapped=0x0) returned 1 [0265.549] CloseHandle (hObject=0xd8) returned 1 [0265.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.550] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x1e92c4 [0265.550] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x1e92cc) returned 0x2650020 [0265.550] ReadFile (in: hFile=0xd8, lpBuffer=0x2650028, nNumberOfBytesToRead=0x1e92c4, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2650028*, lpNumberOfBytesRead=0x18fe10*=0x1e92c4, lpOverlapped=0x0) returned 1 [0265.718] CloseHandle (hObject=0xd8) returned 1 [0265.718] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx")) returned 1 [0265.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0265.726] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.726] GetTickCount () returned 0x51b7b [0265.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.726] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.727] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334715\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334715\\...."), lpSecurityAttributes=0x256228) returned 1 [0265.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334715\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334715\\....\\temporaryfile")) returned 0 [0265.727] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334715\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334715\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334715\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334715\\temporaryfile")) returned 1 [0265.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334715\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3523e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3523e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3523e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.729] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3523e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3523e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3523e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.729] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3523e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3523e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3523e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.729] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334715\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3523e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3523e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3523e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.729] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3523e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3523e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3523e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.730] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3523e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3523e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3523e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.730] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.730] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334715\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334715\\temporaryfile")) returned 1 [0265.743] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa3523e80, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa3523e80, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa3523e80, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.743] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.743] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334715" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334715")) returned 1 [0265.743] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned 0 [0265.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.842] WriteFile (in: hFile=0xd8, lpBuffer=0x2a30028*, nNumberOfBytesToWrite=0x1e92c8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2a30028*, lpNumberOfBytesWritten=0x18fdf8*=0x1e92c8, lpOverlapped=0x0) returned 1 [0265.882] CloseHandle (hObject=0xd8) returned 1 [0265.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.900] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x555df [0265.900] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x555e7) returned 0x2350048 [0265.901] ReadFile (in: hFile=0xd8, lpBuffer=0x2350050, nNumberOfBytesToRead=0x555df, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2350050*, lpNumberOfBytesRead=0x18fe10*=0x555df, lpOverlapped=0x0) returned 1 [0265.907] CloseHandle (hObject=0xd8) returned 1 [0265.908] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx")) returned 1 [0265.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x2561c8 [0265.911] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.911] GetTickCount () returned 0x51c36 [0265.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.911] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.912] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334902\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334902\\...."), lpSecurityAttributes=0x2561c8) returned 1 [0265.912] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334902\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334902\\....\\temporaryfile")) returned 0 [0265.912] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334902\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334902\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334902\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334902\\temporaryfile")) returned 1 [0265.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334902\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa36ecf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa36ecf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa36ecf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.914] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa36ecf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa36ecf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa36ecf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.914] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa36ecf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa36ecf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa36ecf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.914] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334902\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa36ecf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa36ecf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa36ecf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.914] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa36ecf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa36ecf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa36ecf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.914] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa36ecf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa36ecf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa36ecf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.914] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.914] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334902\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334902\\temporaryfile")) returned 1 [0265.915] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa36ecf00, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa36ecf00, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa36ecf00, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.915] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.915] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334902" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334902")) returned 1 [0265.915] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned 0 [0265.924] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.925] WriteFile (in: hFile=0xd8, lpBuffer=0x23a5640*, nNumberOfBytesToWrite=0x555e8, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x23a5640*, lpNumberOfBytesWritten=0x18fdf8*=0x555e8, lpOverlapped=0x0) returned 1 [0265.933] CloseHandle (hObject=0xd8) returned 1 [0265.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.937] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0x10f61 [0265.937] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x10f69) returned 0x2ea700 [0265.937] ReadFile (in: hFile=0xd8, lpBuffer=0x2ea708, nNumberOfBytesToRead=0x10f61, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0 | out: lpBuffer=0x2ea708*, lpNumberOfBytesRead=0x18fe10*=0x10f61, lpOverlapped=0x0) returned 1 [0265.939] CloseHandle (hObject=0xd8) returned 1 [0265.939] DeleteFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx")) returned 1 [0265.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xc) returned 0x256228 [0265.940] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x18fcbc | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0265.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x26) returned 0x2596e8 [0265.940] GetTickCount () returned 0x51c56 [0265.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x9) returned 0x2561e0 [0265.940] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x2e) returned 0x28ea10 [0265.941] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x34) returned 0x289b90 [0265.941] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334934\\...."), lpSecurityAttributes=0x256228) returned 1 [0265.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334934\\....\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334934\\....\\temporaryfile")) returned 0 [0265.941] MoveFileA (lpExistingFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334934\\....\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334934\\...."), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334934\\temporaryfile")) returned 1 [0265.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334934\\*", lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa37391c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa37391c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa37391c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289b90 [0265.943] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa37391c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa37391c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa37391c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.943] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa37391c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa37391c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa37391c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 1 [0265.943] FindFirstFileA (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334934\\TemporaryFile\\*", lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa37391c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa37391c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa37391c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x289bd0 [0265.943] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa37391c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa37391c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa37391c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.943] FindNextFileA (in: hFindFile=0x289bd0, lpFindFileData=0x18f834 | out: lpFindFileData=0x18f834*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa37391c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa37391c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa37391c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x289bac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0265.944] FindClose (in: hFindFile=0x289bd0 | out: hFindFile=0x289bd0) returned 1 [0265.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334934\\TemporaryFile" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334934\\temporaryfile")) returned 1 [0265.944] FindNextFileA (in: hFindFile=0x289b90, lpFindFileData=0x18fb94 | out: lpFindFileData=0x18fb94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa37391c0, ftCreationTime.dwHighDateTime=0x1d538c3, ftLastAccessTime.dwLowDateTime=0xa37391c0, ftLastAccessTime.dwHighDateTime=0x1d538c3, ftLastWriteTime.dwLowDateTime=0xa37391c0, ftLastWriteTime.dwHighDateTime=0x1d538c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TemporaryFile", cAlternateFileName="TEMPOR~1")) returned 0 [0265.944] FindClose (in: hFindFile=0x289b90 | out: hFindFile=0x289b90) returned 1 [0265.944] RemoveDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\18334934" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\18334934")) returned 1 [0265.944] PathFileExistsA (pszPath="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned 0 [0265.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.SKYSTARS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.skystars"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.946] WriteFile (in: hFile=0xd8, lpBuffer=0x2fb680*, nNumberOfBytesToWrite=0x10f68, lpNumberOfBytesWritten=0x18fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2fb680*, lpNumberOfBytesWritten=0x18fdf8*=0x10f68, lpOverlapped=0x0) returned 1 [0265.948] CloseHandle (hObject=0xd8) returned 1 [0265.949] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xd8 [0265.950] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x18fe10 | out: lpFileSizeHigh=0x18fe10*=0x0) returned 0xc278 [0265.950] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0xc280) returned 0x2ea700 [0265.950] ReadFile (hFile=0xd8, lpBuffer=0x2ea708, nNumberOfBytesToRead=0xc278, lpNumberOfBytesRead=0x18fe10, lpOverlapped=0x0) Thread: id = 2 os_tid = 0x908